The hospital's message to patients was short. Email is unreliable for now. For an urgent question about an upcoming appointment, call the clinic or department through the main hospital line. Otherwise, wait until email is restored. Unity Health also said that patient and resident care is not affected and that its hospitals remain safe and open.
The problem behind that notice was one of the larger Microsoft 365 incidents of the year. Here is what happened and what IT administrators should take from it.
What Unity Health Toronto reported
Unity Health posted its notice at about 20:00 UTC (3 p.m. Eastern) on November 12 and updated it a few minutes later. It said:
- A Code Grey was declared because of the global Microsoft 365 outage.
- Hospital staff had trouble sending and receiving email.
- Patients with appointment questions should call the main hospital line if the matter is urgent, or wait for email to come back.
- Patient and resident care was not affected, and the hospitals stayed open.
- The organization would keep monitoring while Microsoft worked on a fix. Anyone with questions should contact their care team.
In Ontario's hospital emergency codes, Code Grey usually means a loss or failure of infrastructure. That reading comes from general industry knowledge, not from the notice. The point is that this was handled as a disruption to operations, not to clinical care. The notice does not say which sites, departments or other Microsoft 365 tools beyond email were affected, so this article doesn't guess.
Section summary: Email went down at a large Toronto hospital network. Care continued, and patients were sent to the phone line for urgent appointment questions.
What broke at Microsoft: Exchange Online mailbox access
Microsoft's main incident was in Exchange Online, the hosted mail service behind work and school Outlook mailboxes. The Microsoft 365 Status account on X first said it was investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas. More details can be found in the Microsoft 365 admin center under EX1550543.
The scope soon widened beyond the Americas. Microsoft said "While we're working to mitigate impact, we've confirmed the issue may affect Microsoft 365 service connectivity for users in any region." That explains why a Toronto hospital called it a global outage.
Microsoft's incident history, as preserved by the status tracker IsDown, listed these connection methods as possibly affected:
- Outlook on the web
- MAPI, which desktop Outlook uses
- Exchange ActiveSync (EAS), used by many mobile mail apps
- The REST API
That list covers browser, desktop and phone access. Switching to a different app was unlikely to help.
There was also a second notice. Microsoft reported an Exchange Online incident, EX1550543, and a Microsoft 365 suite advisory, MO1550821. According to the outage tracker StatusStack, MO1550821 names possible connectivity issues for Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365, Microsoft Defender XDR, Microsoft Planner, and Microsoft To Do. Microsoft still described Exchange as the main affected service. "Global outage" does not mean every Microsoft 365 product failed for every tenant.
Teams adds some confusion. StatusStack and other trackers note that Microsoft tracked a separate Teams incident in North America earlier on November 12 (TM1550488) and said automated recovery restored it. Teams complaints that afternoon may have come from more than one problem.
How big was it?
User reports rose quickly. The Post and Courier, syndicated on Yahoo Tech, reported that the outage began shortly before 1 p.m. Eastern. According to Downdetector, Outlook reports climbed from fewer than 3,000 to more than 128,000 in under an hour. Downdetector counts self-reported complaints, not verified affected users, so treat those numbers as a sign of scale rather than a census.
The impact went well beyond hospitals. Houston station KPRC reported that some Southeast Texas cities say the outage is affecting city services, including Sugar Land, Pearland, and League City. The University of Wisconsin–Milwaukee's IT status page described a widespread outage affecting email access and delivery (desktop, mobile, and Outlook on the web).
Microsoft's explanation so far
Microsoft's public updates changed over the course of the day:
- Elevated load. Microsoft first said the infrastructure was "experiencing elevated load across multiple regions." It began moving US traffic to other infrastructure and spreading Outlook connections across its worldwide capacity.
- Servers dropping out, not a traffic surge. Microsoft later revised this: "We determined the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure."
- Failing health checks. Later updates in the IsDown history said affected servers were failing automated health checks and being taken out of service. Microsoft looked at a component that processes those checks and also paused all deployments and configuration changes as a precaution.
