Microsoft 365 Outage Disrupts Shipping Emails and Survey Bookings; Coastguard Rescue Unaffected

For Microsoft 365 administrators, this is a useful case study. It shows what an Exchange-centred failure breaks, what keeps working, and why a phone list still matters.

What happened, and when​

The outage began on Thursday and was still running on Friday. CybersecurityNews described it as a major outage that disrupted cloud service access on November 12 and continued into November 13, 2026, as Microsoft worked to restore failing infrastructure. Microsoft's first public note said it was investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas. More details can be found in the Microsoft 365 admin center under EX1550543.

Users noticed quickly. MacRumors reported that problems emerged on Thursday, November 12, with nearly 130,000 Outlook reports recorded on Downdetector shortly after 1 p.m. The incident did not stay limited to the Americas. Microsoft's own updates later warned that service connectivity could be affected for users in any region.

There are two incident IDs to know:

• EX1550543 covers Exchange Online mailbox access and mail delivery.
• MO1550821 covers the knock-on effects on other Microsoft 365 services.

Microsoft's service-health updates, as archived by the University of Pennsylvania's IT incident page, point readers to MO1550821 for the broader impact.

Section summary: This was an Exchange Online failure that spread across Microsoft 365. It ran from Thursday afternoon (US Eastern time) into Friday and was tracked under two incident IDs.

The maritime fallout, organisation by organisation​

Riviera's reporting gives a clear view of how each organisation was affected:

• UK Maritime and Coastguard Agency (MCA): The agency reported problems sending and receiving email because of the worldwide Microsoft outage. It said its search-and-rescue services were not affected. People facing an emergency at the coast should still call 999 and ask for the Coastguard.
• Maersk: The Danish shipping company warned that notifications, emails and updates could be delayed or temporarily disrupted. It said the problem was Microsoft-related and not specific to Maersk or its internal systems. Maersk had also suffered a cyberattack on a local legacy system earlier in the week. That was a separate event, and nothing in Microsoft's statements or the companies' statements links the two.
• Lloyd's Register: The classification society warned of delays to survey requests and technical enquiries. Clients needing a survey within 24 hours were told to phone its Global Technical Client Care and Planning & Scheduling managers.
• APL Logistics: Customers with urgent updates were told to phone their service representatives rather than use digital channels.
• Royal Netherlands Institute for Sea Research (NIOZ): The institute said Outlook, Teams and its internal intranet were affected and that its IT team was monitoring recovery.

According to Riviera, the outage disrupted email used for voyage instructions, cargo documentation, survey requests and routine customer updates. The affected organisations said core vessel operations and emergency response remained available. No port closures or vessel delays caused directly by the outage were known when Riviera published. That only covers what had been reported by then, not the full incident.

Section summary: The maritime impact was on business communications, not on running ships. Several organisations switched urgent matters to the phone.

What Microsoft says broke​

Riviera reports that Microsoft blamed an infrastructure failure, not a cyberattack. According to a timeline compiled from Microsoft's status feed and published by System Design Academy, Microsoft said at 03:34 UTC on 13 November that there was no indication it was the result of malicious activity.

Microsoft's technical explanation developed over the night:

• Servers dropped out. Several Exchange servers became unavailable, which put more load on the ones still running. CyberPress noted that early telemetry pointed to elevated load across several regions. Microsoft later clarified that the pressure did not come from increased traffic.
• Restored servers failed again. Microsoft's status account said servers it had brought back can become unresponsive again once they receive traffic.
• The failing process was identified. System Design Academy's timeline says that at 01:06 on 13 November it named the process: the one "responsible for establishing secure connections". According to the Penn archive, Microsoft said this process became overwhelmed and stopped servers from handling requests. It was preparing a configuration change, testing it on a subset of servers, and planning to apply it more widely along with restarts.
• A recent network change was rolled back. In the same notices, Microsoft said it had started reverting a recent network configuration change that "correlates with the start of impact." It also limited traffic in specific locations to keep servers stable.

Microsoft had not confirmed a root cause at the time. System Design Academy noted that it had not published a final root cause by 13 November. A timing overlap with a network change does not prove the change caused the outage, so treat that link as unconfirmed until Microsoft publishes a post-incident review.

Section summary: A process that sets up secure connections became overwhelmed, and servers that were brought back failed again once traffic returned. Microsoft has not published a final root cause.

