BusinessTech, The South African and MyBroadband all covered the SARS alert. Taken together with other reporting, the picture is fairly clear. Exchange Online was failing, and the damage spread to every Microsoft 365 service that depends on it. Outlook took the worst of it.
What SARS actually said
The notice was short. SARS said Microsoft was having a global service outage that "may affect access to Outlook, Teams and other Microsoft 365 applications." It added that its technical teams were working directly with Microsoft and that it would share more information as it came in. SARS apologised to taxpayers and traders for the inconvenience.
The outlets framed the notice differently:
- MyBroadband wrote that SARS had warned its services were being affected.
- The South African pointed out that SARS had not said whether its own online services, including eFiling, were affected.
- BusinessTech said SARS warned the outage could disrupt its operations, but it named no specific SARS system that was down.
SARS's own wording supports the cautious version. None of the published reporting confirms that eFiling or customs platforms went offline. None mentions a filing extension, a workaround or a restoration deadline. The confirmed facts are that SARS knew about the outage, was talking to Microsoft, and expected Microsoft 365 tools to be disrupted.
Section summary: SARS warned of possible disruption to Microsoft 365 tools. It did not say eFiling was down, and it offered no deadline changes.
The incident behind the alert: EX1550543 and MO1550821
Administrators can follow this outage through two incident IDs in the Microsoft 365 admin center. The South African coverage doesn't mention either ID.
On Thursday, Microsoft first said it was "investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas," tracked under EX1550543. BleepingComputer reported that a broader advisory, MO1550821, confirmed customers may be unable to connect to multiple services, including Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR.
According to BleepingComputer, the Microsoft 365 incident began Thursday at 1:26 PM ET, although Microsoft began investigating Exchange Online mailbox connectivity problems in the Americas earlier in the day. Microsoft at first described the problem as limited to the Americas, but it later confirmed that users in any region could be affected. That is why South African businesses arriving at work on Friday morning found their inboxes unreachable.
SecurityWeek reported that Microsoft said features of many Microsoft 365 services that interact with Exchange Online and email services are impacted, while elements that do not depend on Exchange Online remain functional. That one sentence explains why the effects were so uneven.
Section summary: If you have admin access, EX1550543 covers Exchange Online and MO1550821 covers wider Microsoft 365 connectivity.
Which services broke, and how badly
The South African's breakdown matches the Exchange-dependency pattern:
| Service | Reported impact |
|---|---|
| Outlook / Exchange Online | Mailboxes possibly unreachable on desktop, mobile and web; mail delivery delayed |
| Microsoft Teams | Core chat and meetings mostly working; calendar, scheduling and invites failing |
| Microsoft 365 Copilot | Problems with Copilot Chat and pulling in work email, calendar and file data |
| SharePoint | Some connected features affected; direct file access still working |
| Microsoft Defender | Safe Links link checking in emails and messages possibly affected |
According to an Azure-focused community write-up, every Exchange Online access path was hit. Microsoft said Outlook on the web, desktop Outlook (MAPI), mobile mail (EAS) and the REST API were all affected. So switching from desktop Outlook to the web version would not have helped.
The City of Cape Town posted its own public notice. It warned that OneDrive users might have trouble opening files. It also told staff the problems came from Microsoft's global infrastructure, not their own devices or network connections. That last point is useful: it should stop people rebooting routers and reinstalling Office for nothing.
The South African experience was messy. MyBroadband's sources said JSE-listed Lesaka Technologies and Momentum Group were affected. Medical aid provider BestMed and some residential estates told customers their email was down. One reader said Outlook was their company's main link to overseas suppliers, so they couldn't reach suppliers or customers. Some firms looked at WhatsApp and Gmail as temporary channels. That was a stopgap, not a recommendation. Other readers said Teams calls, meetings and chats mostly kept working, but calendar functions did not.
Section summary: Email was the main casualty. Teams was degraded rather than fully down, and Copilot, SharePoint and Defender lost the features that depend on Exchange.
What Microsoft says went wrong
Microsoft's explanation changed as the incident went on.
- Thursday evening: Microsoft said a portion of its infrastructure was under elevated load across multiple regions, which was probably causing the connectivity errors.
- Overnight: MyBroadband quoted Microsoft saying "a core process on the affected servers is becoming overwhelmed," causing servers to stop responding and lose capacity. The South African described it as a process that sets up secure connections. It said the problem got worse when other servers unexpectedly became unavailable, and that Microsoft was looking at a network configuration change made around the time the outage started.
