Here is what the company has said so far, what it means for Windows and Microsoft 365 administrators, and what you can and can't do while you wait.
How the outage unfolded
According to Mashable's running timeline, Microsoft's first update came at 12:54 p.m. ET on X. It said customers were having trouble with Exchange Online mailboxes "in the Americas." Exchange Online is the cloud back end for Outlook mail and calendar. At 1:07 p.m. ET, Microsoft said the problem was wider than that: "we've confirmed the issue may affect Microsoft 365 service connectivity for users in any region."
WIRED reported a separate notice earlier in the day. Around 10:40 a.m. ET, Microsoft said it was looking into reports of people having trouble using Teams in North America.
Different sources give different start times. A public outage extract kept by the University of Wisconsin–Milwaukee, which relays Microsoft's notices, lists the Exchange Online degradation as starting at Nov 12, 2026, 10:17 AM CST. That is 11:17 a.m. ET, more than 90 minutes before the 12:54 p.m. post on X. Admins working out when their own users were first hit should check the admin center timeline, not social media timestamps.
The public status page eventually read: "User impact: Users may be unable to connect to multiple Microsoft 365 services." Mashable said the status page also went down briefly, which doesn't help when it's the place you're told to check.
Section summary:
- The first public notice covered Exchange Online in the Americas.
- Within about 15 minutes, Microsoft said users in any region could be affected.
- The admin-center extract shows a start time earlier than the first post on X.
Which services were hit
Microsoft's status page listed Exchange Online, Teams, SharePoint Online, Microsoft Copilot 365 and Microsoft Defender XDR as potentially affected. WebProNews reported that the formal service-health notice lists Exchange Online, Teams, SharePoint Online, Copilot, Defender XDR, Planner, To Do and Purview as potentially impacted. That covers mail, chat, files, Copilot, and security and compliance tools.
Mashable reported that the status page said the outage affected Microsoft 365 enterprise services, not Microsoft's consumer products. Users still filed complaints about a wider range of services. IBTimes noted that complaints rose for Outlook, Microsoft 365, Teams, Copilot, Azure, OneDrive and the Microsoft Store on Downdetector, which tracks user-submitted outage reports. Downdetector counts reports, not confirmed outages, so a spike for the Microsoft Store doesn't mean the Store was down.
Mashable said Downdetector logged more than 100,000 reports for Outlook alone. WIRED said reports began falling around 1:15 p.m. ET, after spiking around midday. Treat these numbers as a rough measure of how many people noticed, not as a count of affected tenants.
"Potentially impacted" also doesn't mean every listed service failed for every customer. It means Microsoft couldn't rule them out.
What Microsoft says went wrong
Microsoft's own explanation went through several stages.
1. Not a traffic surge. Microsoft first pointed to elevated load, then corrected that. "We've determined that the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure," the company said. In short, servers dropped out and the remaining ones were overloaded.
2. Failed health checks. Microsoft said the servers were going offline because they failed automated health checks. The company also said "the failed health checks may originate from a specific component that's responsible for processing server health."
3. Containment. WIRED quoted Microsoft: "We've paused all deployments. We're moving additional traffic off the affected infrastructure, and we're restarting affected servers to return them to service." Microsoft also said it had started spreading connection traffic across its wider worldwide infrastructure.
4. A targeted workaround. SecurityWeek reported that just before 3 p.m. ET, Microsoft said affected servers were failing automated health checks and that it was testing a workaround that bypasses the component responsible for processing those checks. The company said it was also investigating elevated processor usage on affected servers.
5. Servers too far gone to test the fix. Shortly before 4 p.m. ET, Microsoft said that many affected servers had become unresponsive, so it couldn't confirm whether the change worked. It was restarting them so they would come back with the change applied, and doing the same on other affected parts of its infrastructure.
6. Partial recovery. iTnews quoted a later update, posted just after 8 a.m. AEDT on November 13 (about 4 p.m. ET Thursday): "We've validated an alternative service health check method, which allowed a subset of affected servers to successfully return to service," Microsoft also said it was "preparing automated recovery systems to continually detect and restart unresponsive servers, to maintain service stability while this change progresses."