Why Teams "half-worked" and SharePoint files stayed reachable​

Exchange Online is not only email. System Design Academy explains that Exchange Online stores the mail, calendars and contacts that many Microsoft 365 services read. When Exchange failed, every feature that depends on it failed too. By the morning of 13 November that notice listed 18 services besides Exchange Online.

Microsoft's own notices described the limits for each service:

• Exchange Online: Mailbox access could fail through Outlook on the web, Outlook desktop (MAPI), Exchange ActiveSync and REST connections. Mail delivery could be delayed. MacRumors added that Exchange accounts accessed through other clients such as Apple Mail are also experiencing problems because the disruption involves Microsoft's underlying infrastructure.
• Teams: Microsoft said most core functions, including calls, meetings, group chats and channel messages, were not affected. Calendar scheduling, invites, meeting edits, Live and Virtual event creation, and creating private or shared channels could fail. In short, Microsoft Teams is not entirely offline.
• SharePoint Online: Features that depend on Exchange could fail, but direct access to stored files kept working.
• Planner and To Do: Planner had reliability problems with plan and task operations. To Do might not load at all.
• Security and management services: The notices also listed possible effects on Defender XDR, Defender for Office 365, Purview (including DLP, labelling, audit and eDiscovery), Intune enrollment and device check-in, and Windows 365 Cloud PCs that use Purview Customer Key. These were Microsoft's tenant-wide warnings. Nothing has confirmed that the maritime organisations named above were affected in these areas.

Consumer accounts were affected as well. System Design Academy notes that Microsoft's status page for consumers said Outlook.com, OneDrive, OneNote, To Do, Teams and Microsoft 365 for the web were affected for personal accounts too.

Section summary: If a feature reads mail, calendar or contacts data, assume it was affected. Teams calls and chat, and direct access to SharePoint files, were largely spared.

Recovery status and the 48-hour mail window​

Recovery was progressing but not finished at last check. MacRumors reported that Microsoft's latest update said repairs across parts of the Asia Pacific region were improving mailbox access and helping delayed emails move through the system. CybersecurityNews said Microsoft confirmed improvements in key services, including Exchange Online mailbox access and delayed email processing, although some users may continue to experience intermittent disruptions. ABC7's live coverage said Outlook and Teams are coming back online after an hours-long outage.

For anyone worried about lost email, the most important detail is this: Microsoft has increased the email timeout window to 48 hours to help protect delayed messages while backlogs clear. Messages that sat in queues during the outage should be delivered late rather than bounced, as long as the backlog clears within that window. Mail involving systems outside Microsoft can behave differently, because each sending server has its own retry rules.

What admins should do now​

The steps below are general operational advice, not instructions from Microsoft:

• Use the incident IDs. Follow EX1550543 and MO1550821 in the Microsoft 365 admin center's Service health page rather than social media, and keep the incident records for any SLA discussion.
• Expect late mail, not missing mail. Tell users that delayed messages may arrive in bursts and could be out of order. Ask them to confirm anything time-sensitive before acting on it, such as a voyage instruction or a survey slot.
• Check security and compliance gaps. If Defender, Purview or Intune notices applied to your tenant, review whether alerts, DLP actions, labelling and device compliance check-ins ran as expected during the outage.
• Write down the fallback that worked. Lloyd's Register and APL Logistics both moved urgent work to the phone. If your organisation had no equivalent, this is the time to build one: a phone list that does not depend on Exchange, and a channel that does not run through the same tenant.

The bigger picture​

Riviera notes that the incident has renewed attention on shipping's reliance on cloud communications from a small number of technology providers. That concern is reasonable, but it needs context. The MCA's statement shows that resilience held where it mattered most: search and rescue does not depend on Outlook. The weak point was the commercial and administrative layer, where one tenant-wide dependency can slow survey bookings and customer updates across a whole sector at once.

Cloud email is still far more reliable than most on-premises Exchange setups it replaced. The lesson is not to abandon Microsoft 365. It is to know which business processes depend on Exchange and to have a phone fallback ready for when it fails.

Update: Most Maynooth University users regain access (November 13, 2026)​

Maynooth University’s IT Services reported at 16:00 GMT on November 13 that most staff and students had regained access to Microsoft services. It anticipated restoration for remaining university users within a few hours, though that was not a Microsoft-wide resolution estimate.

The university advised anyone still affected to restart their device and install available updates, then contact its Service Desk if problems persist.