Was the Internet Down? Microsoft 365 Outage and Unrelated Service Reports Explained

For Windows admins and Microsoft 365 tenants, the gap between those two accounts matters. Here is what was confirmed, what wasn't, and what to do about it.

What broke, and when​

CIO, citing Microsoft's service health dashboard, puts the start of the outage at 16:17 UTC on Thursday, November 12. LazyAdmin's timeline uses the same start time for the Exchange incident and says EX1550543 starts. Users can't open their mailboxes. About two hours later, MO1550821 opened for the services that depend on Exchange Online.

The start time is a little less settled than it looks. Windows Latest says Microsoft's report gave the start as around 1:25 PM ET, but we've got credible reasons to believe the outage started much earlier in the day, although it was limited. LazyAdmin also records an earlier, separate Teams incident (TM1550488), Americas only. Resolved. That one ran from 14:45 to 15:53 UTC. Anyone filing a complaint or an SLA claim should keep those three incident IDs separate.

Microsoft first described trouble in one region. According to SecurityWeek, Microsoft initially reported that users in the Americas were having trouble connecting to Exchange Online mailboxes. It later identified potential disruption to Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR. CIO reports that within two hours Microsoft said users in any region could be affected. At the peak, Downdetector logged more than 130,000 Outlook problem reports.

The incident IDs to track:

Summary: This was an Exchange Online incident that spread to dependent services. The Internet as a whole kept working.

The "whole Internet" problem​

Macworld deserves credit for qualifying its own headline. It noted that Downdetector and ThousandEyes Outages showed complaints about unrelated platforms. It also said those reports did not prove every service was down or that the failures shared Microsoft's cause. An Amazon spokesperson told Macworld that AWS was working normally and had been all day. Some users reported iMessage problems, but Apple's System Status page showed no matching outage at the time.

So why did it feel like the whole Internet was down? Outage maps count complaints, not confirmed failures. When a service that hundreds of millions of people depend on goes down, people start blaming everything else that seems slow. The Associated Press has noted that Microsoft cites roughly 430 million Microsoft 365 app users. That is the size of the user base, not a count of people affected by this outage, which remains unknown.

Macworld also reported that OpenAI and Anthropic saw disruption to the tools that connect their AI assistants to Microsoft 365. The assistants themselves were not reported down. A ChatGPT task that pulls from your mailbox or SharePoint would fail because the Microsoft data source was unavailable.

Summary: The confirmed outage was Microsoft's. Reports about AWS and Apple services were not tied to the same cause, and AI tools failed only where they connected to Microsoft 365.

Which services failed, and how much​

The scope was uneven. SecurityWeek summarized Microsoft's position as follows: Features of many Microsoft 365 services that interact with Exchange Online and email services are impacted. Elements of those services that do not depend on interaction with Exchange Online remain functional, Microsoft said.

The University of Pennsylvania's mirror of Microsoft's incident feed and CIO's reporting give the detail:

• Outlook and Exchange Online: Mailbox access could fail through Outlook on the web, desktop Outlook (MAPI), Exchange ActiveSync and REST connections, and mail delivery could be delayed.
• Teams: Most core features kept working, including calls, meetings, group chats and channel messages. Features that depend on Exchange could fail: calendar scheduling and invites, creating live or virtual events, some contact syncing, and creating or deleting private or shared channels.
• SharePoint Online: Direct access to files kept working. Features that depend on Exchange could be affected.
• Microsoft 365 Copilot: Copilot Chat might not load or respond, and Copilot might be unable to reach email, calendars and files.
• Defender: Defender for Office 365 Safe Links might be unable to check URLs clicked in Outlook and Teams, and some Defender XDR portal pages were affected.
• Purview: Data loss prevention, auto-labeling, Communication Compliance, Information Protection labels, eDiscovery search and export, and audit searches could be affected.
• Windows 365: Tenants using Microsoft Purview Customer Key for Cloud PCs could have users who were unable to connect to their Cloud PCs.
• Also listed: some Intune enrollment and compliance scenarios, Microsoft To Do failing to load, and Power BI exports of sensitivity-labeled reports to PDF failing intermittently.

