Microsoft 365 Outage: What to Check Afterward

Field notes from the engineering team

On Thursday, November 12, 2026, Microsoft 365 stopped working for a large share of its users. Outlook and Exchange Online took the worst of it. Teams, SharePoint, OneDrive and Copilot were affected too, and the trouble ran into Friday, November 13.

If your office could not send or read email for most of a day, you were not alone, and nothing on your side broke. This is a short account of what Microsoft has said so far, what the outage did and did not mean, and what to check now that mail is coming back.

This article reflects Microsoft’s updates through the morning of Friday, November 13. Microsoft had not declared the incident fully resolved at that point, and it had not yet published its root cause.

The short version

Item	Detail
What happened	Exchange Online and several other Microsoft 365 services were unreachable or slow for many customers worldwide, starting around 17:30 UTC (10:30 a.m. Mountain) on November 12.
Microsoft incident IDs	EX1550543 (Exchange Online) and MO1550821 (Microsoft 365). Admins can find them in the Microsoft 365 admin center.
Cause, so far	Microsoft points to servers that became unavailable and failed automated health checks. It has not published a final root cause.
Was it an attack?	Microsoft says it has no evidence of malicious activity. Nothing it has said suggests customer data was exposed.
Delayed mail	Microsoft extended its email timeout window to 48 hours so delayed messages are not lost.
What to do now	Check for late and missing mail, look at calendar items, undo panic changes, and treat any “Microsoft outage” message with suspicion.

What happened

Microsoft first posted about the problem as users in the Americas being unable to reach Exchange Online mailboxes through several connection methods. Network monitoring firm ThousandEyes saw connection resets, refusals, timeouts and server errors beginning around 17:30 UTC, along with heavy packet loss inside Microsoft’s network.

The list of affected services grew through the day. Microsoft’s incident notice named Exchange Online, Teams, SharePoint Online, Copilot and Microsoft Defender XDR. Reports also covered OneDrive, the Microsoft 365 admin center and Intune. Microsoft said features that did not depend on Exchange Online kept working, so some people could still use Teams chat while their calendars and mail failed.

Downdetector, which counts user reports, logged reports from 74 countries and territories within about an hour, according to the Associated Press. Reuters reported more than 130,000 Outlook problem reports in the US at the peak, and said the disruption reached government agencies in Australia, Japan and the United States.

By Friday morning Eastern time, Microsoft reported broader recovery in North America, sustained improvement across much of Europe, and encouraging signs in Asia Pacific. It also said email queues were “significantly reduced and approaching normal levels,” while warning that some users might still see intermittent access problems or delayed mail.

What Microsoft has said about the cause

Microsoft’s explanation changed as engineers worked the problem, so treat the details as provisional.

• Early on, Microsoft said a number of servers were unexpectedly unavailable and failing automated health checks, which pushed load onto the rest of the infrastructure. It said overall traffic had not gone up.
• It then tried configuration changes, restarts, an alternative health check method, and traffic optimization measures such as throttling, protocol adjustments and failover routing.
• Later updates described a core process on the affected servers becoming overwhelmed and a patch to an authentication and routing configuration component that was rolled out in stages. At one point Microsoft said a change was “not taking as expected.”

Microsoft has said it will publish a Post-Incident Report with the root cause and repair items once mitigation is complete. We have not seen that report, so we are not going to guess at the cause. Check Microsoft’s report when it appears.

Was this a breach?

Microsoft says it is not aware of any malicious activity tied to this incident. Euronews noted that the usual way to knock a service offline, a flood of outside traffic, does not match Microsoft’s statement that traffic had not increased. We would add one caution: “no evidence of malicious activity” is a statement about the cause of the outage, and it is the status as of today. The final report is the place to look for anything more.

An outage stops people from reaching their mail and files. It does not, on its own, mean anyone else saw them. That is the difference between a service problem and a security incident.

What to check now

Mail access and mail delivery recover separately. A mailbox that opens again does not prove everything sent to you has arrived.

1. Late and missing email. When Microsoft could not accept mail, sending servers generally got a temporary “try again later” reply instead of a rejection. The sender’s server holds the message and retries. How long it keeps trying depends on the sender, and some systems give up after a few hours and send back a bounce. The 48-hour window is on Microsoft’s side. A sender’s own retry limit is a separate setting, so some senders may have given up. Ask people who were expecting something important whether they got a bounce, and do not ask senders to resend everything: resending queued mail creates duplicates once the backlog clears. An administrator can run a message trace in the Exchange admin center to see what arrived and when.

2. Calendar and meetings. Microsoft’s notice said scheduling meetings, sending invites, and editing or viewing calendar entries could fail. If someone created or changed a meeting on Thursday or Friday, open it and confirm the attendees received it.

3. Links and quarantine. Microsoft’s notice said some links in email and documents might fail to open, and that viewing or releasing items in quarantine could fail. A link that failed during the outage is not evidence the link is bad. Have the person try it again, and recheck anything held in quarantine.

