Where Microsoft says recovery stands
In an update that Italian news agency ANSA relayed at 16:42 CET (15:42 UTC), Microsoft described "broader improvements" in North America and "steady improvements" across much of Europe. It also said it was seeing encouraging signs of recovery in Asia-Pacific. It still warned that some users could have intermittent connection problems or delayed mail. Italian tech writer Pasquale Pillitteri compared that wording with Microsoft's earlier updates. He found that Europe had moved up from "encouraging recovery progress" to "steady improvements," while Asia-Pacific was still the only region described with "signs" instead of "improvements."
Petri's running log shows how the wording changed during the day. At 7:18 AM ET, Microsoft confirmed "encouraging" progress in recovery in Europe. By 10:24 AM ET, it said it was "observing sustained improvements in service availability as recovery progresses across affected Microsoft 365 services." Another Microsoft post, reported by ABC7, set out the priority: "We're focused on recovery for the remaining affected environments while prioritizing email queue and backlog reduction."
These are Microsoft's own descriptions. No outside party has measured how much traffic is back to normal, and "much of Europe" doesn't tell you how many European users still lack mail. Microsoft has not provided an exact time for when it expects Outlook and other 365 services to return to normal functions.
Summary: Things are getting better in every region, at different speeds, and Microsoft still hasn't given an end time.
How the outage unfolded
The disruption, which began Thursday afternoon, primarily affected Microsoft's Exchange Online email infrastructure, preventing users from accessing their Outlook mailboxes and causing delayed email deliveries. It spread beyond email: Teams, SharePoint Online, Microsoft Copilot 365, and Microsoft Defender XDR were also impacted by the outage.
Recovery has gone backwards at least once. Early Friday, ANSA reported that Microsoft said its fixes weren't working as expected and that it was looking for other ways to add capacity because traffic management was still unbalanced. Gulf Business described another problem: some servers become unresponsive again when traffic is reintroduced, slowing recovery efforts. In plain terms, bringing a server back online doesn't help much if it falls over again as soon as users reconnect.
Microsoft hasn't published a formal root cause. Petri reports that an overwhelmed backend process triggered cascading server failures and that Microsoft deployed an upstream authentication and routing patch to stabilize its global Microsoft 365 outage. Until Microsoft releases its post-incident report, which it has said will come after recovery, treat that as an early account. France 24 headlined Microsoft's position that there were "No signs of a cyberattack".
Summary: The outage started in Exchange Online, spread to other services and had setbacks during recovery. The official cause report is still to come.
Why your mailbox can open while your mail is still missing
Microsoft keeps reporting better "service availability." That means you can sign in and open your mailbox. It doesn't mean the mail that piled up during the outage has been delivered. Clearing that backlog takes time, even after the service is responding again.
The 48-hour figure needs some care. CNN reported that Microsoft extended the email timeout window to 48 hours, and explained that the email timeout window is the maximum amount of time that a mail server or email client such as Outlook will spend waiting to receive an email before returning an error. Gulf Business said the extension remains in place, giving delayed messages more time to reach recipients before they expire.
Here's what that means for you:
- It's not a delivery promise. ANSA says delays "could" reach 48 hours. That's a possible upper limit, not a deadline you can plan around.
- It's not an SLA term. The timeout keeps delayed messages from expiring too soon. It doesn't promise when they'll arrive.
- It explains the waiting. A message sent Thursday afternoon may still be retrying, and the extended window keeps it from being bounced back in the meantime.
Summary: Being able to open your mailbox isn't the same as getting your mail. The 48-hour window protects delayed messages but doesn't say when they'll show up.
A practical guide for Microsoft 365 admins
Pillitteri's report gives EX1550543 as the Exchange Online incident ID, which the @MSFT365Status account cites in its updates. It gives TM1550488 as the Teams incident, opened Thursday for sign-in problems in North America. WindowsForum couldn't confirm either ID on a public Microsoft page. Admins should look in Service health in the Microsoft 365 admin center, where details for their own tenant appear.
For individual messages, Microsoft's Exchange documentation recommends message trace in the Exchange admin center (EAC). Here's how to use it during this incident:
- Check your permissions. According to Microsoft's documentation, message trace requires membership in the Organization Management role group in Exchange Online, or the Exchange Administrator role in Microsoft Entra. Microsoft advises against using Global Administrator for routine work.
