Microsoft 365 outage passes 13 hours as Exchange Online fixes stall

Microsoft has been unable to fully restore Microsoft 365 more than 13 hours after an Exchange Online failure began at 16:17 UTC on Nov. 12 — and it told customers overnight that its latest fixes were "not taking as expected."

The failure took down Outlook first, then spread to Teams, SharePoint, Copilot and parts of Microsoft's security tooling. Downdetector logged more than 130,000 Outlook problem reports at the peak — a volume comparable to the largest Microsoft outages of recent years.

The incident shows how a single server-side fault inside one Microsoft service can cascade across mail, meetings, AI assistants and security controls at once.

What failed, and when?

The first symptoms were mailbox access failures. "Users may be unable to access their mailbox using Outlook on the web, Outlook desktop (MAPI), Exchange ActiveSync (EAS), or REST-based connections, and email delivery may be delayed," Microsoft wrote on its service health dashboard.

Users in the Americas initially could not reach their mailboxes through Outlook on the web, desktop Outlook, mobile clients or the REST API. Within two hours, Microsoft said users in any region could be affected. It then opened a wider incident covering Teams, SharePoint Online, Copilot, Defender XDR, Intune, Power BI and several Purview services.

In short: a regional mail problem became a global, multi-service event in under two hours.

What caused the outage?

Microsoft initially investigated elevated infrastructure load and whether a recent change had contributed. It later ruled out a traffic surge as the cause.

"We've determined that the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure," the company said in its Exchange Online incident update.

A subsequent update identified the mechanism more precisely. "Our investigation has found that a process on the affected servers responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests," Microsoft said.

The company's response combined four tracks:

• Preparing a configuration change to address the overwhelmed connection process, tested on a subset of servers before wider deployment.
• Reverting a recent network configuration change that correlated with the start of the disruption.
• Restricting traffic and gradually reintroducing connections while checking server stability under load.
• Restarting affected infrastructure and monitoring whether servers stay up.

Recovery has been nonlinear. Microsoft reported that some servers became unresponsive again after traffic was restored, requiring further analysis and mitigation.

How bad was the collateral damage?

Impact varied by service, depending largely on whether each feature relied on Exchange Online. Microsoft's incident notification detailed the breakdown:

• Teams: core messaging and online meetings remained largely functional, but calendar access and meeting scheduling could fail.
• SharePoint Online: direct file access stayed functional; Exchange-dependent features could be affected.
• Copilot: users might be unable to load Copilot Chat or receive responses, and Copilot experiences might be unable to reach work data such as email, calendars and files.
• Defender for Office 365: Safe Links might be unable to verify URLs clicked in Outlook and Teams; some Defender XDR portal pages were also affected.
• Intune and Purview: selected device enrolment and compliance scenarios, plus Purview data loss prevention, automatic labelling and communication compliance.

For security teams, the distinction matters: Safe Links being unable to verify URLs is a specific impairment, not a total loss of Defender for Office 365 capabilities — but it does mean phishing protections degrade during the window.

What does this say about concentration risk?

The incident has renewed attention on the operational dependencies created when organisations consolidate email, collaboration and security functions within a single cloud ecosystem.

"Enterprises have priced Microsoft 365 as a licence and never as a single point of failure," said Sanchit Vir Gogia, chief analyst at Greyhound Research.

Gogia argued that when mail, meetings and security functions such as Safe Links depend on the same service estate, one infrastructure disruption can hit several business functions simultaneously.

"The answer is not a second suite. It is a rehearsed fallback for the few things that cannot stop: an out-of-band channel for incident command, mail continuity for critical roles, and a written decision on whether each security control fails open or closed," he said.

Gogia also said enterprise customers will want a detailed account of the incident, including a timeline showing when Microsoft identified the different causes and how it validated the recovery measures. Microsoft has continued to publish updates through its Microsoft 365 service status portal but had not yet published a final post-incident root-cause report.

Until that report lands, CIOs are left pricing a risk many contracts never covered.