The Windows 365 and Safe Links items deserve attention. The first means an email outage could stop some users from reaching their desktops at all. The second means a security control may have quietly stopped checking links.

What Microsoft said caused it​

Microsoft's explanation changed over the course of the incident, and it has not confirmed a root cause.

Early updates blamed elevated load across multiple regions. Microsoft later told CIO that the load was not coming from more traffic but from a large number of servers being unexpectedly unavailable, which pushed their load onto the remaining infrastructure. On the Microsoft 365 Status account, the company said a problem that's causing servers to fail automated health checks and become unavailable was the issue it was working on.

Microsoft then said a process on the affected servers that establishes secure connections was becoming overwhelmed, so those servers stopped processing requests. It said it was testing a configuration change on a subset of servers and rolling back a recent network configuration change whose timing matched the start of the outage. It did not say the rollback caused the recovery or that the network change caused the outage.

Recovery was slow and uneven. LazyAdmin's timeline shows Microsoft pauses all deployments and configuration changes around 19:06 UTC Thursday. Around 21:08 UTC, some servers return to service using a different health check method. Then, at midnight UTC, returned servers become unresponsive again once they receive traffic. By 04:57 UTC Friday, Microsoft scales up VMs to handle the traffic surge. Some machines are stuck in a bad state. CIO reported Microsoft as saying its own traffic rebalancing had increased the volume of calls from its routing services to backend servers. In other words, the recovery work was adding load of its own.

Microsoft said it was not aware of any malicious activity behind the outage and promised a post-incident report after mitigation. On the evidence so far, this is not a cyberattack, not a Windows failure and not an AWS problem.

Summary: Servers were failing health checks and getting overloaded on secure-connection handling. A network change is under investigation, and there is no final root cause yet.

Real-world effects​

Macworld reported that UK NHS trusts, including the children's provider Evelina London, could not reliably send or receive email. Police forces said some online reporting forms could be affected, but 999 and 101 call handling was not. Schools asked parents to phone instead of email. AP reported disruption to government email in Singapore, some Supreme Court operations in the Philippines, and Japanese authorities lining up telephone alternatives. Air India said flights were unaffected and rerouted customer email.

As of Macworld's 11:45 GMT update on Friday, citing the Guardian, Microsoft said it had finished recovery work in Asia-Pacific and was extending it to other regions. Macworld said no confirmed time for full restoration had been given. Treat that as a snapshot, not a final all-clear.

What admins should do now​

1. Check the incidents for your own tenant. Microsoft Q&A guidance says to Sign in to the Microsoft 365 Admin Center. Go to Health > Service Health. Search for Issue ID: MO1550821. Also check EX1550543.
2. Have a backup status source. If you can't reach the admin center, LazyAdmin notes that Microsoft posts the same updates on status.cloud.microsoft and on the @MSFT365Status account on X.
3. Write down your incident IDs and times now. Windows Latest says business customers can ask for a credit. In the support request, explain that you want Microsoft to review an SLA credit for the outage, and include the relevant incident ID. Whether you qualify depends on your agreement and on how much downtime you can show.
4. Check your security controls. If Safe Links or Purview DLP was impaired, review what got through during the outage window.
5. Don't go hunting for fixes on your own machines. Nothing in the reporting points to Windows builds or local configuration. Rebuilding Outlook profiles will not fix a server-side outage.

Sanchit Vir Gogia of Greyhound Research made the longer-term point to CIO: enterprises have priced Microsoft 365 as a licence and never as a single point of failure. His recommendation is not a second productivity suite. It is a rehearsed fallback for the few things that can't stop: a separate channel for incident command, mail continuity for critical roles, and a written decision on whether each security control fails open or closed when the service behind it goes down.