Microsoft 365 Outage MO1550821: Outlook, Teams and Defender XDR Connectivity Guidance — Megathread

The incident was still active as this was written. Microsoft has given no final root cause and no confirmed time when service will be fully restored. Here is what has been confirmed, what is still unclear, and what admins should do now.

What Microsoft has confirmed​

The outage built up in stages over the day, and Microsoft's public updates followed it step by step.

• The Teams warning. Microsoft first posted that it was investigating problems with Teams in North America. On its Microsoft 365 Status account, it said it was looking into "reports of users experiencing issues when accessing or using Microsoft Teams functionality in North America" under incident TM1550488. Microsoft later said this earlier Teams problem had been fully resolved. However, Microsoft has not indicated whether the two incidents are related.
• Exchange Online gets pulled in. Microsoft then reported, according to ABC News, issues accessing Exchange Online mailboxes "through multiple connection methods in the Americas". That incident is tracked as EX1550543. Techaeris reported that Microsoft acknowledged the problem at 12:54 p.m. Eastern time.
• The scope widens. Microsoft later said "we've confirmed the issue may affect Microsoft 365 service connectivity for users in any region." That wording describes where the problem could appear. It does not mean every tenant in every region went down.
• A broader advisory. According to BleepingComputer, in a Microsoft 365 admin center advisory tracked as MO1550821, Microsoft confirmed that customers may be unable to connect to multiple services, including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR.

The Irish Independent reported the European side of the outage. Downdetector showed a jump in UK reports of Teams problems at about 6:15 p.m. local time, which is 18:15 UTC in November. Users on X also said Microsoft's public status page would not load. When the page did load, it warned that users might be unable to connect to multiple Microsoft 365 services.

Section summary: The incident started as a regional Teams and Exchange problem and grew into a multi-service connectivity advisory with possible global reach. At least three incident IDs are involved.

Missing servers, not extra traffic​

Microsoft's own account of the cause is the most useful detail so far. Its first explanation pointed to "elevated load" on part of its infrastructure across multiple regions, which sounded like a traffic surge. Microsoft later corrected that. ABC News quoted the clarification: "We determined the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure."

That is a different kind of failure. Users did not suddenly pile in. Instead, a set of servers dropped out, and the remaining servers had to carry their share of the work. Picture a supermarket where half the checkout staff go home at once. The queue is the same size, but it moves much more slowly.

According to the Irish Independent, Microsoft's update shortly after 19:10 UTC listed three steps:

• Pausing all deployments
• Moving more traffic off the affected infrastructure
• Restarting affected servers so they can return to service

Microsoft also said it was redistributing connection traffic across its global infrastructure to spread the load. Reuters quoted the company: "We're aggressively pursuing all pathways to reduce impact,"

Pausing deployments is a common step when something has gone wrong. If you don't yet know why servers are dropping out, you stop shipping changes that could add new variables. Microsoft has not said that a deployment caused the failure. Readers should treat the pause as a precaution, not an admission. Techaeris also noted that Microsoft has not attributed the Microsoft 365 outage to a cyberattack, and no threat actor has claimed it.

Section summary: Microsoft says unexpected server unavailability, not extra demand, put a strain on the remaining capacity. Its fixes are operational: freeze changes, move traffic, restart servers. The underlying fault has not been disclosed.

How big was it?​

The numbers come from user-submitted Downdetector reports, so they show how loudly people complained, not how many accounts Microsoft counted as affected. The sources also disagree, mostly because each one checked at a different time.

People described inboxes that wouldn't load and mail they couldn't send or receive. BleepingComputer reported that Downdetector complaints also covered Outlook, Microsoft 365, Teams, Copilot, Azure, OneDrive, and the Microsoft Store. A spike in Downdetector reports for a service does not prove that service failed. Many users simply report whichever Microsoft product they happened to be using.

