Microsoft 365 Grinds Back to Life After Day-Long Global Outage

More than 24 hours after the outage began, Microsoft reported broad recovery and stability across its Microsoft 365 services as of 6:00 p.m. UTC (1 p.m. ET) on Friday, Nov. 13. The company still acknowledged service degradation in Microsoft 365 components that interact with Exchange Online, its cloud email platform. Microsoft attributed the failure to a technical issue, not to a cyberattack and not to artificial intelligence.

What caused the outage?

The culprit, according to Microsoft, was self-inflicted infrastructure work. The company described the fault as "introduced by an earlier network capacity upgrade that surfaced following a recent network change." In plainer terms, an upgrade intended to add headroom interacted badly with a subsequent configuration change. The result was a global outage lasting more than a day.

Restoration proceeded deliberately rather than swiftly. "Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration," Microsoft said on its service health dashboard. A slower recovery that holds, one presumes, beats a fast one that does not.

Which services remain affected?

The blast radius extended well beyond email. Microsoft confirmed that elements of Microsoft 365 products interacting with Exchange Online and email services may be affected in various ways, while components that do not rely on that interaction remain functional. The collateral damage includes several products a finance desk would not immediately associate with a mail outage:

• Email delivery may be delayed or inaccessible.
• Some Microsoft 365 Admin Center pages may fail to load.
• Cloud Update, Cloud Policy and Inventory in the Microsoft 365 Apps Admin Center are affected.
• Copilot 365 Chat may not load or return responses, on web or in the app.
• Microsoft Intune device enrollment, device check-in and device compliance policies "may have been intermittently impacted," Microsoft said.
• A long list of functions in Microsoft Purview (the compliance and data-governance suite) and Microsoft Teams are impacted.
• Customers who configured Windows 365 tenants and Cloud PCs to use Microsoft Purview Customer Key may have users unable to connect to their Cloud PCs.
• Users of Word and Excel may be unable to view recently used files.

An update posted at 8:00 p.m. UTC (3 p.m. ET) softened expectations further. "As infrastructure stabilizes, we're still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes," Microsoft wrote. Sign-in first, mail flow later; the ordering is worth noting for anyone drafting client communications on a deadline.

Why does recovery raise security risks?

Recovery from a large outage creates openings for criminals, precisely when fatigue is highest. Matt Hull, vice president of cyber intelligence and response at NCC Group, warned that "cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create. Organizations should remind colleagues to be particularly vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay."

Social engineering ranks among the chief concerns, as attackers impersonate Microsoft or internal IT teams. "We could see attempts to convince people to reset passwords, approve multi-factor authentication requests or provide remote access to their devices," Hull said. A workforce conditioned to expect password resets and authentication prompts during an outage is, understandably, an easier target.

What happens next?

Microsoft has promised a full post-incident report once its review is complete. The company also struck a contrite note in its status update: "We are deeply sorry for the disruption this incident has caused you and your business. We know the trust you place in our services and take that responsibility extremely seriously."

For finance leaders, the operational lesson is straightforward. A single vendor's network change stalled email, compliance tooling, device management and AI assistants across a global customer base for more than a day, with no ETA for full mail-flow normalization as of the latest update. The post-incident report, when it arrives, will merit a close read. In the interim, staff should treat every urgent reset request with the skepticism this outage has earned.