Microsoft 365 Outage MO1550821: Outlook, Teams and Defender XDR Connectivity Guidance — Megathread

The incident was still active as this was written. Microsoft has given no final root cause and no confirmed time when service will be fully restored. Here is what has been confirmed, what is still unclear, and what admins should do now.

What Microsoft has confirmed​

The outage built up in stages over the day, and Microsoft's public updates followed it step by step.

• The Teams warning. Microsoft first posted that it was investigating problems with Teams in North America. On its Microsoft 365 Status account, it said it was looking into "reports of users experiencing issues when accessing or using Microsoft Teams functionality in North America" under incident TM1550488. Microsoft later said this earlier Teams problem had been fully resolved. However, Microsoft has not indicated whether the two incidents are related.
• Exchange Online gets pulled in. Microsoft then reported, according to ABC News, issues accessing Exchange Online mailboxes "through multiple connection methods in the Americas". That incident is tracked as EX1550543. Techaeris reported that Microsoft acknowledged the problem at 12:54 p.m. Eastern time.
• The scope widens. Microsoft later said "we've confirmed the issue may affect Microsoft 365 service connectivity for users in any region." That wording describes where the problem could appear. It does not mean every tenant in every region went down.
• A broader advisory. According to BleepingComputer, in a Microsoft 365 admin center advisory tracked as MO1550821, Microsoft confirmed that customers may be unable to connect to multiple services, including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR.

The Irish Independent reported the European side of the outage. Downdetector showed a jump in UK reports of Teams problems at about 6:15 p.m. local time, which is 18:15 UTC in November. Users on X also said Microsoft's public status page would not load. When the page did load, it warned that users might be unable to connect to multiple Microsoft 365 services.

Section summary: The incident started as a regional Teams and Exchange problem and grew into a multi-service connectivity advisory with possible global reach. At least three incident IDs are involved.

Missing servers, not extra traffic​

Microsoft's own account of the cause is the most useful detail so far. Its first explanation pointed to "elevated load" on part of its infrastructure across multiple regions, which sounded like a traffic surge. Microsoft later corrected that. ABC News quoted the clarification: "We determined the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure."

That is a different kind of failure. Users did not suddenly pile in. Instead, a set of servers dropped out, and the remaining servers had to carry their share of the work. Picture a supermarket where half the checkout staff go home at once. The queue is the same size, but it moves much more slowly.

According to the Irish Independent, Microsoft's update shortly after 19:10 UTC listed three steps:

• Pausing all deployments
• Moving more traffic off the affected infrastructure
• Restarting affected servers so they can return to service

Microsoft also said it was redistributing connection traffic across its global infrastructure to spread the load. Reuters quoted the company: "We're aggressively pursuing all pathways to reduce impact,"

Pausing deployments is a common step when something has gone wrong. If you don't yet know why servers are dropping out, you stop shipping changes that could add new variables. Microsoft has not said that a deployment caused the failure. Readers should treat the pause as a precaution, not an admission. Techaeris also noted that Microsoft has not attributed the Microsoft 365 outage to a cyberattack, and no threat actor has claimed it.

Section summary: Microsoft says unexpected server unavailability, not extra demand, put a strain on the remaining capacity. Its fixes are operational: freeze changes, move traffic, restart servers. The underlying fault has not been disclosed.

How big was it?​

The numbers come from user-submitted Downdetector reports, so they show how loudly people complained, not how many accounts Microsoft counted as affected. The sources also disagree, mostly because each one checked at a different time.

People described inboxes that wouldn't load and mail they couldn't send or receive. BleepingComputer reported that Downdetector complaints also covered Outlook, Microsoft 365, Teams, Copilot, Azure, OneDrive, and the Microsoft Store. A spike in Downdetector reports for a service does not prove that service failed. Many users simply report whichever Microsoft product they happened to be using.

The outage also reached beyond Microsoft's own apps. Reuters reported that it was hitting connectors used by OpenAI's and Anthropic's AI services, and that OpenAI said it was investigating an issue with Microsoft connectors in which new connections may be broken and tools are not working as expected. Many organisations now connect AI assistants to their mailboxes and SharePoint libraries, so an Exchange outage also breaks those tools.

Section summary: Peak Outlook complaints were in the six figures. The impact reached SharePoint, Copilot, Defender XDR and third-party AI connectors. None of these figures is an official count of affected users.

What admins should do now​

This is a service-side incident. Most of the fixes are in Microsoft's hands, but there is still plenty for IT staff to do.

• Go to Service health in the Microsoft 365 admin center. Look up EX1550543 and MO1550821, which several outlets confirmed, and TM1550488 for the earlier Teams problem. These posts are tied to your tenant and usually carry more detail than public social media updates.
• Don't rely only on the public status page. Users reported that it would not load during the incident. Microsoft's X account and the admin center are useful backups.
• Confirm it's this incident before you troubleshoot locally. Check whether the failing workloads match the advisory: Exchange Online, Teams, SharePoint Online, M365 Copilot and Defender XDR. If they don't match, you may have a separate tenant or client issue.
• Head off the wrong fixes at the help desk. Password resets, reinstalling Outlook, rebuilding profiles and changing network settings will not fix a server-capacity problem in Microsoft's datacenters. They only add tickets.
• Log what is affected. Record which workloads, sites and user groups are hit and when. You'll want that for the post-incident review and any SLA discussion.
• Use backup channels. For urgent messages, use whatever alternative your organisation has approved. If you had to work out which channel that is during the outage, add it to the next planning meeting.

