[{"data":1,"prerenderedAt":272},["ShallowReactive",2],{"\u002Fblog\u002Fmicrosoft-365-outage-november-2026":3},{"id":4,"title":5,"author":6,"body":7,"date":261,"description":262,"extension":263,"meta":264,"navigation":265,"path":266,"readingTime":267,"seo":268,"stem":269,"tag":270,"updated":261,"__hash__":271},"blog\u002Fblog\u002Fmicrosoft-365-outage-november-2026.md","The Microsoft 365 outage of 12-13 November","Madhumita S",{"type":8,"value":9,"toc":250},"minimark",[10,14,17,22,25,28,31,34,51,55,58,158,161,165,168,171,174,178,187,190,193,197,200,203,207,235,239,242],[11,12,13],"p",{},"Microsoft spent 12 and 13 November 2026 fighting a Microsoft 365 outage that stopped people opening their mailboxes, broke the calendar side of Teams and left Copilot for work unable to load. The Exchange Online incident, EX1550543, began around 16:17 UTC on Thursday, according to Microsoft's incident record; the first public post followed at 17:54, and the wider Microsoft 365 incident, MO1550821, opened at 18:26. By Friday morning Microsoft was reporting incremental improvement but not recovery: capacity was still below baseline and the incident was still listed as service degradation. Microsoft says it has no evidence of malicious activity. It has not published a root cause or a fix time.",[11,15,16],{},"Downdetector counted about 130,000 user reports of Outlook problems in the US by early Thursday afternoon, plus reports from 74 countries and territories. Those are user-submitted reports, not confirmed customers, and they say more about how many people noticed than how many were affected. What matters for a business is smaller and more concrete. For most of Thursday night and Friday morning, mail to and from Microsoft 365 tenants was delayed, some of it for hours, and the services that quietly depend on Exchange Online failed with it. This account reflects Microsoft's updates up to 10:45 UTC on 13 November; the next was due at 11:00.",[18,19,21],"h2",{"id":20},"what-broke-and-what-kept-working","What broke, and what kept working",[11,23,24],{},"By 09:57 UTC Microsoft's status page listed 20 services, from Exchange Online and Outlook to Power BI, Intune and Windows 365. Microsoft's framing is that the affected features are the ones that interact with Exchange Online and email services, while elements that do not depend on Exchange stay up. That explains most of the list, not all of it: Power BI label exports and Windows 365 Cloud PCs are hard to trace back to mail. Read the list as the blast radius rather than a dependency diagram.",[11,26,27],{},"Outlook on the web, Outlook desktop over MAPI, Exchange ActiveSync and REST connections failed or timed out for many users. Microsoft warned that email delivery might be delayed. Microsoft Graph requests for mail, calendar and contacts timed out, which took out integrations that never mention Exchange: CRM syncs, ticketing notifications, e-signature requests, anything that reads a mailbox. Copilot could not load chats or reach work data. Clicks on links rewritten by Defender for Office 365 Safe Links failed to open, because the service could not process the rewritten URLs. Some admin center pages would not load.",[11,29,30],{},"In Teams, core messaging and meetings held. The failures were the features that lean on Exchange or Graph: calendar scheduling, invites and meeting edits; creating Live or Virtual events; adding or syncing contacts; creating or deleting private or shared channels; and Copilot answers that need mail, calendar or files. Files stored directly in SharePoint stayed reachable, though external sharing had problems.",[11,32,33],{},"Read that list once and you can see why the outage felt wider than a mail problem. Email is the notification bus for most small companies. When it stops, invoices, password resets from other vendors, support tickets and calendar invites stop with it, even though every one of those systems was healthy.",[11,35,36,37,44,45,50],{},"Ireland's Health Service Executive said in a statement that email was not being transmitted and that video conferencing was intermittent. ",[38,39,43],"a",{"href":40,"rel":41},"https:\u002F\u002Fwww.rte.ie\u002Fnews\u002Fbusiness\u002F2026\u002F1113\u002F1599093-euronext-asks-listed-firms-to-phone-after-outlook-outage\u002F",[42],"nofollow","Euronext asked listed companies to contact it by phone",". ",[38,46,49],{"href":47,"rel":48},"https:\u002F\u002Fzeenews.india.com\u002Findia\u002Farticle-microsoft-outage-hits-airlines-indigo-akasa-air-email-support-down-air-india-ops-unaffected-3162081",[42],"IndiGo and Akasa Air said their email support was down, while Air India said its flight operations were unaffected",". OpenAI said its Microsoft connectors were failing, so new connections and tools in ChatGPT did not work.",[18,52,54],{"id":53},"the-timeline-in-utc","The timeline, in UTC",[11,56,57],{},"Times are UTC. The 16:17 and 18:26 entries are the recorded starts of the two incidents; the