Two incidents, one tempting narrative
Microsoft began reporting Exchange Online problems on Thursday, November 12, shortly before 1 p.m. Eastern. The disruption spread to Outlook, Teams, SharePoint, Copilot and other Microsoft 365 services. On Friday afternoon, the FAA issued a nationwide ground stop, ordering departing aircraft to stay on the ground until further notice.
Back-to-back "everything is down" days invite a theory that one thing caused both. Several outlets have now addressed it directly.
- Homeland Security Secretary Markwayne Mullin said the ground stop did not stem from a threat to the US and was not linked to this week's Microsoft outage.
- Mullin said he saw no reason to connect the two incidents and called them separate issues.
- He also said he would not rule out any cause for the outage, including a cyberattack.
- The FAA attributed its issue to a temporary telecommunications outage.
- CNN, citing law enforcement sources, reported that preliminary indications were that it was not a cyberattack.
A local outlet put it plainly: both incidents remained under investigation, and timing alone does not establish a shared cause.
What happened inside Microsoft 365
Computer Weekly's reporting has the most useful technical detail. It says Microsoft tracked the problem as incident EX1550543 for Exchange Online (the Exchange Online ID comes from Computer Weekly's account), and MO1550821 for the wider Microsoft 365 suite.
According to that account:
- Microsoft said the trigger was servers becoming "unexpectedly unavailable" during automated checks. A process "responsible for establishing secure connections" was then overwhelmed and stopped servers from processing requests.
- Microsoft rolled back a recent network configuration change that correlated with the start of the impact.
- Early recovery didn't hold. Some restored servers became unresponsive again once traffic returned, and Microsoft said capacity changes weren't taking effect as expected.
- Microsoft later reported positive results for server stability after an "upstream authentication/routing configuration component patch". It widened that patch to regions entering peak business hours.
- Microsoft said it had no indication of malicious activity.
- The incident was still open when Computer Weekly went to press.
The blast radius went well beyond mail. Computer Weekly says the service health page listed Exchange Online, Outlook, Teams, SharePoint Online, OneDrive, Microsoft 365 Copilot, Defender, Planner, To Do, Intune, Purview and Power BI as degraded. NBC's live coverage described the Exchange symptoms: users might be unable to reach their mailbox through Outlook on the web, Outlook desktop, Exchange ActiveSync or REST-based connections, and delivery could be delayed. Copilot Chat could fail to load or respond, and Copilot experiences might not reach work data such as email, calendar and files.
Microsoft's explanation is a preliminary one. A formal post-incident report would be the place to look for a definitive root cause. Until then, treat the "network change plus overwhelmed connection process" account as the working diagnosis, not the final word.
What is known about the FAA stop
Transportation Secretary Sean Duffy announced the ground stop at 4:16 p.m. Eastern on Friday. The FAA advisory said "extraordinary circumstances and for reasons of safety" required all airports to be ground stopped. The source report says Duffy described a communications problem affecting all 22 regional air traffic control centers, and that FAA technicians were investigating. The FAA's public explanation does not name a failed component, a vendor or a root cause.
Why the "related" theory is weak
- Different systems. One incident hit cloud productivity services. The other hit communications serving air traffic control facilities. Airline email being down is not the same as controllers losing communications.
- Different official explanations. Microsoft pointed to an upgrade and network change. Officials described the FAA problem as a telecommunications outage.
- No evidence of shared infrastructure. None of the reporting reviewed shows the FAA's affected systems depended on Microsoft 365.
- Timing is not causation. Large, complex systems fail often. Two failures within 24 hours can easily be a coincidence.
There is a limit on this reasoning. "No evidence of a link" is not proof that no indirect dependency exists. Both investigations were still open at the time of reporting.
The SMART claim needs a caveat
The Independent Voter News piece raises the FAA's AI-assisted SMART airspace tool as a possible culprit, citing a Gizmodo critique of a rushed rollout. That is a policy concern from outside commentary. Nothing in the reporting I reviewed ties SMART to the communications failure, and the FAA has described the cause as a telecommunications problem. Treat the SMART idea as unverified speculation.
What IT admins should take from this
Computer Weekly noted this was the third major Microsoft cloud failure in four months, and it documented how heavily UK public-sector organizations lean on Microsoft 365 for email and identity. That's a general resilience lesson whatever the FAA turns out to have suffered. Practical steps include:
- Check Service health in the Microsoft 365 admin center for incident status and updates.
- Have an out-of-band channel for staff, because Teams and Outlook may be down together.
- Decide in advance how critical alerts will reach people if Exchange Online is unavailable.
- Warn users about phishing. Computer Weekly published a separate piece on outage-themed phishing risks, though I haven't verified its details.
- Read Microsoft's post-incident report when it arrives and compare it with your own impact logs.
Bottom line
Microsoft's outage appears to stem from an upgrade, a network change and an overloaded connection process. The FAA's ground stop was blamed on a telecommunications outage. Officials say the two aren't connected, and nothing published so far shows otherwise. Final reports from both Microsoft and the FAA should settle what actually failed.