The outage also reached beyond Microsoft's own apps. Reuters reported that it was hitting connectors used by OpenAI's and Anthropic's AI services, and that OpenAI said it was investigating an issue with Microsoft connectors in which new connections may be broken and tools are not working as expected. Many organisations now connect AI assistants to their mailboxes and SharePoint libraries, so an Exchange outage also breaks those tools.

Section summary: Peak Outlook complaints were in the six figures. The impact reached SharePoint, Copilot, Defender XDR and third-party AI connectors. None of these figures is an official count of affected users.

What admins should do now​

This is a service-side incident. Most of the fixes are in Microsoft's hands, but there is still plenty for IT staff to do.

• Go to Service health in the Microsoft 365 admin center. Look up EX1550543 and MO1550821, which several outlets confirmed, and TM1550488 for the earlier Teams problem. These posts are tied to your tenant and usually carry more detail than public social media updates.
• Don't rely only on the public status page. Users reported that it would not load during the incident. Microsoft's X account and the admin center are useful backups.
• Confirm it's this incident before you troubleshoot locally. Check whether the failing workloads match the advisory: Exchange Online, Teams, SharePoint Online, M365 Copilot and Defender XDR. If they don't match, you may have a separate tenant or client issue.
• Head off the wrong fixes at the help desk. Password resets, reinstalling Outlook, rebuilding profiles and changing network settings will not fix a server-capacity problem in Microsoft's datacenters. They only add tickets.
• Log what is affected. Record which workloads, sites and user groups are hit and when. You'll want that for the post-incident review and any SLA discussion.
• Use backup channels. For urgent messages, use whatever alternative your organisation has approved. If you had to work out which channel that is during the outage, add it to the next planning meeting.

Two security points are often missed. Defender XDR was on the list of possibly affected services, so security teams should check whether alerting or portal access was disrupted. They should also expect phishing campaigns that use the outage as a hook, such as fake "Microsoft 365 service restoration" emails asking users to sign in again.

For end users: save unsent drafts locally, don't keep forcing sign-outs, and try again later. Microsoft hasn't offered a workaround that is guaranteed to work. Repeating the same failed action ten more times is not one either.

Section summary: Use admin center Service health for tenant-specific updates. Confirm the incident before troubleshooting locally, keep the help desk away from fixes that can't work, and watch for phishing that uses the outage as bait.

The second major outage this year​

This isn't the first time 2026 has looked like this. TechRadar covered a major outage on January 22 that hit Outlook, 365 and Teams. That one ran into the next day under advisory MO1221364, and TechRadar summed up its cause as a humdrum server capacity issue. A day earlier, Tom's Guide reported that Microsoft was looking into a possible third-party networking issue affecting access to Teams and Outlook.

Capacity trouble in January and servers dropping out unexpectedly in November are different failures. They have something in common, though: Microsoft 365 is extremely resilient until a fault spreads far enough that "redistribute traffic" stops being enough. Parade, citing SQ magazine, said Microsoft 365 has an active user base of approximately 321 million, with nearly 4 million companies utilizing the Microsoft 365 suite. At that size, even a partial outage affects a lot of workplaces.

To be fair to Microsoft, its updates on Thursday were frequent and fairly open. It corrected the "elevated load" explanation instead of letting a misleading traffic-surge story stand, and it said plainly what it was doing to mitigate the problem. Two questions remain. Why did a group of servers fail at the same time? And why could the rest of the system not absorb the loss without customers noticing? We'll know more if Microsoft publishes a post-incident report in the admin center.

Bottom line: As of this writing, the Microsoft 365 connectivity incident is ongoing. Microsoft says unexpectedly unavailable servers are straining the rest of its infrastructure. Exchange Online, Teams, SharePoint, Copilot and Defender XDR are listed as possibly affected, and the problem may reach users in any region. Admins should rely on admin center Service health, keep the help desk away from fixes that can't work, and watch for the post-incident review.

Update: Alternative health check returns some servers to service (November 12, 2026)​

According to FingerLakes1.com, Microsoft said at 4:01 p.m. Eastern that an alternative health check had returned some affected servers to service. The company was applying the change more broadly, but the incident remained unresolved.

