What actually broke
Problems began Thursday, November 12, 2026. Users began reporting at about 16:00 GMT that they could not access Outlook, and within about an hour, the outage tracker Downdetector had logged reports from 74 countries and territories. That 74-country figure shows where people reported problems. It doesn't count the organisations affected or confirm a service failure in each country.
The scope grew as the day went on. BleepingComputer reported that in a Microsoft 365 admin center advisory tracked as MO1550821, Microsoft confirmed that customers may be unable to connect to multiple services, including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR. The same outlet noted that the outage followed a separate Microsoft Teams incident earlier Thursday that caused an outage for users in North and South America, and Microsoft has not indicated whether the two incidents are related.
NBC News reported that consumer services were hit too. Microsoft's notice said "This issue impacts Outlook.com, OneDrive, OneNote To Do, Teams, and Microsoft 365 for the web." As of late Thursday, Microsoft's online status pages said its corporate services Exchange Online, Copilot, Microsoft Planner, Sharepoint, Microsoft To Do, Windows 365, cloud printing services, and mobile device management programs were all experiencing issues. Device management is on that list, so this went beyond email for Windows admins.
The outage also had a security side effect. One admin-focused writeup noted that in Defender for Office 365, Safe Links "may be unable to verify URLs", which may affect people clicking links in Outlook and Teams. It said all the main client paths failed: Outlook on the web, desktop Outlook (MAPI), mobile mail (EAS) and the REST API were all affected.
In short: this was a Microsoft 365 failure centred on Exchange Online. It spread to Teams, SharePoint, Copilot, consumer apps and some management tooling, and it lasted into a second day.
The recovery was slow
Recovery came in stages and wasn't smooth. BleepingComputer's Thursday evening update said Microsoft says it is seeing limited recovery from the widespread Microsoft 365 outage after successfully returning some affected servers to service. More than 12 hours in, Al Jazeera reported that Microsoft says it has had only "marginal success" in restoring its most widely used workplace services. Gulf Business reported that on Friday the company acknowledged that changes introduced to improve service availability were not working as expected.
By Friday morning, Eastern Time, there was progress. Microsoft says its services are gradually recovering from the widespread Microsoft 365 outage, with improvements in email access and delivery, and CNN's live coverage carried Microsoft's statement that email was "approaching normal levels." These are progress updates. They don't mean every tenant has fully recovered, and delayed mail and patchy access can linger after the headline problem is fixed.
What caused it (as far as we know)
According to The Independent, a technical failure involving its server infrastructure is the leading explanation. Microsoft said the problem came from "elevated load" caused by servers becoming "unexpectedly unavailable", not by a surge in traffic. The company said it saw no evidence of malicious activity, and executive vice president Charles Lamanna said a cyberattack had been ruled out.
Tom Worthington of the Australian National University told The Independent that a buggy software update was the most likely culprit. That is an outside expert's informed guess, not Microsoft's confirmed root cause. Expect a proper post-incident review in the admin centre under MO1550821. Until then, any confident claim about the exact trigger is speculation.
The "most damaging in history" claim, checked
The Independent's headline rests on one quote. Samuel Mather-Holgate, managing director of UK financial advisory firm Mather & Murray Financial, called the outage a "terrifying demonstration" of how fragile the modern economy has become. He also warned that most businesses will recover little more than service credits from Microsoft. The service-credit point is probably the most useful thing in the piece for finance teams: the SLA is not insurance.
The same article says early forecasts point to billions of pounds' worth of economic activity being affected. It names no forecaster and gives no method. CNN's live coverage ran an item headlined "Cost of Microsoft outage could top $7 billion, according to estimate", but the coverage available here doesn't say who produced that figure or how. Treat both numbers as rough early estimates.
There's also a difference between economic activity affected and money lost. A lot of delayed email gets sent later, and meetings get rescheduled. Real losses are things like missed deadlines, halted proceedings, delayed prescriptions and lost sales. They are real, but nobody has added them up yet. The Independent itself says there is no way to accurately measure the total cost for everyone affected.
Is it fair to compare this outage to the worst IT incidents ever? It's possible. But "could become" is carrying that quote, and readers should keep the conditional.
In short: the disruption is well documented. A historic economic toll is a forecast, not a finding.
Is "10 months after a similar outage" a pattern?
The Independent says this incident comes 10 months after another Microsoft 365 outage that Microsoft called a service functionality issue affecting a subset of customers intermittently, and which drew far fewer Downdetector reports. The article doesn't name that incident. One January incident fits the timing: Tom's Guide reported a January 21, 2026 disruption tracked as MO1220495. During that one, Microsoft said "a possible third-party networking issue may be affecting access to Microsoft 365 services, including Teams and Outlook for some users." We can't confirm that's the incident The Independent meant. The two events shouldn't be treated as sharing a cause either. One looked like an external networking problem; the other involved Microsoft's own servers.
What you could actually do during the outage
The honest answer for end users was very little. Al Jazeera put it plainly: the problem lies with Microsoft's servers rather than their own devices. The desktop version of Outlook may still show emails already downloaded, while Teams chats and calls have largely continued working. That's a small but real argument for keeping cached-mode desktop Outlook on key machines, alongside the web client.
For admins, the useful work happens before the next outage, not during it:
- Follow the incident ID, not social media. MO1550821 in the Microsoft 365 admin center is the official record, and the post-incident report should appear there.
- Keep an emergency contact list outside Microsoft 365. Matt Saunders, field CTO at Adaptavist, told The Independent that people can fall back on phones for meetings, but that's hard when everyone's numbers sit in a system that's also offline. Keep a copy that doesn't depend on Entra ID, Exchange or OneDrive.
- Choose a fallback channel and test it. The Independent's experts suggested phone or messaging services not tied to the main provider, such as WhatsApp or Telegram. Check that it fits your compliance rules before an incident, not halfway through one.
- Map what depends on what. Outlook, Teams and Copilot may share infrastructure behind the scenes, so having "three different apps" doesn't mean you have redundancy. Find which processes, such as approvals, customer email and device management, have a single point of failure.
- Warn staff about outage-themed phishing. Sophos researcher Aiden Sinnott told The Independent that scammers will pose as Microsoft or affected businesses offering fixes. If Safe Links can't verify URLs at the same time, that matters more than usual.
- Read the service credit terms before blaming Microsoft. If an hour of lost email costs you more than the credit is worth, the gap is your risk to manage.
Saunders's own advice: whenever you use an online system, think briefly about how you'd get the task done without it.
The bigger picture
Big cloud failures keep teaching the same lesson. When a lot of companies run on the same shared service, a fault in that service turns into a problem for all of them at once. Microsoft 365 is efficient and very capable, and it's also one big shared dependency. Tenants generally can't avoid that by changing their own configuration.
That doesn't mean everyone should leave the cloud. Self-hosted Exchange has its own outages, and they're on you to fix. It does mean continuity planning should assume Microsoft 365 will sometimes be unavailable for most of a working day, because that just happened. Whether or not this one ends up in the record books, it's a free rehearsal for the next one, so update the continuity plan before the post-incident report even arrives.