Two security points are often missed. Defender XDR was on the list of possibly affected services, so security teams should check whether alerting or portal access was disrupted. They should also expect phishing campaigns that use the outage as a hook, such as fake "Microsoft 365 service restoration" emails asking users to sign in again.

For end users: save unsent drafts locally, don't keep forcing sign-outs, and try again later. Microsoft hasn't offered a workaround that is guaranteed to work. Repeating the same failed action ten more times is not one either.

Section summary: Use admin center Service health for tenant-specific updates. Confirm the incident before troubleshooting locally, keep the help desk away from fixes that can't work, and watch for phishing that uses the outage as bait.

The second major outage this year​

This isn't the first time 2026 has looked like this. TechRadar covered a major outage on January 22 that hit Outlook, 365 and Teams. That one ran into the next day under advisory MO1221364, and TechRadar summed up its cause as a humdrum server capacity issue. A day earlier, Tom's Guide reported that Microsoft was looking into a possible third-party networking issue affecting access to Teams and Outlook.

Capacity trouble in January and servers dropping out unexpectedly in November are different failures. They have something in common, though: Microsoft 365 is extremely resilient until a fault spreads far enough that "redistribute traffic" stops being enough. Parade, citing SQ magazine, said Microsoft 365 has an active user base of approximately 321 million, with nearly 4 million companies utilizing the Microsoft 365 suite. At that size, even a partial outage affects a lot of workplaces.

To be fair to Microsoft, its updates on Thursday were frequent and fairly open. It corrected the "elevated load" explanation instead of letting a misleading traffic-surge story stand, and it said plainly what it was doing to mitigate the problem. Two questions remain. Why did a group of servers fail at the same time? And why could the rest of the system not absorb the loss without customers noticing? We'll know more if Microsoft publishes a post-incident report in the admin center.

Bottom line: As of this writing, the Microsoft 365 connectivity incident is ongoing. Microsoft says unexpectedly unavailable servers are straining the rest of its infrastructure. Exchange Online, Teams, SharePoint, Copilot and Defender XDR are listed as possibly affected, and the problem may reach users in any region. Admins should rely on admin center Service health, keep the help desk away from fixes that can't work, and watch for the post-incident review.

Update: Alternative health check returns some servers to service (November 12, 2026)​

According to FingerLakes1.com, Microsoft said at 4:01 p.m. Eastern that an alternative health check had returned some affected servers to service. The company was applying the change more broadly, but the incident remained unresolved.

Microsoft was also preparing automated recovery for unresponsive servers and investigating a small number of configuration updates as possible contributors, FingerLakes1.com reported. Microsoft’s list of potentially affected services now includes Planner, To Do and multiple Purview services.

The next update was scheduled for 5:30 p.m. Eastern; that was not a promised restoration time.

Update: Microsoft points to server health-check component (November 12, 2026)​

Human Resources Director reports that Microsoft’s later investigation found failed health checks may originate in a component responsible for processing server health. Microsoft also said it had not identified a recent change that correlated with the start of the outage. That narrows the investigation toward how server health is being assessed, but does not establish why servers became unavailable or confirm that this component is the root cause.

This adds a diagnostic detail to the earlier update, which said Microsoft was investigating a small number of configuration updates as possible contributors. The new report does not say those checks are complete or that configuration changes have been ruled out; it says Microsoft has not found a recent change linked to the incident. For admins, there is still no new customer-side workaround or confirmed restoration time: continue to monitor tenant-specific Service health updates while Microsoft works to return affected servers to service.

Update: Microsoft considers configuration rollbacks (November 12, 2026)​

Microsoft says it is assessing whether reverting a small number of recent configuration updates could accelerate recovery, according to Interesting Engineering. The company is also continuing to restart and validate affected servers.

Microsoft has not confirmed that the configuration updates caused the outage, and the rollback was still under consideration rather than confirmed as deployed.

Update: Microsoft changes recovery approach as relief falls short (November 12, 2026)​

According to the separate outage report, Microsoft said at 22:11 UTC that its recovery actions had not delivered the expected relief. A core process on affected servers was becoming overwhelmed, causing them to stop responding and reducing available capacity.

Microsoft’s new plan was to isolate part of the service infrastructure, restart affected components and gradually restore traffic to test stability before applying the approach more widely, the report said. The company was also considering isolating traffic by region so regions could recover independently.

The report says Microsoft’s potentially affected services list now includes Intune, Defender for Office 365 and specific Purview functions, including Data Loss Prevention and Auto Labelling. It also lists intermittent failures exporting sensitivity-labeled Power BI reports to PDF, as well as Cloud Update, Cloud Policy and Inventory in the Microsoft 365 Apps admin center.

Admins should check those workloads and device check-ins where relevant. The next Microsoft update was scheduled for 23:30 UTC; that was an update time, not a restoration estimate.