A subset of servers coming back is progress, but it isn't the all-clear. WebProNews reported that as of 3:56 p.m., the company had not said when service will return or what caused the servers to fail their health checks.
Microsoft's messages don't fully agree
Mashable reported that later in the X thread, Microsoft said it had not found any recent change that lined up with the outage. The admin-center wording relayed by UW–Milwaukee is different. It says the health-check failures may be related to a recent change to a component involved in processing those checks.
These two statements may not be contradictory. "May be related" is a hypothesis, and "no correlated change found" may reflect what Microsoft learned later. Either way, treat claims about the cause with caution until Microsoft publishes a post-incident review.
Was it a cyberattack?
There is no evidence of one. SecurityWeek said Microsoft has disclosed no evidence of a cyberattack. WIRED also said there was no indication an attack caused the outage. That isn't the same as Microsoft ruling one out, but everything Microsoft has said points to an internal health-check problem. In general, a monitoring system that wrongly marks healthy servers as failed is a known way for cloud services to break. A safety mechanism that misfires can do more damage than the problem it was built to catch.
What admins should do right now
Find the incident IDs. This is the most useful detail for IT staff. SecurityWeek reported that Microsoft is tracking the Exchange Online disruption under EX1550543 and the broader Microsoft 365 incident under MO1550821 in the Microsoft 365 admin center. The UW–Milwaukee extract confirms Microsoft is reporting the wider connectivity problems under MO1550821 on the Service Health Dashboard.
A practical checklist:
- Open Service health in the Microsoft 365 admin center and look for EX1550543 and MO1550821. Tenant-specific notices are usually more detailed than public posts, and you can't count on the public status page, which went down for a while on Thursday.
- Confirm the symptoms match. If users can't connect to mailboxes, Teams or SharePoint across several devices and networks, the problem is very likely on Microsoft's side.
- Hold off on heavy local troubleshooting. Rebuilding Outlook profiles, reinstalling Office or resetting Windows network stacks during a service-side outage wastes time and can create new problems after Microsoft recovers. Nothing Microsoft has said suggests local changes will help.
- Tell users early. A short note saying "it's Microsoft, not you, and we're watching the incident" will cut down on duplicate help desk tickets.
- Check your security tools. Defender XDR and Purview appear on the potentially affected list. Security teams should be aware that alerting or investigation workflows may be degraded and plan accordingly.
- Document your impact. Write down when your users were first affected, which services failed and what work was disrupted. You'll need it for internal reporting and for any service-credit conversation under your Microsoft agreement after the post-incident review comes out.
Microsoft hasn't said how delayed or queued mail will be handled. Don't promise users their mail will arrive, and don't assume it's lost.
The bigger picture: one point of failure
WebProNews cited TechCrunch as noting that Microsoft's previous major incident was in September, when a days-long Microsoft 365 outage was blamed on a "core authentication configuration" issue. Two large incidents in roughly two months will draw attention from CIOs who have put mail, chat, files, Copilot and security operations all on one platform.
ShiftDelete argued that because Microsoft's updates point to failing servers rather than a traffic spike, the business impact is about dependency concentration rather than any confirmed external cause. When one health-check component can affect Exchange, Teams, SharePoint and Defender at the same time, putting everything on Microsoft 365 is convenient but also means everything can fail together.
To be fair to Microsoft, outages this size are rare compared with how much traffic Microsoft 365 handles. The company also posted fairly specific technical updates during the incident, including that it paused deployments, moved traffic, bypassed the health-check component and restarted servers, rather than repeating "we're investigating." Even so, a status page that goes down during an outage, and messages that disagree about whether a recent change was involved, are things customers should raise when the post-incident review is published.
Bottom line: Servers failing health checks overloaded the rest of Microsoft's infrastructure, and Microsoft is restoring them in batches using an alternative health-check method. The underlying cause hasn't been named. Admins should follow EX1550543 and MO1550821 in the admin center, avoid disruptive troubleshooting on user devices, and record their impact for the post-incident review.
This story is still developing, and we'll update the Microsoft 365 outage coverage on WindowsForum as Microsoft releases more.