The incident is tracked as two records. EX1550543 covers Exchange Online mailbox access. MO1550821 covers the wider Microsoft 365 impact. Here is what is confirmed so far, what is still unclear, and what administrators should do while it continues.
The timeline
According to PA Media's report, which ran in East Renfrewshire News, Kilmarnock Today (the ayrshire-today.co.uk page) and STV News, Downdetector first showed a spike in UK reports about Microsoft Teams at about 6:15 p.m. on Thursday, November 12. Reports were still coming in at 3 a.m. Friday. The Scotsman's report gives the same timings.
Downdetector counts user reports. It does not tell you when the fault started inside Microsoft or how many people were affected, so treat these times as the point when users noticed.
Microsoft's own updates on its Microsoft 365 Status account on X show how the scope grew:
- The first post said Microsoft was investigating problems accessing Exchange Online mailboxes through several connection methods in the Americas.
- A later post said the issue may affect Microsoft 365 service connectivity for users in any region.
- Microsoft then said part of its infrastructure was under elevated load across multiple regions. It began redistributing connection traffic across its global infrastructure.
- It later added that the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure.
In short, this was not a traffic flood. Servers kept dropping out, and the ones still running had to absorb their load.
Summary: The trouble started with Exchange Online mailbox access in the Americas and then affected Microsoft 365 connectivity in any region. Microsoft traced the overload to servers failing, not to extra demand.
Servers that failed again after restarts
Microsoft's Friday update, as reported by PA Media and The Scotsman, said it had brought servers back into operation several times overnight UK time, but those servers crashed again. The company also tried isolating parts of its infrastructure and moving traffic to alternate routes. One change meant to improve serviceability failed. Microsoft said it had "confirmed that change is not taking as expected."
Microsoft's status posts explain why the work was slow. Its explanation changed several times overnight:
- Failed health checks. Microsoft tested a configuration change for a problem that made servers fail automated health checks and drop out of service. In parallel, it restarted all affected servers.
- A suspect component. Microsoft then said the failed health checks may come from a specific component that processes server health. It took steps to stop more servers being pulled from service.
- A different health check. An alternative health-check method let a subset of servers return to service. Microsoft also began preparing automated recovery to detect and restart unresponsive servers.
- The fixes did not hold. A later post said our actions taken thus far have not provided the anticipated relief. Microsoft said a core process on affected servers was becoming overwhelmed.
- Servers failing under load. Microsoft then said servers returned to service could stop responding again once they received traffic. It began limiting which types of traffic could reach the affected infrastructure in some locations and rebuilding some servers with an earlier configuration.
The University of Pennsylvania reproduces Microsoft's incident text on its PennO365 alerts page, which is a mirror, not Microsoft's own status site. The latest status shown there is more specific. It says a process on the affected servers that establishes secure connections becomes overwhelmed, so the servers stop processing requests. Microsoft was testing a configuration fix on a subset of servers before rolling it out more widely. It had also started reverting a recent network configuration change that correlates with when the problems began.
That last point is notable because earlier posts said no recent change correlated with the start of the impact. Investigations like this often change course. Until Microsoft publishes a post-incident review, the configuration change is a lead, not a confirmed root cause.
Microsoft also took a standard precaution. It said it had paused all deployments while reviewing recent changes. During an outage of unknown cause, freezing deployments stops new changes from making things worse.
Summary: Restarted servers kept failing once traffic returned. Microsoft says an overwhelmed secure-connection process is involved and is reverting a recent network change. Neither has been confirmed as the root cause.