- Start narrow. By default, a new trace covers all senders and recipients over the last two days. Microsoft's FAQ recommends entering the sender, the intended recipients and the approximate send time.
- Read the status. Message trace shows whether the service received, rejected, deferred or delivered a message. "Defer" means delivery was postponed and may be tried again later. During this incident, that's the status you'd expect to see. "Getting status" means Microsoft 365 received the message recently but has no further data yet.
- Check the events. Microsoft's FAQ says the events section explains why a message hasn't been delivered yet, and the timestamps show where it is in the pipeline.
- Allow for lag. Microsoft says a sent message should show up in trace data within 5 to 10 minutes. Under normal conditions, results for messages less than 10 days old appear right away in the modern EAC.
- Use PowerShell if the portal times out. Microsoft suggests the Get-MessageTraceV2 cmdlet, which has more lenient timeout limits than the web interface. If you run it without parameters, it returns only the last 48 hours of data. The tenant limit is 100 query requests in any five-minute window, so set any automated polling well below that.
One caveat: one message trace tells you about one message. Microsoft's FAQ lists several reasons a message might be late, including large size, latency in the service and blocking. Don't use a single trace result to judge the state of all your tenant's mail.
Summary: Use Service health for the incident as a whole and message trace for individual messages. A "Defer" status during this outage is usually good news: the message is still in the system.
AI assistants hit by the same outage
The outage also broke third-party AI connectors that read Microsoft 365 data. Forbes reported that OpenAI said new connections to Microsoft's services may fail and existing tools may not work as expected, while Anthropic reported that email, calendar and search tools in its Microsoft 365 connector were failing for most requests.
According to Pillitteri, Anthropic's status page moved to "monitoring" at 15:40 UTC Friday, with the connector and Claude for Outlook starting to recover, though some SharePoint searches still failed. OpenAI's incident, "Elevated errors affecting the Microsoft 365 connector," was still listed as under investigation. If an AI assistant reads your company's mail, it goes down when Exchange Online does, because it has nothing to read. Organizations that rely on these connectors should include them in their incident playbooks.
The stock market's reaction
According to ANSA, as reported by Pillitteri, Microsoft shares were down 1.48% at $515.27 at the Nasdaq open, against a Thursday close of $523.00. That was a snapshot from the first minutes of trading. No analyst has separated the outage's effect from the investor worries about AI spending that have weighed on the stock for months. For IT teams, the more important number is how many messages are still waiting in queues.
What users should do now
- Don't resend over and over. A message sent during the outage may still be waiting in a queue. Sending it again can create duplicates once the backlog clears. Ask your admin to trace it first.
- Use another channel for urgent matters. Organizations have improvised: France 24 noted that a European stock market operator asks companies to phone after Outlook outage. Use your organization's approved backup channel.
- Check your contract. Pillitteri notes that business and enterprise customers may be able to claim service credits under Microsoft's service level agreements. Admins should review their agreement terms once the incident closes.
- Don't treat "improvements" as "resolved." CNN reported Microsoft saying it was "seeing improvements in key scenarios, including mailbox access and delayed email processing, though some intermittent issues may continue."
Analysis: What this outage shows
This outage spread from email into collaboration, security tooling and third-party AI assistants. Each of those services depended on Exchange Online being up. This wasn't Microsoft's first email outage of 2026: in January, The Register reported a nearly 10-hour Microsoft 365 outage in which affected users reported internal mail flowing slowly, while external email had packed up altogether. A second day of disruption in November will make it harder for Microsoft to avoid questions from European public administrations and large enterprises about relying on a single vendor.
To be fair to Microsoft, recovering a global, multi-tenant mail platform is hard. Servers that buckle when traffic comes back are a familiar failure pattern, and extending the timeout to 48 hours was a sensible way to avoid a wave of bounced mail. Still, customers deserve more than reassuring adjectives. They need a clear root cause, a timeline and evidence that the fix will hold. Until Microsoft publishes its post-incident report, check your own inbox and your message traces rather than relying on the status wording alone.