Microsoft was also preparing automated recovery for unresponsive servers and investigating a small number of configuration updates as possible contributors, FingerLakes1.com reported. Microsoft’s list of potentially affected services now includes Planner, To Do and multiple Purview services.

The next update was scheduled for 5:30 p.m. Eastern; that was not a promised restoration time.

Update: Microsoft points to server health-check component (November 12, 2026)​

Human Resources Director reports that Microsoft’s later investigation found failed health checks may originate in a component responsible for processing server health. Microsoft also said it had not identified a recent change that correlated with the start of the outage. That narrows the investigation toward how server health is being assessed, but does not establish why servers became unavailable or confirm that this component is the root cause.

This adds a diagnostic detail to the earlier update, which said Microsoft was investigating a small number of configuration updates as possible contributors. The new report does not say those checks are complete or that configuration changes have been ruled out; it says Microsoft has not found a recent change linked to the incident. For admins, there is still no new customer-side workaround or confirmed restoration time: continue to monitor tenant-specific Service health updates while Microsoft works to return affected servers to service.

Update: Microsoft considers configuration rollbacks (November 12, 2026)​

Microsoft says it is assessing whether reverting a small number of recent configuration updates could accelerate recovery, according to Interesting Engineering. The company is also continuing to restart and validate affected servers.

Microsoft has not confirmed that the configuration updates caused the outage, and the rollback was still under consideration rather than confirmed as deployed.

Update: Microsoft changes recovery approach as relief falls short (November 12, 2026)​

According to the separate outage report, Microsoft said at 22:11 UTC that its recovery actions had not delivered the expected relief. A core process on affected servers was becoming overwhelmed, causing them to stop responding and reducing available capacity.

Microsoft’s new plan was to isolate part of the service infrastructure, restart affected components and gradually restore traffic to test stability before applying the approach more widely, the report said. The company was also considering isolating traffic by region so regions could recover independently.

The report says Microsoft’s potentially affected services list now includes Intune, Defender for Office 365 and specific Purview functions, including Data Loss Prevention and Auto Labelling. It also lists intermittent failures exporting sensitivity-labeled Power BI reports to PDF, as well as Cloud Update, Cloud Policy and Inventory in the Microsoft 365 Apps admin center.

Admins should check those workloads and device check-ins where relevant. The next Microsoft update was scheduled for 23:30 UTC; that was an update time, not a restoration estimate.

Update: Microsoft reports limited recovery (November 13, 2026)​

Microsoft had observed limited recovery by 6 p.m. Eastern on November 12 as users gradually reconnected, according to Reuters. Restored servers had remained stable so far, but Microsoft was still working to bring other affected servers back online.

Reuters reported that Microsoft was also shifting traffic to alternative routes. Recovery remained incomplete, so users could still experience connection problems as capacity returned.

Update: Additional details (November 13, 2026)​

Geekspin reports that University of Iowa Health Care warned patients that the outage disrupted email and voicemail across its campuses. The provider directed patients to use MyChart to contact their medical teams.

Anthropic said its Microsoft connector’s mail, calendar and search tools were failing for most requests, and new connections might not complete, according to Geekspin.

Update: Nelson businesses report disruption to property settlements and council services (November 13, 2026)​

According to Top South Now, the Microsoft outage disrupted property settlements and public services in Nelson, New Zealand, on November 13. Lawyer Craig Morice told the outlet that his firm could not receive bank emails confirming that settlement funds had cleared. Staff completed transactions by phone and through personal Gmail accounts, with the agreement of lawyers on the other side.

Top South Now also reported that Nelson City Council staff checked their service-request system manually because its usual assignment emails were unavailable. The council said it expected a possible backlog the following week. Teams remained available to its staff, although communicating with people outside the council was harder.

The accounts show how an email outage can interrupt workflows even where other applications remain usable. For IT teams, they also highlight the need for approved backup communication channels: personal email may help organisations keep work moving, but sensitive documents and financial information should be handled under their security policies.