4. Changes people made in a panic. When email goes down, people reset passwords, reinstall Outlook, remove and re-add accounts, or turn off settings. A service-side outage is not fixed by any of that, and some of it causes new problems: a changed password that other devices do not know, or an account that now needs setup again. Ask your team what they changed, and put it back where it makes sense. Microsoft’s own advice for its Power Apps and Field Service mobile apps during the incident was to stay signed in instead of signing out.

5. A gap in security monitoring. Defender XDR was among the affected services, so alerts and dashboards may have been delayed or missing for some organizations. Ask whoever watches your security tools to look back over the outage window for unusual sign-ins and new mailbox forwarding rules.

Expect phishing that mentions the outage

Scammers do not need to cause an outage. They only need to show up while people are confused. Within a day, the Dutch pharmacists’ organization KNMP warned that phishing emails posing as Microsoft and offering to restore or update software were circulating. Two Australian banks warned their customers about scammers offering to fix the outage.

Messages we would expect to see:

• An email or text saying you must “re-verify” or sign in again to restore your mailbox.
• A call or message from “IT support” or “Microsoft support” offering to fix the outage and asking for remote access or a verification code.
• A “service credit” or “compensation” notice with a link.

The rules are simple. Microsoft does not send unsolicited emails or make unsolicited calls to fix an outage. Get outage news only from the Microsoft 365 admin center, the public status page at status.cloud.microsoft, or the verified Microsoft 365 Status account on X. If someone entered a password on a page they reached from an outage message, change that password, review the account’s sign-in activity and forwarding rules, and call your IT provider. Our earlier post on how to tell if an email is real covers how to report suspicious messages.

Get ready for the next outage

Reuters noted it was the second major Microsoft 365 disruption this year. Another one is a matter of when. Most of the work is deciding in advance how the business keeps going when email is down for a day.

1. Keep an out-of-band contact list. Print or store somewhere other than Microsoft 365 the mobile numbers and personal or alternate email addresses of your staff, key clients, vendors and your IT provider. If your list lives only in Outlook contacts, it went down with Outlook.

2. Choose a backup way to reach clients. Decide who calls whom, and what you say. A short phone script and a voicemail greeting update cover most of what a day without email costs. Municipalities and medical offices should also know which public notices or patient messages cannot wait.

3. Know where to read outage news. Admins should be able to open the Microsoft 365 admin center service health page, and know that Microsoft’s public status page, status.cloud.microsoft, shows incidents when the admin center is not reachable. Microsoft’s own Q&A pointed admins without access to it.

4. Back up Microsoft 365 data separately. A backup does not make an outage shorter. What it does is keep a second, independent copy of your mail, files and Teams data, so a deletion, a ransomware incident or a bad change does not leave Microsoft’s retention settings as your only recovery option. Test a restore at least once a year, as we describe in our backup restore testing guide.

5. Decide who you call. Write down who decides it is an outage and not a local problem, who tells staff, and who calls your IT provider. During this incident, many people spent hours troubleshooting their own computers.

6. Tell your staff the phishing rules in advance. A five-minute reminder before an outage, “we will tell you what is going on by phone or text, never by a link,” is worth more than one sent after the first fake notice arrives.

How we help

When Microsoft 365 is the problem, the first job is working out whether it is Microsoft, your network, or one account. That is day-to-day work for our help desk, which includes 24/7 emergency response for outages under agreement. Our Microsoft 365 and cloud service covers the tenant itself: settings, retention, mailbox rules and sign-in review, plus the checks after an event like this one.

Email security filters phishing, including outage-themed messages, before they reach a user, and our backup and disaster recovery service includes Microsoft 365 backup and restore testing. If an account is compromised, incident response covers revoking sessions and checking what was touched.

For municipalities, law firms and healthcare practices, a day without email can mean missed notices, deadlines and patient messages. If you want help building an outage plan or checking your tenant after this event, contact us.

Sources

• Microsoft 365 Status on X: EX1550543 post
• Microsoft public service health status
• Microsoft Q&A: incident MO1550821 and affected services
• University of Bath status page, quoting Microsoft’s incident updates for November 13
• ThousandEyes: Microsoft 365 Outage Analysis, November 12, 2026
• Associated Press: Microsoft reports progress as it works to recover email and other services
• Reuters via StreetInsider: Microsoft outage spills into Asia-Pacific business hours
• Euronews: Microsoft outage explained
• Computer Weekly: Global Microsoft outage leaves users open to phishing attacks
• DutchNews.nl: phishing warning from KNMP
• University of Queensland status page, quoting Microsoft’s incident updates
• Mint (Bloomberg): Microsoft races to fix Outlook
• Moneycontrol: Microsoft extends email timeout to 48 hours
• McAfee: Microsoft outage and scams to watch
• IMB Bank scam alert and ING scam alert
• DMARCguard: Microsoft outage EX1550543, email deferred, not rejected