--- title: Microsoft Traces the Global Microsoft 365 Outage to a Fault From an Earlier Network Upgrade description: Microsoft says a fault from an earlier network capacity upgrade caused the Nov. 12-13 outage. The timeline, the impact and what IT teams should check now. author: Darie Nani (Editor-in-Chief) date: 2026-11-14T18:52:00.123Z updated: 2026-11-14T18:52:00.142Z canonical: https://www.sovereignmagazine.com/article/what-caused-the-microsoft-365-outage image: https://cdn.nanimediahouse.com/microsoft-datacenter-server-aisle-582234.webp categories: Science & Tech content_type: News region: Global publication: Sovereign Magazine schema_type: Article about: - type: Organization name: Microsoft description: Microsoft is an American technology company founded in 1975 and headquartered in Redmond, Washington. It is known for Windows, Microsoft 365, Azure and its research into workplace productivity. url: https://www.microsoft.com industry: Technology sameAs: - https://en.wikipedia.org/wiki/Microsoft --- Microsoft says the outage that took Exchange Online and Outlook email down around the world on Thursday, Nov. 12, began with "an issue during an earlier network capacity upgrade that surfaced following a recent network change." Servers failed automated health checks and dropped out of service, and the servers still running could not carry the load. "This was a technical issue not related to cyber or AI / agents," Microsoft said on Friday, Nov. 13, ruling out a cyberattack. The company said it had addressed the underlying issue and was restoring service to the remaining customers and regions. Microsoft says the incident began at 11:17 a.m. ET (16:17 UTC) on Thursday, with mailbox failures in the Americas. Services began to recover just before midday GMT on Friday, about 18 hours after reports of problems surged on Thursday evening UK time, the Guardian reported. Microsoft later said it was "seeing broad recovery and stability across our services." Downdetector logged about 130,000 user reports from 74 countries and territories, and at its height recorded 19,650 reports a minute across Outlook, Microsoft 365, OneDrive, Copilot and Teams, against fewer than 15 on a typical Thursday. Microsoft says more than 430 million people use Microsoft 365 apps. Teams, SharePoint, Copilot, Defender XDR, Outlook.com, OneDrive, OneNote, Planner, To Do, Intune and Purview were all affected, along with Windows 365 Cloud PCs using Purview Customer Key, and some Google Workspace users who read their mail in Outlook clients reported problems too. Core Teams messaging and meetings, and direct access to SharePoint files, largely kept working, according to Infotech, an Arlington, Va., research and advisory firm formerly known as Info-Tech Research Group. ## Restored Servers Kept Failing Under Live Traffic Through Thursday Night Microsoft first blamed elevated infrastructure load across several regions. It paused all deployments, redistributed connection traffic and restarted affected servers, then said on X on Thursday: "We determined the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure." Engineers found that a process on the affected servers that sets up secure connections was becoming overwhelmed, so the servers stopped handling requests. Each time engineers brought servers back into rotation, live traffic overwhelmed them again. "If you lose part of that pool, then all of the users are trying to access the remaining servers, and that overloads them. And then they go down. And so you end up with a cascading problem," said Mark Gregory, an associate professor at RMIT University. On Thursday night Microsoft added capacity, began rolling back a recent network configuration change that coincided with the start of the disruption, froze non-essential changes and throttled some incoming traffic. By Friday morning it had extended its email timeout window to 48 hours so delayed messages would not be lost, and those messages began to arrive. "Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration," Microsoft said. ## Police, Courts, Airlines and Schools in Britain, the US and Asia Lost Email Services In Britain, several police forces asked people to phone rather than report crimes online, some schools took absence reports by phone, healthcare systems were disrupted and National Rail warned that emailed tickets might not be accessible. A judge in Manchester sent jurors home because of delays. In Colorado, the Arapahoe County sheriff's office could not process bond payments by email and asked people to post bond in person, and the US House chief administrative officer sent a campus-wide alert. In Asia, IndiGo and Akasa Air said their email support was affected, Japan's Sagawa Express could not take some online reservations, drugmaker Taisho handled orders by phone and the Philippine Supreme Court said email responses and other