Microsoft 365 back online after 18-hour global outage

Microsoft 365 is recovering after an 18-hour global outage — one of the vendor's worst in recent memory — with Outlook accessible again and email backlogs processing under an extended 48-hour delivery timeout.

The breakthrough came at about 10pm AEDT on Friday, when Microsoft reported success restoring "portions" of infrastructure in the Asia Pacific region. In a status update just past 11pm AEDT, the vendor said it was "seeing encouraging recovery progress, with service availability and email delivery performance improving across a growing portion of affected Microsoft 365 infrastructure".

Recovery then spread. Europe showed encouraging progress, Japan remained "comparatively more stable", and North America — just beginning its Friday when the fix landed — was improving, though Microsoft warned "some users may still experience intermittent issues as recovery actions continue".

What does the outage change for IT teams?

Plenty, if your day depended on Redmond. Organisations worldwide had a largely unproductive day. Internet providers and government departments warned customers they couldn't receive or action requests while Microsoft services stayed dark — a full business day of stalled workflows for anyone tied to Exchange Online.

There's a delivery wrinkle to watch, too. Microsoft has extended its typical email timeout window to 48 hours "to help protect delayed messages as delivery catches up". Testing by iTnews found scheduled emails sent during the outage arrived hours out of order. "Reducing email queues and backlogs remains a priority," the vendor said.

Why did Asia Pacific recover first?

The prioritisation may not have been accidental. Australia's federal government activated a "digital resilience" agreement with Microsoft — one signed by Home Affairs Minister Tony Burke.

"The relationship that we have with Microsoft is an important one," Burke said in televised remarks. "When it came to the formal cyber agreements which I've signed on behalf of Australia, the first of those was with Microsoft. That agreement has, in fact, been activated today to make sure that we get appropriate prioritisation of Australian interests in this."

For CIOs, that detail matters: contract clauses with hyperscalers can translate into recovery queue position during a global incident.

What caused it?

Not an attack, Microsoft insists. "This was a technical issue not related to cyber or AI [or] agents," the company said on Saturday morning.

The root cause points to internal change management. "The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change," Microsoft said — a familiar pattern for anyone who has watched a routine capacity push cascade into a regional failure.

Microsoft says there is no evidence of malicious activity associated with the incident. It has promised a full post-incident report "with root cause and defence-in-depth actions after mitigation is complete".

In Australia, the government was being briefed by National Cyber Security Coordinator Lieutenant General Michelle McGuinness and Microsoft A/NZ president Jane Livesey.

Eighteen hours, one network change, and a continent's email in the queue — the post-incident report will be required reading.