Affected services
The news reports name Teams, Copilot, Outlook email and parts of Microsoft's cloud services. The MO1550821 entries on the PennO365 mirror add some specific effects:
| Service | Reported impact |
|---|---|
| Exchange Online | Users may be unable to reach mailboxes through the affected connection methods, which include the REST API |
| Windows 365 | Tenants using Microsoft Purview Customer Key for Cloud PCs may have users unable to connect to their Cloud PCs |
| Power BI | Users may intermittently fail to export reports with MIP sensitivity labels to PDF |
| Microsoft Purview | Authorization, Auto Labelling, Data Loss Prevention, Communication Compliance and Data Classification affected |
| Microsoft Defender XDR | Listed among the affected Microsoft 365 services |
These are possible effects, not confirmed failures for every user. SecurityWeek, citing Microsoft, reported that features of many Microsoft 365 services that interact with Exchange Online and email services are impacted. Elements of those services that do not depend on interaction with Exchange Online remain functional. In practice, a Teams chat might work while a Teams feature that depends on your mailbox does not.
The Windows 365 item is easy to miss. If your organization uses Customer Key to encrypt Cloud PCs, some of your staff may have lost access to their entire desktop, not just email.
Effects outside Microsoft
The outage also affected other companies' products. PA Media reported that OpenAI said it was investigating a problem with Microsoft connectors where new connections might be broken and tools might not work as expected. That points to integrations built on Microsoft 365 data. It does not mean ChatGPT itself was down.
PA Media also reported that governments in several countries, including Australia, India and Japan, reported Microsoft outages. No figures were given for how many organizations were affected in those countries.
There was also trouble with status information. Microsoft had first pointed people to a page on its website for updates, but users complained it would not load. Microsoft then posted regular updates on its official Microsoft 365 accounts.
What admins should do now
Microsoft has not offered a workaround or an estimated recovery time. This list sticks to what Microsoft's updates and reputable coverage support:
- Track the right incidents. Watch EX1550543 for mailbox access and MO1550821 for the wider impact in Service health in the Microsoft 365 admin center. If the admin center won't load, Microsoft points to status.cloud.microsoft if the admin center is not available to you.
- Check the service list in MO1550821 again. Microsoft says it has revised the list of affected services and features in the "more info" section of that incident, so the list from an hour ago may be out of date.
- Leave tenant settings alone. Cryptika's admin guidance advises against resetting passwords, rebuilding Outlook profiles or changing tenant settings because of these errors. A new Outlook profile cannot fix a server problem on Microsoft's side, and it gives your helpdesk more cleanup later.
- Expect uneven recovery. Microsoft is limiting some traffic types in some locations, so access may come and go even where things look better. Microsoft has said that as capacity returns, users may recover gradually as their apps reconnect.
- Warn staff about scams. Cryptika also recommends warning users about phishing emails and fake support calls that exploit the outage. Scammers often pose as IT support during a widely reported outage.
- Check your Windows 365 and Purview setup. If you use Customer Key for Cloud PCs, or rely on Purview DLP and auto-labelling, assume those controls may be affected. Once service returns, check whether any compliance processing was delayed or skipped.
Analysis: a long outage, and not an attack
Microsoft's EVP Charles Lamanna said there was "no indication" that malicious or cyber activity caused the outage. That is Microsoft's assessment at this stage, not an independent finding. It does match the technical updates, which describe health checks, overloaded processes and configuration changes, not an attack.
This outage is notable for how long it lasted. Each recovery attempt brought servers back, and traffic knocked them over again. With many servers out, the rest became overloaded. Restarting a fleet does not help if the same traffic brings the restarted servers down again. That is why Microsoft limited traffic types and rebuilt some servers with an older configuration.
To be fair to Microsoft, its status account posted detailed and fairly frank updates through the night, including saying plainly that its fixes had not worked. The other side of that: if the company's suggested status page won't load during a global outage, many admins will end up checking social media and outage-tracking sites for updates.
The main lesson for IT teams is dependency mapping. Few people would expect an Exchange Online problem to affect Power BI exports, Purview DLP and Windows 365 Cloud PCs. It is worth listing which of your business processes depend on Exchange Online, and planning how you would communicate with staff if Teams and Outlook were both down.
Summary: Microsoft says this was not an attack. Restoration was still under way on Friday morning, with no confirmed root cause and no recovery time. Admins should watch EX1550543 and MO1550821, avoid changes on their own side and warn users about scams.