transactions might be delayed. OpenAI and Anthropic reported problems with their Microsoft 365 connectors, and Microsoft shares dipped about 1.1% at Friday's open. Australia's Home Affairs Minister Tony Burke said Microsoft had likened the disruption to the 2024 CrowdStrike outage. ## IT Teams Should Check Workflows and Queued Mail Before Declaring Recovery A Microsoft service-health notification does not mean every business process has recovered, Infotech says in [a note for CIOs](https://www.infotech.com/research/microsoft-365-outage-immediate-actions-for-cios) published Friday. It tells IT teams to check that business-critical workflows, integrations and queued transactions have resumed correctly, and to document the continuity gaps they found. In the cases Infotech reviewed, contingency plans held where a manual route existed and stalled where email was the only channel. For admins whose Exchange Online is down or still recovering, the tech site Petri advises against rebuilding Outlook profiles or changing local DNS records or tenant routing rules, and suggests watching Health > Service health in the Microsoft 365 admin center, then auditing queued mail flow, delayed Defender alerts and pending Intune policy syncs. "CIOs need a clear basis for telling the business it can return to normal operations," said Kate Wood, AVP of Research Development at Infotech. "That means knowing which critical processes have been tested, where security coverage still needs checking, and which teams must continue using workarounds." Over the longer term, Infotech says companies should test their continuity procedures against prolonged outages that affect several cloud services at once, and find where reliance on a single cloud environment creates [shared points of failure](https://www.sovereignmagazine.com/article/revolut-down-outage-google-cloud). ## Service Credits for the Outage Are Not Automatic, Infotech Says Service credits are not issued automatically, and [SLA claims](https://www.sovereignmagazine.com/article/mantas-is-turning-cloud-outages-into-an-insurable-financial-risk) generally require evidence of the impact on a specific customer, not just confirmation that a widespread outage happened, according to Infotech. It advises companies to preserve outage evidence such as service-health advisories, document the disruption they actually suffered, and have vendor-management and legal teams review their agreements for credit eligibility, evidence requirements and submission deadlines. The advisories to keep are EX1550543 for Exchange Online and MO1550821 for the wider Microsoft 365 incident. ## Attackers Have Posed as Microsoft Support During Past Outages During previous large outages, attackers have commonly impersonated Microsoft support staff and promised to restore access, Infotech says. It advises warning employees about phishing emails, credential-harvesting attempts and deepfake voice and video calls, confirming that security monitoring, logging and policy enforcement have recovered, and reviewing gaps in coverage during the outage. ## Microsoft's Preliminary Post-Incident Review Is Due Within 48 Hours of Resolution For incidents with broad impact across a large number of organizations, [Microsoft's service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/service-health-and-continuity) says a preliminary post-incident review is delivered through Service health within 48 hours of the incident's resolution, followed by a final review within five business days, on the same page whose advisories Infotech tells companies to preserve for a credit claim. Microsoft's status page said the report would cover root cause and defense-in-depth actions. "We are deeply sorry for the disruption this incident has caused our customers and partners," Microsoft said. "We will provide a full post-incident report once our review is complete." Charles Lamanna, Microsoft's executive vice president for Copilot, Agents and Platform, told BleepingComputer: "Our teams are reviewing what happened and how we can prevent similar issues going forward." ## FAQ **Q: Was the earlier Teams outage on Thursday part of this?** A separate Teams incident, tracked as TM1550488, ran from 9:45 to 10:53 a.m. ET in North and South America before the main outage. Microsoft attributed it to resource contention within its infrastructure and has not said whether the two incidents are related. **Q: Is there an issue with Microsoft 365 right now?** In its latest update on Friday, Nov. 13, Microsoft reported broad recovery and stability and said it was still restoring service to the remaining customers and regions, without giving a time for full restoration. **Q: Did the Microsoft outage get fixed?** Microsoft says it has addressed the underlying issue. Engineers also patched an upstream authentication and routing component to stabilize servers, according to Petri.