- Mitigation: Microsoft considered traffic throttling, protocol adjustments and failover routing. It later reported "positive results" from a routing-configuration patch on part of its infrastructure and said it was rolling it out to more servers.
- Latest update reported by MyBroadband: Microsoft said it was seeing "early signs of stabilisation," but capacity had not returned to normal. Engineers were draining traffic from affected servers, restarting and fixing them, and bringing them back in stages.
Several outlets also cited a separate explanation that failed server health checks disrupted Outlook and other Microsoft 365 services. The overloaded process, the failed health checks and the configuration change could all be parts of one chain of failures. Until Microsoft publishes its promised Post-Incident Report, that remains informed speculation.
Was it a cyberattack? Microsoft said it was not aware of any malicious activity. SecurityWeek noted the outage came two days after November's Patch Tuesday, which fixed an exploited Outlook spoofing flaw, but that Microsoft's service advisories have not linked the vulnerability to the Exchange Online outage. Two events close together in time don't prove one caused the other.
The 48-hour email detail admins should know
MyBroadband reported that Microsoft was extending email timeout windows to 48 hours to protect delayed messages during recovery.
In practice, mail servers retry sending for a limited time before giving up and returning a non-delivery report. A longer window means mail sent to your organisation during the outage is more likely to arrive late than bounce. Mail your organisation sends to outside recipients is a different matter, because their servers set the retry rules.
Practical guidance for Windows and Microsoft 365 shops
None of the following comes from Microsoft or SARS. It is general operational advice based on what this outage showed:
- Check the right source. Look up EX1550543 and MO1550821 in Service health in the Microsoft 365 admin center. During outages the admin center itself can be slow, so watch Microsoft's public status channels as well.
- Don't troubleshoot endpoints. If every access method fails at once, rebuilding Outlook profiles or clearing caches won't help.
- Have an out-of-band channel ready. If your incident plan depends on email and Teams calendar invites, it fails along with them. Set up SMS, a phone tree or a separate messaging tool before you need it.
- Expect a backlog when service returns. Delayed mail may arrive in bursts. Tell users not to resend everything, or recipients get duplicates.
- Re-check anything time-sensitive. For taxpayers and traders, nothing published moves any SARS deadline. Keep an eye on official SARS updates rather than assuming you'll get extra time.
The bigger picture
The SARS notice says a lot about how cloud services are concentrated. A national tax authority, a metro municipality, JSE-listed companies and residential estates all lost email at the same time because of one Microsoft failure. The scale of Microsoft 365 is a big reason organisations choose it, and it is also why a single failure in Exchange Online reaches so far.
The obvious counterpoint is that running your own Exchange servers has outages too. They just affect fewer people and get less coverage. Microsoft's post-incident report should show whether this was a one-off failure or a design weakness. For now, the lesson for IT teams is simple: plan for what happens when your main communication platform goes down, because this week it did.
Update: Microsoft says a serviceability change did not work as expected (November 13, 2026)
Microsoft says a change intended to improve serviceability was “not taking as expected,” according to STV News. The company has tried several mitigation measures, including isolating infrastructure and shifting traffic to alternate routes.
That qualification follows the earlier reports of positive results from a routing patch and signs of stabilisation. STV’s report does not establish whether the change Microsoft described was the same patch, or whether those earlier gains have been reversed.
The outage is also affecting Scottish public services. STV reports that West Lothian, Midlothian and City of Edinburgh councils, NHS Grampian and Scottish Water have experienced issues. Edinburgh council urged parents who need to contact their child’s school to use the telephone.
For Microsoft 365 administrators, the report is a reminder that an attempted fix does not necessarily mean service has recovered. Organisations relying on email for time-sensitive communications may need to keep alternative contact routes available while Microsoft continues mitigation.
Update: Suffolk police and fire service warn about online forms (November 13, 2026)
According to the East Anglian Daily Times, Suffolk Constabulary has warned that online reports submitted through its website may be affected by the Microsoft outage. The force advised people needing non-emergency assistance to call 101 or use its live chat, and to call 999 in an emergency.
Suffolk Fire and Rescue Service has also advised people to call rather than use online forms for urgent matters, the outlet reported. These warnings add public-facing forms to the services potentially affected; they do not establish that every submission is failing.
For organisations administering similar forms, the reports highlight a practical risk: a user may submit a time-sensitive request without knowing whether it has reached the intended team. Where a form or its processing depends on affected Microsoft services, administrators should check submissions and make alternative contact routes clear while the incident continues. The Suffolk reports do not identify the technical cause of the form issues.