rest mark when Microsoft published each update, not necessarily when the work happened.",[59,60,61,74],"table",{},[62,63,64],"thead",{},[65,66,67,71],"tr",{},[68,69,70],"th",{},"Time",[68,72,73],{},"What Microsoft reported",[75,76,77,86,94,102,110,118,126,134,142,150],"tbody",{},[65,78,79,83],{},[80,81,82],"td",{},"12 Nov, ~16:17",[80,84,85],{},"Incident EX1550543 begins, according to the incident record.",[65,87,88,91],{},[80,89,90],{},"17:54",[80,92,93],{},"First public post: investigating mailbox access problems \"in the Americas\".",[65,95,96,99],{},[80,97,98],{},"18:26",[80,100,101],{},"Opens MO1550821 for the wider Microsoft 365 impact.",[65,103,104,107],{},[80,105,106],{},"19:12",[80,108,109],{},"Pauses deployments, shifts traffic and begins restarting servers.",[65,111,112,115],{},[80,113,114],{},"19:31",[80,116,117],{},"Says the load comes from servers being unexpectedly unavailable, not from more traffic.",[65,119,120,123],{},[80,121,122],{},"13 Nov, 01:12",[80,124,125],{},"Says the connection process is overwhelmed and begins reverting a network change that correlates with the start of impact.",[65,127,128,131],{},[80,129,130],{},"04:56",[80,132,133],{},"Reports a surge in outbound calls from routing services to backend servers; partial recovery is not holding.",[65,135,136,139],{},[80,137,138],{},"07:24",[80,140,141],{},"Reports positive results after an upstream authentication\u002Frouting configuration patch.",[65,143,144,147],{},[80,145,146],{},"08:09",[80,148,149],{},"Expands that patch as server stability improves.",[65,151,152,155],{},[80,153,154],{},"09:57",[80,156,157],{},"Incremental improvement, capacity still below baseline; email timeout extended to 48 hours; no evidence of malicious activity.",[11,159,160],{},"Two details stand out. Microsoft gave times for its next update rather than times for a fix, which is the honest way to run an incident with an unknown cause. And servers that came back did not stay back: at 01:48 restarts looked positive, and at 02:58 those changes were not taking as expected.",[18,162,164],{"id":163},"what-microsoft-says-went-wrong","What Microsoft says went wrong",[11,166,167],{},"The updates describe a sequence, not a trigger. Servers became unexpectedly unavailable, which put more load on the ones still serving traffic. A process responsible for establishing secure connections became overwhelmed and the servers stopped processing requests. Microsoft began reverting a recent network configuration change that correlated with the start of impact. Recovery added traffic of its own: routing services calling backend servers that could not route the responses. Then an upstream authentication\u002Frouting configuration patch, applied to part of the infrastructure and expanded through the morning, was followed by increased server capacity stability.",[11,169,170],{},"The network change Microsoft was undoing is the closest thing to a named suspect, but the updates do not establish that it caused the failure. At 09:57 the company was still working through the cause, with capacity below baseline, and it has promised a Post-Incident Report with the root cause and the repairs it will make. The patch and the 48-hour mail window are mitigation, not diagnosis.",[11,172,173],{},"Microsoft has said it has no evidence of malicious activity and is not aware of any. That is narrower than ruling an attack out, and the wording matters while the investigation is open. Until the report exists, anyone who tells you they know what happened is guessing.",[18,175,177],{"id":176},"your-mail-may-be-delayed-not-lost","Your mail may be delayed, not lost",[11,179,180,181,186],{},"Mail does not necessarily vanish when a mailbox provider goes down. Under SMTP, the standard every mail server implements, a message that cannot be delivered immediately must be queued and retried, and ",[38,182,185],{"href":183,"rel":184},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc5321.html",[42],"RFC 5321"," says the give-up time \"generally needs to be at least 4-5 days\". That covers the common case, not every case. A permanent rejection, an API-based sender with its own retry policy, or a sending server that gives up early can still lose a message. Microsoft said delivery might be delayed. It did not promise that nothing was dropped, and on Friday it extended its own email timeout to 48 hours to preserve delayed messages while it worked through the backlog.",[11,188,189],{},"That has a practical consequence: do not ask people to resend straight away. Check for a bounce, and check whether the original is queued or already delivered before sending again. A blind resend can arrive next to the original once the queues drain, and the recipient gets the same message twice. If a sender gave up early, the bounce is the evidence, and it tells you which window that sender uses.",[11,191,192],{},"Two wrinkles matter here. Mail sent to Microsoft 365 recipients from outside could be delayed