Microsoft 365 remained partly offline for more than 13 hours

Microsoft 365 remained partly offline for more than 13 hours after an Exchange Online failure that began at 16:17 UTC on Nov. 12. Microsoft said its latest fixes were not taking effect as expected, leaving Outlook, collaboration tools and security functions only partly restored more than 13 hours into the incident.

The failure started with Outlook and widened within two hours from the Americas to any region, according to Microsoft. It then reached Teams, SharePoint Online, Copilot, Defender XDR, Intune, Power BI and several Purview services, turning an email-access problem into a broader Microsoft 365 continuity event.

Downdetector logged more than 130,000 Outlook problem reports at the peak. That measure captures reports, not a Microsoft-confirmed count of affected customers or unique accounts. Microsoft warned that mailboxes could fail through Outlook on the web, desktop Outlook, Exchange ActiveSync or REST-based connections, while email delivery could be delayed.

The measurable disruption was substantial, but the available reporting did not establish a customer or financial loss total.

What caused the outage?

Microsoft initially examined elevated infrastructure load and a possible recent change, but later rejected higher user demand as the cause. In incident EX1550543, it said unexpectedly unavailable servers were shifting load onto the remaining infrastructure.

Microsoft said: “Our investigation has found that a process on the affected servers responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests.”

Under service incident MO1550821, Microsoft reported a surge in calls from routing services to backend servers while it applied mitigation. It attributed the higher outbound call volume to traffic-rebalancing actions and said it was scaling virtual machines to add capacity and reduce the load.

Microsoft prepared a configuration change to correct the behavior and tested it on a subset before wider deployment. It also reverted a recent network configuration change that correlated with the incident’s start, restarted affected infrastructure and monitored server stability. Those actions were mitigations, not a final root-cause resolution.

Recovery restricted some traffic and reintroduced connections gradually as Microsoft tested whether servers could remain stable under load. Some servers became unresponsive again after traffic returned, forcing further analysis and mitigation. The company continued publishing updates through its Microsoft 365 service status portal.

The practical point: Microsoft restored traffic before proving that the remaining infrastructure could stay stable.

Which services were affected?

Impact varied by service and feature, partly because several functions depend on Exchange Online. Microsoft described the following exposure:

• Exchange Online: Users could lose mailbox access through Outlook on the web, desktop Outlook, mobile clients, Exchange ActiveSync or REST-based connections; email delivery could also be delayed.
• Teams: Core messaging and online meetings remained largely functional, but Exchange-dependent calendar access and meeting scheduling could fail.
• SharePoint Online: Direct access to stored files remained functional, while features that rely on Exchange Online could be impaired.
• Copilot: Users could fail to load Copilot Chat or receive responses, and Copilot experiences could not access work data such as email, calendars and files.
• Security and compliance: Defender for Office 365 Safe Links might not verify URLs clicked in Outlook or Teams; some Defender XDR portal pages, selected Intune enrollment and compliance scenarios, and Purview data-loss prevention, automatic labeling and communication-compliance functions could also be affected.

Unavailable and impaired are different risks. The Safe Links issue, for example, concerned URL verification rather than the loss of every Defender for Office 365 capability, while Teams retained core messaging and meeting functions.

The practical point: shared dependencies made partial service failures operate as a single platform outage.

How concentrated is the enterprise risk?

The incident again exposed the concentration of enterprise functions in one cloud estate. Sanchit Vir Gogia, chief analyst at Greyhound Research, said: “Enterprises have priced Microsoft 365 as a licence and never as a single point of failure.”

Gogia said an infrastructure disruption can hit several business functions at once when mail, meetings and security controls share the same service estate. The financial exposure is operational continuity, not merely an email delay: critical communications, collaboration and protective controls can degrade together.

His prescribed fallback was not a second full suite. He recommended rehearsing continuity for the functions that cannot stop, including an out-of-band incident-command channel, mail continuity for critical roles and a written decision on whether each security control should fail open or closed.

Gogia also wants a detailed post-incident account showing when Microsoft identified each cause and how it validated the recovery measures. Microsoft has not yet published a final post-incident root-cause report, and the company disclosed no financial loss estimate, complete customer count or final restoration time in the cited updates.

For finance and operations teams, the first task is to test fallback paths against shared-platform failure; for Microsoft, the next test is whether its published evidence shows a durable repair.