Microsoft 365 limps back: Exchange Online still degraded after 24-hour outage

Twenty-four hours after Microsoft 365 fell over worldwide, Microsoft confirmed broad recovery as of 6:00 p.m. UTC (1 p.m. ET) on Friday, Nov. 13 — with one stubborn exception. Services that interact with Exchange Online remain degraded, and mail flow has no ETA for full normalization.

The cause, Microsoft said, was not a cyberattack and not AI. It was a technical issue "introduced by an earlier network capacity upgrade that surfaced following a recent network change." In plain terms: an upgrade went in, a later change exposed the flaw, and global business email took the hit.

"Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration," the company wrote on its service health dashboard. Slow, by design. Whether customers find that comforting is another matter.

What does the outage actually affect?

The blast radius extends well beyond the inbox. Microsoft lists a casualty roll that reads like a product catalogue:

• Email itself — delayed or inaccessible for some tenants
• Microsoft 365 Admin Center — some pages fail to load
• Microsoft 365 Apps Admin Center — Cloud Update, Cloud Policy and Inventory all affected
• Copilot 365 Chat — users may not load it or receive responses from the web version or the app
• Microsoft Intune — device enrollment, device check-in and device compliance policies "may have been intermittently impacted"
• Microsoft Purview and Microsoft Teams — "a long list of functions" impacted
• Windows 365 Cloud PCs — tenants configured with Microsoft Purview Customer Key may have users unable to connect
• Word and Excel — recently used files may not display

Components that don't touch Exchange Online kept working. That distinction, invisible to most end users, decided who had a bad Friday and who had a catastrophic one.

What happens next?

An update at 8:00 p.m. UTC (3 p.m. ET) spelled out the awkward mechanics of recovery. "As infrastructure stabilizes, we're still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes."

So sign-in may work while the mail backlog drains. Admins should brace for a lag between "back up" and "actually working" — and for users who notice the difference immediately.

Microsoft has promised a full post-incident report once its review is complete. "We are deeply sorry for the disruption this incident has caused you and your business," the status update read. "We know the trust you place in our services and take that responsibility extremely seriously."

What does this change for security teams?

Recovery windows are a gift to attackers. Matt Hull, vice president of cyber intelligence and response at NCC Group, warned that "cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create."

His advice: remind colleagues to be vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay.

Social engineering tops the risk list. Hull expects attempts to convince people to reset passwords, approve multi-factor authentication requests or grant remote access to their devices, with attackers impersonating Microsoft or internal IT teams. An outage that breaks legitimate IT communications makes that impersonation considerably easier.

For CIOs, the practical takeaway is blunt. A capacity upgrade took down a dependency that spans email, compliance, endpoint management and virtual desktops. The post-incident report is worth reading when it lands — and until then, the phishers know your users are distracted.