on the way in, so a quiet inbox did not always mean nobody had written. And Safe Links rewriting meant some links in mail that had already arrived failed to open, which looked like a broken link rather than an outage. If you run outbound campaigns from Microsoft 365, pause them and resume at normal volume. Catching up in one burst is how a sender earns a throttle.",[18,194,196],{"id":195},"the-status-page-is-not-your-monitoring","The status page is not your monitoring",[11,198,199],{},"The more useful lesson is about visibility. Microsoft's admin center sits inside the product it reports on, and this incident made parts of it unreachable, which is why the company also posted to a public status page. But a status page describes the service, not your tenant. \"Service degradation\" can mean a settings page loads slowly or a sales team cannot send a single message, and both read the same from outside.",[11,201,202],{},"If your only alarm is a user saying Outlook is broken, you learn about incidents late and without scope. A synthetic check that sends mail from a non-Microsoft mailbox to a monitored inbox and back, every few minutes, tells you whether the path your business uses is working. Run it in both directions, give each message a unique identifier so duplicates are visible, and alert on delay as well as failure. It catches the partial failures a status page calls degraded, and it gives you a start time for the incident note.",[18,204,206],{"id":205},"what-to-have-ready-before-the-next-one","What to have ready before the next one",[208,209,210,214,217,220,223,232],"ol",{},[211,212,213],"li",{},"A list of what actually stops. Not the service catalog: the five or ten workflows that depend on mail. Invoice approval, e-signature, ticket notifications, the CRM sync, the alerting that emails the on-call engineer. Ask each team once and write the answers down. The list differs in every company, and nobody has one until they need it.",[211,215,216],{},"A second channel that does not share the dependency. Phone numbers for the people who matter, a group chat on another provider, and a status page hosted outside Microsoft's infrastructure. The channel only helps if the details are somewhere people can find them while the intranet is also down.",[211,218,219],{},"An outside-in mail probe, as above. Keep it maintained: credentials expire, alert routes break, and a monitor nobody checks is worse than none.",[211,221,222],{},"A written rule for bulk mail and automations. Pause, do not resend, re-run and reconcile. An HTTP timeout is not proof the call failed: the server may have completed the operation and lost the response. Treat a timeout as an unknown outcome, and use an idempotency key or a state check before retrying, or the re-run sends twice.",[211,224,225,226,231],{},"The SLA claim path. Microsoft's online services carry service-specific availability commitments, including 99.9% for many core services, and the credits are governed by those terms. They are not automatic. Someone has to file a claim with evidence, inside the window ",[38,227,230],{"href":228,"rel":229},"https:\u002F\u002Fwww.microsoft.com\u002Flicensing\u002Fdocs\u002Fview\u002FService-Level-Agreements-SLA-for-Online-Services",[42],"the agreement"," sets, so check which SLA covers your subscription before you need it.",[211,233,234],{},"A rehearsal. Once a year, for an hour, work without Outlook. It finds the workflows nobody listed and the phone numbers nobody has.",[18,236,238],{"id":237},"what-we-still-dont-know","What we still don't know",[11,240,241],{},"There is no root cause, no count of affected tenants, and no confirmation of which mitigation did the work. Microsoft has not said whether the extra connections came from outside its network, from its own recovery traffic, or from both, and that decides whether the fix is a configuration guardrail or a capacity change.",[11,243,244,245,249],{},"If you do one thing this week, write the list in the first item above: five workflows, the systems behind them, and the person who owns each. If you would rather have that mapped, probed from outside and tied to an on-call rota, it is part of our ",[38,246,248],{"href":247},"\u002Fservices#devops","DevOps and cloud infrastructure"," work.",{"title":251,"searchDepth":252,"depth":252,"links":253},"",2,[254,255,256,257,258,259,260],{"id":20,"depth":252,"text":21},{"id":53,"depth":252,"text":54},{"id":163,"depth":252,"text":164},{"id":176,"depth":252,"text":177},{"id":195,"depth":252,"text":196},{"id":205,"depth":252,"text":206},{"id":237,"depth":252,"text":238},"2026-11-13","Outlook was down for much of Thursday and into Friday, and Teams lost its calendar. What Microsoft says went wrong, and what it means for your business.","md",{},true,"\u002Fblog\u002Fmicrosoft-365-outage-november-2026",9,{"title":5,"description":262},"blog\u002Fmicrosoft-365-outage-november-2026","Cloud","6amYHSDy-avb9gSAYvyU-uyrIFrOMxN15_m22kqmDgc",1794567210772]