Microsoft 365 outage exposes recovery gaps after more than 10 hours

Daniel Okafor

A global Microsoft 365 outage lasted more than 10 hours on November 12, 2026, and into November 13, affecting email, collaboration and security systems across multiple regions. That is more than 40% of a full day. Microsoft’s incident updates named nine affected products and services:

• Outlook and Exchange Online mailboxes
• Teams and SharePoint Online
• Microsoft 365 Copilot and Microsoft Defender XDR
• Planner, To Do and Intune

What did Microsoft report?

Microsoft 365 Status said: “We're investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas.”

The company listed that Exchange incident as EX1550543 in the Microsoft 365 admin centre, while a broader incident under MO1550821 covered seven additional collaboration, productivity and security services.

The initial alert focused on the Americas and access through multiple connection methods. Microsoft later said connectivity problems could affect any region. Users in Asia reported connectivity issues on November 13.

Microsoft’s updates did not disclose affected-user totals, a country count, an unavailable-server count, repair cost or customer credits. The updates also gave no recovery deadline or quantified revenue loss. For enterprise buyers, product breadth is documented; customer impact and financial exposure are not.

What caused the outage?

Microsoft said a number of servers became unexpectedly unavailable, adding load to the remaining infrastructure even though traffic did not increase across the platform.

Affected servers failed automated health checks, Microsoft said. The component responsible for processing those checks could be contributing to the failures. Microsoft stopped short of naming the component or confirming a final root cause.

Microsoft also said it was not aware of any malicious activity causing the incident. That wording records the company’s knowledge at that point; it does not amount to a completed forensic exclusion.

Microsoft began testing configuration changes and restarting affected servers. It also prepared automated recovery systems to detect and restart unresponsive servers. It promised a post-incident report covering root cause and corrective measures after it resolved the outage.

How did Microsoft restore service?

Microsoft paused deployments, redistributed traffic across its global infrastructure and redirected connections to alternative routes, but some servers became unresponsive again after receiving traffic.

In a later update, Microsoft said: “a core process on affected servers was becoming overwhelmed.” That process reduced service capacity. The company tested a configuration change on a subset of servers. It restarted affected components before reintroducing traffic to test stability.

Microsoft also imposed temporary traffic restrictions in specific locations while monitoring server stability. Partial recovery followed in some regions, but the first recovery measures did not deliver sustained improvements. Several workstreams continued to restore infrastructure capacity and improve stability.

What remains unproven?

Microsoft’s disclosure leaves three material questions unresolved: how many servers failed, which component mishandled health checks and when every affected region returned to normal service.

The 10-hour duration is firm. The user, server and country counts are not. Microsoft’s updates also omitted repair cost, lost revenue, customer credits and affected software versions. A promised report may narrow the causal account, but none was available in the cited updates. Partial recovery does not establish complete service restoration.

Two linked context items addressed separate resilience concerns. The first concerned Microsoft’s agreement not to train AI on US student data; it noted that India has no comparable legal bar until May 2027. The second covered a Google Cloud outage after a Delhi facility fire and raised questions about India’s digital resilience. Neither item supplied evidence about the server failures, affected-user scale or financial consequences of this incident.