Update: Microsoft reverses network change during outage recovery (November 13, 2026)​

According to Pickr, Microsoft is reversing a recent network change that coincided with the start of the disruption and testing a configuration change. The report does not establish that the network change caused the outage.

Pickr also reports that Microsoft identified the overwhelmed server process more specifically as one responsible for establishing secure connections. When it becomes overwhelmed, affected servers stop processing requests.

In an update quoted by Pickr at 1:30 p.m. Australian Eastern Daylight Time on November 13, Microsoft said it was applying infrastructure capacity improvements where possible to support traffic as regions come back online. It was monitoring the results to identify further actions.

The reversal goes beyond the earlier report that Microsoft was considering configuration rollbacks, though Pickr does not say whether it involves the same changes. For admins, the report does not provide a confirmed restoration time or a new customer-side workaround.

Update: Alaska government agencies report email disruption (November 13, 2026)​

Alaska state and municipal government agencies were affected by the outage, according to the Juneau Independent. Anchorage’s municipal government advised people seeking to reach employees or departments to use the phone.

The Juneau Independent also reported difficulties at other government agencies and non-government organizations in Alaska, but did not specify which services were affected at each organization or when their access would be restored. Anchorage’s notice is an alternative contact method, not a confirmed fix for email.

For people trying to reach municipal staff, the practical change is to use the phone rather than rely on an email response. IT and communications teams can also use the notice as a prompt to check that their own public-facing contact instructions identify an approved backup channel when email is unavailable.

The report does not establish how many Alaska agencies were affected or whether all experienced the same symptoms. Admins should check their own tenant’s Service health information and verify which local workflows remain disrupted.

Update: Microsoft says recovery changes are falling short (November 13, 2026)​

Microsoft’s latest update, reported by Times.co.nz on November 13, says changes intended to improve serviceability are “not taking as expected.” The company is now identifying alternative workstreams to add capacity amid what it described as sustained traffic-management imbalances.

That suggests the recovery measures were still not restoring capacity as planned; Microsoft did not announce that service had been restored or provide a firm recovery time. The report also notes ongoing access problems for Microsoft 365 services, including Outlook and Copilot, and continued disruption to some New Zealand services. Users and admins should continue to expect intermittent problems and monitor their tenant’s Service health updates.

Update: Guam health department directs residents to call or visit (November 13, 2026)​

Guam’s Department of Public Health and Social Services advised residents to visit the appropriate office or call to schedule appointments after the outage disrupted its email and online services, according to the Pacific Daily News.

The department said staff could not access emails, including applications, documents and requests submitted electronically. That affects people who have already sent documents or service requests by email and need assistance. DPHSS said it would provide updates as email services are restored; it did not give a restoration time.

The Pacific Daily News also reported disruptions to its own Outlook service. The outage did not affect every Guam agency: the Department of Education said it continued normal operations, while the Guam Fire Department reported no service interruptions.

For residents awaiting a response from DPHSS, the practical alternative is to contact the appropriate office by phone or visit in person rather than rely on email. The department’s contact directory lists office locations and telephone numbers.

Update: Broker warns outage may not trigger cyber insurance cover (November 13, 2026)​

According to Insurance Business, Bellrock Advisory claims practice leader Joe Hershewe says most businesses affected by the Microsoft 365 outage are unlikely to meet the breach threshold required by their cyber policies. Many policies require an actual or suspected breach before coverage can respond. Microsoft has not attributed the outage to a cyberattack.

Hershewe told Insurance Business that extended cover for widespread events exists but is not standard in most mid-market cyber policies. Bellrock cyber risk adviser Jennifer Clancy cautioned that such endorsements have their own qualifying criteria and that the outage’s unresolved cause complicates that assessment.

For organisations facing disruption costs, the report highlights the importance of checking their own policy wording rather than assuming either that the outage is covered or that a claim will fail. IT teams can help by preserving records of affected services, downtime and operational impact for their insurance and risk colleagues. Coverage will depend on the policy’s terms and the facts established about the incident.

