Microsoft's own incident record goes further than that short public statement. It shows that the outage reached well beyond Outlook, which explains why Teams, Copilot, Purview, Defender and other services also showed errors. It also shows what Microsoft tried before the update saying the fixes weren't working.
The incident, by the numbers
Microsoft is tracking the outage as MO1550821. In the Microsoft 365 admin center advisory, Microsoft confirmed that customers may be unable to connect to multiple services, including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR. According to BleepingComputer, the incident began Thursday at 1:26 PM ET, although Microsoft began investigating reports of Exchange Online mailbox connectivity problems in the Americas earlier in the day. That is 18:26 UTC on November 12, which matches the start time in Microsoft's incident feed.
There is also a separate Exchange-specific record. Microsoft's status posts pointed admins to EX1550543 and MO1550821 in the Microsoft 365 admin center, as well as status.cloud.microsoft if the admin center is not available to you.
Downdetector reports give a rough sense of scale. Free Press Kashmir reported nearly 130,000 Outlook reports at the peak. Earlier, Hollywood Life noted that Downdetector reported more than 100,000 reports shortly after 1 p.m. ET. These numbers come from users choosing to file a report. They are not Microsoft's count of affected tenants or people, and Microsoft has not published such a count.
Section summary: The incident is MO1550821, with a related Exchange record, EX1550543. It started at 18:26 UTC on Thursday, November 12, and Microsoft had not given an estimated time for full restoration.
From "elevated load" to "servers going missing"
Microsoft's explanation shifted as its investigation went on, and the earlier updates help explain why later fixes didn't hold.
- First explanation: load. According to Microsoft's notification quoted on Microsoft Q&A, the affected infrastructure was experiencing elevated load across multiple regions, which was likely contributing to the connectivity errors.
- Correction: servers were dropping out. Microsoft later said, as quoted by NBC Chicago, that the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure. This is the more accurate version of what Free Press Kashmir described as servers going "suddenly missing." Microsoft's wording is that servers became unavailable or unresponsive.
- Spreading the traffic. Microsoft posted that it had begun redistributing connection traffic across its broader worldwide infrastructure to help balance the load. The incident feed noted that this could add some latency.
- Health checks. One status post said Microsoft was testing a configuration change to address a problem causing servers to fail automated health checks and become unavailable, and in parallel had initiated a restart of all affected servers. Later, Microsoft "validated an alternative service health check method, which allowed a subset of affected servers to successfully return to service" and began applying that change more widely.
- A more specific cause, but not the root cause. Microsoft's incident updates, as mirrored on the University of Pennsylvania's Microsoft incident page, later said that a process on the affected servers that sets up secure connections was getting overwhelmed and causing the servers to stop handling requests. Microsoft said it was testing a configuration fix on a subset of servers and restarting infrastructure. At the same time, it was rolling back a recent network configuration change whose timing lined up with the start of the outage. It also limited the types of traffic reaching affected servers in certain locations, so it could check whether they stayed stable before adding traffic back gradually.
This sequence explains the "not taking as expected" update. Servers that came back online could fail again once normal traffic reached them, so restarts alone didn't solve the problem. The traffic imbalance Microsoft described is consistent with that. To be clear, Microsoft has not said the failed fixes caused the outage. It only said they did not work as hoped. A final root cause has not been published.
Section summary: Microsoft first blamed load, then servers dropping out of service, then an overwhelmed secure-connection process. Servers that were restored did not reliably stay up.
Why Teams, Copilot and Purview were affected too
Many readers were confused that an "Outlook outage" also broke Teams, Copilot and compliance tools. The reason is that many Microsoft 365 features depend on Exchange Online. Microsoft's incident feed says users could be unable to reach their mailboxes through Outlook on the web, Outlook desktop using MAPI, Exchange ActiveSync, or REST connections, and that mail delivery could be delayed.