- A partial fix. CNBC reported that around 4 p.m. Eastern, Microsoft said it had "validated an alternative service health check method" that brought some affected servers back online. Microsoft also said it was reviewing a small number of recent configuration updates as possible contributors.
- A setback. In a later post, Microsoft said its actions so far had not brought the relief it expected. A core process on the affected servers was becoming overwhelmed and making them stop responding. Microsoft said it would isolate part of the infrastructure, restart components and bring traffic back gradually.
In its most recent update in the IsDown record, Microsoft said some servers were back in service and stable so far. It had moved traffic to alternative pathways and seen limited recovery in some regions. It warned that users might recover gradually as their clients reconnect, and set the next update for 00:00 UTC on November 13. That is not a declaration that service has been restored, and no final root cause had been published.
Was it an attack? The UK security firm Cypro noted that no evidence published on 12 November linked the Microsoft 365 outage to a cyber attack. So far, the evidence points to server availability and health-check behavior.
Section summary: Many Exchange Online servers failed health checks and dropped out, overloading the rest. Microsoft's fixes produced partial, uneven recovery. Root-cause analysis was still under way.
What Microsoft 365 administrators should do
You can't fix Microsoft's servers. You can stop your help desk from wasting the afternoon on laptops that are working fine. Microsoft's own guidance on Microsoft Learn suggests this approach:
- Check Service health first. In the Microsoft 365 admin center, go to Health > Service health, or select the Service health card on the Home dashboard. Look for EX1550543 and the related MO1550821 advisory. The Active issues Microsoft is working on section shows the incident details and a running feed of updates.
- Make sure the right people can see it. Microsoft says people with the Service Support admin and Helpdesk admin roles can view service health, so you don't need to hand out Global Admin rights in a crisis.
- Have a backup source. If you can't sign in to the admin center, Microsoft points to its public service status page and the @MSFT365status account on X.
- Turn on alerts. Under Customize > Email, you can get notifications for incidents and advisories on chosen services, up to two addresses per admin. You can also subscribe to updates for a single issue with Manage notifications for this issue. The Microsoft 365 Admin mobile app sends push notifications too.
- Know the terms. Microsoft calls something an incident when a service or a major function is unavailable, such as users being unable to send and receive email. An advisory covers more limited or intermittent problems where the service still works.
- Expect a slow recovery. Microsoft warned that clients reconnect gradually, so some users may come back before others. Resist the urge to rebuild Outlook profiles while the incident is still open.
- Report anything not listed. If a problem isn't on the dashboard, use Report an issue so Microsoft can check whether it's widespread.
The bigger lesson: plan for the day email goes down
Unity Health's notice is a good example of handling an outage well. It was quick, it explained the impact plainly, it gave patients a working fallback (the phone) and it separated the communications problem from patient care.
Every organization that runs on Microsoft 365 should ask a few questions. If Exchange Online is down for an afternoon:
- How do you tell staff what's happening?
- How do customers or patients reach you?
- Who owns the public notice?
The answers belong in a written runbook before the next incident, not on a whiteboard during it.
There's a fair counterpoint. Running Exchange on-premises doesn't remove risk. It moves the risk to your own patching, hardware and staff, and those have their own failure history. The realistic answer is a tested fallback plan, not a return to self-hosting:
- phone trees
- an out-of-band status page
- SMS alerts
- scheduling systems that don't depend on email
This was not a WindowsForum test. It's general experience from IT practice. The organizations that come through outages well have usually rehearsed them.
Microsoft is expected to publish a post-incident report once it confirms the cause. Until then, admins should keep watching EX1550543. Patients with urgent appointment questions at Unity Health can call the main hospital line.
Correction (November 12, 2026): An earlier version of this article said Teams had trouble sending and receiving email. Unity Health Toronto's notice said its staff teams were having difficulty sending and receiving email; Microsoft Teams is not an email service and was not the subject of that part of the notice.