Update: Outage delays Workhorse earnings release (November 13, 2026)​

Truck and bus manufacturer Workhorse Group postponed its earnings release from Thursday, November 12, until Monday because of the outage, according to Bloomberg, as published by MyBroadband.

Bloomberg also reported that Japan’s shared government IT platform was experiencing disruptions, citing Deputy Chief Cabinet Secretary Masanao Ozaki. The report did not specify which government services were affected.

Update: Restored servers became unavailable again (November 13, 2026)​

According to The Guardian, republished by Daily Sun, Microsoft said some servers became unavailable again when traffic returned after fixes were deployed. Earlier, Microsoft had reported that restored servers were stable.

As of 3:30 a.m. UTC on November 13, Exchange services were most affected, while Teams chats and meetings were less affected, the report said. Microsoft executive Charles Lamanna also said there was no indication the outage resulted from malicious or cyber activity. That does not establish the cause.

Update: Additional details (November 13, 2026)​

Prameya News reports that Exchange-dependent Teams features, including calendars and meeting scheduling, were affected even where core chats and meetings continued to work.

The outlet also lists Windows 365, Universal Print and Microsoft 365 Education features—including Assignments, Reading Progress and Speaker Progress—among the affected services.

Update: Additional details (November 13, 2026)​

Jagran Josh reports that the outage affected users in at least 74 countries. The outlet does not explain how that figure was calculated, so it should not be treated as an official Microsoft count.

Update: Australian minister points to software update (November 13, 2026)​

According to Business Times, Australian Home Affairs and Cyber Security Minister Tony Burke said Microsoft believed a faulty software update caused the outage, rather than a cyberattack.

That is more specific than Microsoft’s earlier public statements, which had not confirmed a root cause. The report does not establish which update was involved or whether Microsoft has completed its investigation.

Business Times also reported that Australia’s intelligence agency and federal police were affected, as were users in the US House of Representatives.

Update: Additional details (November 13, 2026)​

BestMediaInfo reports that some unresponsive servers prevented configuration changes from taking effect during recovery efforts.

The outlet also reports that Exchange-linked SharePoint features may be affected, although direct access to files remains available.

Update: Additional details (November 13, 2026)​

AFP, as published by IOL, reports that New Zealand’s foreign ministry said the outage affected its ability to receive emails, including at its embassies, consulates and representative offices worldwide.

AFP attributes the previously reported figure of 74 affected countries and territories to Downdetector. It also reports that user-submitted disruption reports declined sharply in Washington and Hong Kong around 04:50 UTC on November 13; that does not confirm service restoration.

Update: Additional details (November 13, 2026)​

The University of Pennsylvania’s PennO365 incident mirror lists a specific Windows 365 impact: users whose organizations use Microsoft Purview Customer Key for Cloud PCs may be unable to connect to their desktops.

The mirror also lists the REST API among the affected Exchange Online mailbox connection methods. These are possible effects, not confirmed failures for every tenant.

Update: Additional details (November 13, 2026)​

Ukrainian National News reports that users in Ukraine submitted Microsoft 365 problem reports to Downdetector on November 13. As of 8:30 a.m. Kyiv time, 37% of reports concerned login, 30% the app, and 20% saving or synchronization.

Those percentages describe user-submitted reports, not an official count of affected users.

Update: Additional details (November 13, 2026)​

Riviera Radio reports that Microsoft attempted to add capacity by deploying additional virtual machines as part of its recovery efforts.

The outlet also reports that New Zealand immigration services experienced problems processing visa applications during the outage.

Update: Additional details (November 13, 2026)​

The Observer Post reports that IndiGo said its email support was affected and that it might not receive customer emails. The outlet also reports that luxury group Richemont delayed its first-half results announcement because of the disruption.

Bharti Airtel experienced internal email disruption and increased calls to its call centers, according to a company official quoted by The Hindu and cited by The Observer Post.

