Microsoft attributes the Microsoft 365 outage to its own servers, not to a cyberattack: several Exchange Online machines became unavailable, and redirected traffic overloaded some of the remaining infrastructure. More than 18 hours after the interruption began, the company was still reporting below-normal capacity and uneven service recovery.
Servers failed and recovery was uneven
Microsoft's first alert came on November 12 at 8:17 a.m. Pacific time: Exchange Online was experiencing problems. At 10:27 a.m., the company reported issues in several regions and warned that Teams, SharePoint, and Copilot could also be affected. At around 10:58 a.m., it began diverting traffic away from the affected infrastructure and restarting servers to reduce the load.
At 11:30 a.m., Microsoft explained that some servers had unexpectedly become unavailable. Traffic sent to other machines put additional pressure on the systems that were still operational. Computer Hoy described a core Exchange Online process that came under heavy load and stopped responding, triggering a chain reaction as requests were redirected to other servers. IT Pro separately reported that several unavailable servers were overloading the remaining infrastructure.
Microsoft had not identified the initial trigger. Computer Hoy said the company was investigating whether it could be related to a recent update or network configuration change. IT Pro noted that the root cause would not be disclosed until the incident had been mitigated and services had returned to normal.
Windows Latest's timeline shows a series of tests and measures, but also setbacks. Microsoft began testing a configuration change at 11:43 a.m. and, at 12:56 p.m., applied a health check to recover some servers. At 2:00 p.m., it acknowledged that it was still experiencing difficulties despite deploying fixes; at 2:57 p.m., it observed limited recovery in some regions.
An hour later, the company warned that restored servers could stop responding again. At 11:25 p.m., it reported greater stability after applying a patch to its infrastructure. The latest update cited by Windows Latest, published on November 13 at 1:03 a.m., described gradual stabilization, although capacity had not yet returned to normal levels.
No evidence of an attack, but services are still affected
Charles Lamanna, Microsoft's executive vice president of Copilot, agents, and platform, ruled out signs of an intrusion. “For now, I can confirm there is no indication that this is the result of malicious or cyber activity,” he said in a post on X, according to Computer Hoy. He also expressed the company's regret over the disruptions and said it was working to resolve them.
We regret that today’s outages caused disruptions for our customers, and we are working to address the issue.
— Charles Lamanna, Microsoft's executive vice president of Copilot, agents, and platform
The Microsoft update reproduced by PC Gamer specified that there was no evidence of malicious activity linked to the incident and that the company would publish a subsequent report on the root cause and defense-in-depth measures once mitigation was complete. IT Pro added that the increased load was not attributed to excessive traffic, a scenario that would have pointed to a distributed denial-of-service attack.
The list of affected products was extensive. PC Gamer listed the Microsoft 365 admin center, apps, education features, Copilot, Defender for Office 365, Defender XDR, Fabric, Graph, Intune, Planner, Power Apps, Purview, some Teams components, To Do, SharePoint Online, Universal Print, and Windows 365. IT Pro also included Outlook, Calendar, and Exchange Online; it said Azure and Power Platform Admin Center were not affected.
The impact was not the same for all users. IT Pro noted that both personal and business accounts experienced issues, but that the impact on Business and Enterprise was greater, according to Microsoft's status page. Some Windows 365 customers who had configured their environment with Microsoft Purview were also unable to connect to their virtual PCs.
The outage also affected external integrations. OpenAI reported problems with new ChatGPT connections to Microsoft 365 and with its tools; Anthropic posted a similar notice for Claude. Computer Hoy reported sign-in and connection failures with Microsoft 365, although it noted that the chatbots could continue to work normally.
Emails held and traffic under control
In its latest update cited by PC Gamer, Microsoft said global telemetry and customer reports showed gradual improvements across several workloads, but that conditions continued to vary and capacity had not returned to its baseline. Network and traffic management measures remained in place. To protect email during recovery, the company extended the waiting window to 48 hours and prioritized processing queued and accumulated messages.
Recovery also involved technical complications. In another notice reproduced by The Guardian, Microsoft said it was increasing capacity using virtual machines and looking for unhealthy machines to force synchronization of a network change. Some machines were getting stuck and not receiving changes as expected; the company was continuing to assess which adjustments to make.
Microsoft asked enterprise system administrators not to make configuration changes or carry out mass restarts on their internal networks while mitigation work continued, according to Computer Hoy. The recommendation came amid a process in which the company itself was modifying traffic and progressively restoring servers.
Governments, hospitals, and businesses feel the impact
Computer Hoy put the outage's reach at more than 70 countries across Europe, Asia, the Americas, and Oceania. In the UK, parts of the government had trouble sending and receiving email, and the National Health Service (NHS) could not access online patient consultations, according to PC Gamer. The Guardian reported widespread and serious disruption to the British healthcare system: NHS England staff resorted to paper records.
The impact extended to public agencies, schools, and transport. The Guardian reported problems at the school inspectorate Ofsted and universities, notices from schools asking people to call instead of sending emails, difficulties for police receiving online reports, and contingency plans by the British government. Train passengers could have trouble accessing tickets sent by email.
In Australia, Minister for Home Affairs and Cybersecurity Tony Burke said Microsoft did not believe this was a cyber incident, according to Computer Hoy and The Guardian. Several federal agencies reported communication difficulties. The Department of Foreign Affairs and Trade asked that urgent sanctions inquiries be directed by phone to the Australian Sanctions Office; the Department of Agriculture, Fisheries and Forestry warned that its clients might be unable to receive or send messages to its systems.
The impact also reached companies outside the Microsoft ecosystem. The Guardian reported problems with email support services at Indian airlines IndiGo and Akasa Air. In Taiwan, Downdetector logged more than a hundred outage reports between 3:00 a.m. and 9:00 a.m. on Friday; workers reported failures in Outlook and in Teams calendar and scheduling.
Some financial operations had to adapt. According to Bloomberg, as cited by The Guardian, portfolio managers could not review emails and had difficulty accessing trading platforms that required email authentication. Confirming transactions was also difficult, so some traders turned to the phone and other methods traditionally used before email.
The Guardian also reported problems at Taiwanese securities firms, life insurers, and investment companies. One company even canceled a previously scheduled bond repurchase transaction, according to a source familiar with the case who did not want to identify the company.
Microsoft's report is still pending
The company promised to publish a subsequent report on the cause and the measures taken to strengthen defenses, but only after completing mitigation. Until then, the exact origin of the failure remained under investigation, and recovery depended on stabilizing servers, increasing capacity, and processing accumulated messages.
The outage also reignited questions about dependence on a single provider. The Guardian reported a call from the Australian Computer Society for the government to review which critical systems depend on a single provider and where backup alternatives are needed. Its CEO, Prins Ralston, argued that service credits would not compensate small businesses for the losses incurred during a morning of operations.
For now, Microsoft had not declared the incident resolved: its update noted partial improvements, below-normal capacity, and urgent work continuing until mitigation was complete. The extended waiting window is intended to prevent held emails from bouncing or being lost while queues are processed.
Sources: Windows Latest, PC Gamer, Computer Hoy, the Guardian, IT Pro