Microsoft's impact list, as reproduced in the Penn feed, includes:
| Service | Reported impact |
|---|---|
| Teams | Calls, meetings, group chats and channel messages mostly worked. Calendar features that rely on Exchange (scheduling, invites, viewing and editing meetings) could fail. Creating Live or Virtual events could fail, and so could creating or deleting private or shared channels. |
| Copilot | Copilot Chat might not load or respond, and might not be able to reach work email, calendar and files. |
| Purview | DLP, auto-labeling, Communication Compliance, Data Classification, RBAC, audit searches and eDiscovery tasks could be affected. |
| Defender | Defender XDR portal access was listed. A later update also listed Defender for Office 365 features such as Safe Links and Safe Attachments. |
| Microsoft To Do / Planner | Apps might not load, or operations might fail. |
| Power BI | Exporting reports with MIP sensitivity labels to PDF could fail intermittently. |
| Windows 365 | Tenants using Purview Customer Key for Cloud PCs might find users unable to connect. |
Microsoft also said that parts of affected services that don't depend on Exchange Online could keep working. For example, files stored directly in SharePoint Online stayed accessible. A Teams calendar error, then, does not mean your meeting audio is broken.
The Windows 365 entry stands out. A Cloud PC is effectively a Windows desktop, and if it is configured with Purview Customer Key encryption, users could be locked out of it. That is a good reason to check which of your security dependencies sit on the same service paths as your email.
Section summary: Exchange Online was the main point of failure. The Teams, Copilot, Purview and Defender problems were mostly in features that depend on Exchange, not complete outages of those products.
Where things stand now
Later updates in Microsoft's incident feed suggest the situation improved after the setback. Microsoft said it had found no indication of malicious activity. It later reported "positive results for server stability" after applying a patch to an upstream authentication/routing configuration component on part of its infrastructure. A subsequent update said it was continuing to see increased stability and was rolling the patch out systematically, starting with regions in or entering peak business hours.
Microsoft has not declared the incident resolved, and it has not given a time for full restoration. The company says it will publish the root cause and "defense-in-depth repair items" in a Post-Incident Report once the issue is mitigated. Until then, treat the patch as encouraging progress, not a confirmed fix.
What admins and users should do now
- Users: This is a problem on Microsoft's side. As one Microsoft Q&A contributor put it, because this is a backend service interruption originating from Microsoft's infrastructure, there are no troubleshooting steps or corrective actions required on your part. Rebuilding your Outlook profile, resetting your password repeatedly or reinstalling Office will not help. Switching from desktop Outlook to Outlook on the web may not help either, because Microsoft listed both as affected.
- Admins: Follow the incident in the Microsoft 365 admin center under Health > Service health. You can sign in to the Microsoft 365 Admin Center and search for Issue ID MO1550821. If the admin center itself won't load, use Microsoft's public status page.
- Tell users mail may be delayed, not lost. Microsoft's scope notes say delivery could be delayed. That changes how you handle helpdesk tickets.
- Don't assume one working app means everything is back. Teams chat working says little about Purview DLP, Defender's Safe Links or Exchange-based calendars. Keep an eye on compliance and security tooling while recovery continues.
- Check Windows 365 Customer Key tenants if users report Cloud PC connection failures.
- Watch for the Post-Incident Report. It is likely to be the most useful document from this outage for resilience planning.
The bigger picture
Microsoft 365 has had large Outlook outages before. In March 2025, as Business Insider reported via Yahoo, Microsoft identified a potential cause and "reverted the suspected code to alleviate impact." In July 2025, it said its "configuration changes have effectively resolved impact in targeted infrastructure" before rolling them out worldwide. Both times, a configuration rollback or targeted change fixed things fairly quickly.
This incident was harder. Microsoft first said it had found no recent changes that lined up with the start of the outage, then later began reverting a network change that did. Its fixes worked on a subset of servers and then failed under full traffic. Microsoft was right to say plainly that its fix wasn't working, which beats a status page that just says "investigating" for hours. Still, the episode shows how much depends on Exchange Online: email, calendars, AI assistants, data-loss prevention and some Cloud PCs all slowed down or stopped when its connection layer failed.
IT teams should take a practical lesson from this. Map which of your workflows, especially compliance and security controls, depend on Exchange Online, and plan how you will communicate when it is down.