Update: Additional details (November 13, 2026)​

Nairametrics reports that the outage affected email support for Indian airline Akasa Air and disrupted fund-management activities at some financial firms in Taiwan.

In Australia, some businesses could not print invoices, some schools could not hold online classes, and court livestreams were affected, according to the outlet.

Update: Additional details (November 13, 2026)​

An Azure Blog admin write-up cited in the new report says Defender for Office 365 Safe Links may be unable to verify URLs during the outage, potentially affecting links clicked in Outlook and Teams.

Reuters reported that Outlook problem reports on Downdetector peaked at 138,058 around 1 p.m. Eastern on November 12 and fell to about 34,490 by evening. Those figures are user-submitted reports, not counts of affected users.

Update: Authentication and routing patch improves stability (November 13, 2026)​

Microsoft reported improved stability after a patch to an upstream authentication and routing component reached part of its infrastructure, according to a service-health update captured by the University of Pennsylvania’s PennO365 incident service. Microsoft was continuing to expand the patch.

The improvement does not establish full recovery. Administrators should verify critical workflows in their own tenants rather than assume that a successful connection means every service has recovered.

Update: Additional details (November 13, 2026)​

The Associated Press, published by Telangana Today, reports that Singapore’s Government Technology Agency said government email was down. The Philippines Supreme Court said the outage affected some operations, including email responses.

Air India said it temporarily rerouted email to keep customer queries flowing and that flight operations were unaffected, AP reported.

Update: Additional details (November 13, 2026)​

EasternEye reports that a financial services center in Chennai used Teams to share files and obtain approvals during the outage. An employee said staff preserved screenshots as records of sign-offs.

The outlet also lists OneNote among the potentially affected services; that does not mean it failed for every tenant.

Update: Additional details (November 13, 2026)​

The Standard reports that Toronto hospital network Unity Health Toronto activated a Code Grey infrastructure-failure protocol after staff lost email access. The hospital said clinical care was unaffected and directed urgent inquiries to its telephone switchboards.

The outlet also reports intermittent email failures at Malaysia Airlines and customer correspondence problems at Emirates. Emirates said its flights continued as scheduled.

Update: Additional details (November 13, 2026)​

La Veu Lliure reports that the outage affected private channel creation in Teams and file sharing with people outside an organization in SharePoint Online. These are reported impacts, not confirmed failures for every tenant.

Update: Additional details (November 13, 2026)​

The University of Pennsylvania’s service-health mirror lists possible failures creating or deleting shared Teams channels, as well as failures involving Defender for Office 365 Quarantine, Threat Explorer and the release of quarantined items. Purview eDiscovery searches and exports, audit searches and Communication Compliance may also be affected.

The report also says mail flow between on-premises systems and Exchange Online may be disrupted. These are possible impacts, not confirmed failures in every tenant.

Update: Microsoft extends email timeout to 48 hours (November 13, 2026)​

According to The Tech Portal, Microsoft extended its email timeout to 48 hours to preserve mail delayed by the outage. The report does not say that all delayed messages will be delivered.

Microsoft also plans to publish the root cause and repair measures in a post-incident report after recovery, the outlet reports.

Update: Additional details (November 13, 2026)​

The new report says incident MO1550821 began at 1:26 p.m. Eastern on November 12. It also reports that Microsoft was rolling out its authentication and routing patch first in regions at or approaching peak business hours.

According to UNILAD Tech, Microsoft extended the email timeout window from 24 to 48 hours. The extension does not guarantee delivery, and other providers may apply their own retry limits.

Update: Recovery progresses unevenly across regions (November 13, 2026)​

Microsoft reported incremental improvement across several workloads around 09:00–10:00 UTC on November 13, according to WindowsForum’s later report citing a Japanese university help desk. Recovery actions had been completed on parts of the Asia Pacific infrastructure, with other regions to follow.

Service health remained variable and capacity was still below normal, the report said. Microsoft was also prioritizing delayed email queues and backlog processing. Full restoration was not confirmed, so admins should continue checking their tenants’ Service health and verify critical workflows.