A widespread Microsoft 365 outage disrupted email, collaboration and security services on 12 November 2026. Although the disruption prompted speculation about a cyber attack, Microsoft reported that unexpectedly unavailable servers were behind the service degradation.
The incident initially appeared to affect Exchange Online users in the Americas. Microsoft subsequently warned that connectivity problems could affect customers in any region, including organisations in the UK.
Microsoft 365 outage affects multiple cloud services
The first significant public indication emerged at around 12:30 pm Eastern time on 12 November, when user reports for Outlook and Microsoft 365 began rising sharply on Downdetector. The volume suggested a broad service problem rather than an isolated tenant, device or internet connection issue.
Microsoft acknowledged the incident in the early afternoon through its Microsoft 365 Status account. Its initial investigation focused on users in the Americas who were experiencing problems accessing Exchange Online mailboxes.
The reported scope then expanded. Microsoft said users in any region could experience Microsoft 365 service connectivity problems, making the incident relevant to organisations outside the area where the earliest symptoms appeared.
Services reported as affected during the Microsoft 365 outage included:
- Exchange Online and Outlook
- Microsoft Teams
- SharePoint Online
- OneDrive
- Microsoft 365 Copilot
- Microsoft Defender XDR
Reuters also reported disruption to connectors used by OpenAI and Anthropic services to access Microsoft accounts. This illustrates how an outage within a major cloud platform can affect connected services and automated workflows as well as Microsoft’s own applications.
Outlook and Exchange Online symptoms
The primary incident involved connectivity errors when users attempted to access Exchange Online mailboxes. These errors affected several connection methods, including Outlook on the web, desktop Outlook connections using MAPI, mobile clients using Exchange ActiveSync and applications making REST API calls.
This meant users could encounter different symptoms depending on how they accessed their accounts. Some might have been unable to open a mailbox, while others could have experienced failed synchronisation, delayed messages or errors from applications connected to Exchange Online.
By 2:07 pm Eastern time, Downdetector had recorded more than 97,000 Outlook problem reports. Downdetector figures represent reports submitted by users rather than a verified count of affected accounts, but the volume provided a strong indication of the incident’s reach.
What caused the Microsoft 365 outage?
Microsoft’s working diagnosis was that a number of servers had become unexpectedly unavailable. This placed elevated load on the infrastructure that remained operational and led to connectivity problems across Microsoft 365 services.
Importantly, Microsoft said the elevated load was not caused by a sudden surge in traffic. Its published explanation instead pointed to reduced server availability, with the remaining systems placed under strain as they handled connections that would normally have been distributed more widely.
This distinction is relevant because high service load can sometimes raise concerns about a distributed denial of service attack. In this case, Microsoft’s updates did not attribute the load to hostile traffic or any other malicious activity.
Microsoft’s mitigation measures
Microsoft took several measures to stabilise the affected environment and restore capacity. These included pausing deployments, redistributing connection traffic across its wider global infrastructure and moving additional traffic away from affected systems.
The company also restarted affected servers. Service health summaries indicated that engineers were testing configuration changes intended to bypass health-check related failure conditions while continuing to monitor recovery.
Pausing deployments helps prevent further changes from complicating an active incident. Redistributing traffic and restarting unavailable systems can reduce pressure on remaining capacity while engineers investigate why infrastructure has stopped responding as expected.
Microsoft 365 outage timeline and current status
The main developments reported on 12 November 2026 were:
- At about 12:30 pm Eastern time, Downdetector reports for Outlook and Microsoft 365 began to spike.
- In the early afternoon Eastern time, Microsoft acknowledged Exchange Online mailbox access problems affecting users in the Americas.
- In subsequent updates, Microsoft warned that connectivity issues could affect users in any region.
- By 2:07 pm Eastern time, more than 97,000 Outlook problem reports had been recorded by Downdetector.
- Later that afternoon, Microsoft said unexpectedly unavailable servers were causing elevated load and outlined its mitigation work.
- As of the evening in the UK, the incident remained under investigation and mitigation measures were continuing.
Microsoft tracked the primary Exchange Online incident as EX1550543 in the Microsoft 365 admin centre. A broader Microsoft 365 suite advisory was recorded as MO1550821.
Tenant administrators can use those identifiers to locate relevant service health updates when the admin centre is accessible. Microsoft also provides public service status information for users who cannot sign in to a tenant-specific dashboard.
No evidence links the outage to a cyber attack
No evidence published on 12 November linked the Microsoft 365 outage to a cyber attack. Microsoft had not disclosed malicious traffic, unauthorised access, malware or exploitation of a software vulnerability as a cause.
No threat actor had been credibly associated with the incident, and there were no indicators of compromise such as suspicious IP addresses, file hashes or domains. A proof of concept exploit is not applicable because Microsoft was managing an availability incident, not announcing a security vulnerability.
Organisations should therefore avoid treating the outage itself as evidence that their Microsoft 365 environment has been compromised. Separate warning signs, such as suspicious sign-ins, unexpected account changes or alerts from identity and endpoint monitoring, would be needed to support that conclusion.
The incident should also not be confused with the global Windows disruption on 19 July 2024. That separate event was linked to a faulty update from a third-party endpoint security provider and was unrelated to the 12 November 2026 Microsoft 365 outage.
What UK organisations should do
UK organisations that rely on Microsoft 365 should confirm whether their own tenant and critical workflows are affected. Administrators should monitor EX1550543 and MO1550821 in the Microsoft 365 admin centre, alongside updates from the public Microsoft 365 Status account.
Internal communications should distinguish service unavailability from a confirmed security incident. Staff can be given approved workarounds for urgent communication and document access, while administrators preserve logs and continue watching identity, endpoint and cloud security alerts for separate signs of malicious activity.
Organisations using integrations that connect to Microsoft accounts should also check whether failed requests, delayed automation or queued tasks require attention after service restoration. This is particularly important where workflows depend on Exchange Online, SharePoint, OneDrive or Microsoft 365 Copilot.
Microsoft’s investigation and recovery updates remain the authoritative source for the outage. Unless local security telemetry indicates otherwise, the available evidence supports treating the event as a significant cloud availability failure rather than a cyber attack.
Originally reported by The Independent.
