🔍 Read the full analysis: Microsoft 365 Outage On Day Two: The Situation And Next Steps on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Microsoft 365 service degradation was still ongoing at 08:35 UTC on Nov. 13, after an Exchange Online outage began the previous day. Microsoft said a patch had improved stability on some servers and that it was expanding the patch region by region; the root cause remains unknown.
Microsoft 365 service degradation remained ongoing at 08:35 UTC on Friday, Nov. 13, as Microsoft expanded a patch intended to stabilize servers affected by an outage that began the previous day. In its 08:06 UTC update to incident EX1550543, Microsoft said servers were stable where the patch had been applied and that it was extending the fix region by region; it has not identified the root cause.
The disruption centers on Exchange Online. Since Thursday, Nov. 12, many users have reported being unable to reach mailboxes through Outlook on the web, desktop and mobile apps, or REST connections. Microsoft’s status page described the broader Microsoft 365 condition as “Service degradation” at the latest stated check.
Services that depend on Exchange Online have also experienced effects, including Teams calendars and meeting scheduling, parts of SharePoint Online, Microsoft 365 Copilot, the Microsoft Defender XDR portal, Purview and Planner. OpenAI and Anthropic separately reported errors with their Microsoft 365 connectors. The source material does not establish that every user or feature in those services was affected.
Microsoft’s account of the incident has developed over several updates. It initially described elevated load across multiple regions, then said the load was not caused by increased traffic but by servers becoming unexpectedly unavailable. The company paused deployments, redirected traffic, restarted servers and changed how server health was checked. It later reported that a core process on affected servers was becoming overwhelmed, and that restarted servers could become unresponsive again after receiving traffic.
At 07:29 UTC Friday, Microsoft reported positive results for server stability after applying an upstream authentication and routing configuration component patch to part of its infrastructure. Its 08:06 UTC update said it was expanding the patch systematically, starting in regions that were in or entering peak business hours. Microsoft had not said in the supplied updates when the rollout would finish or when normal service would return.
Microsoft 365 outage · Nov 12–13, 2026 · times UTC
Down, rerouted, restarted, down again
How Microsoft described the outage, step by step, in its own status posts.
Server pool (schematic)
servingcarrying extra loadunavailablerestart
What Microsoft said
- 17:54Nov 12Mailbox access fails in the Americas
- 18:07“May affect” users “in any region”
- 18:35“Elevated load across multiple regions”
- 19:12All deployments paused, traffic moved, servers restarted
- 19:31Not more traffic: servers “unexpectedly unavailable”, the rest carry the load
- 21:00New health-check method: some servers back in service
- 23:59Returned servers “can become unresponsive again”
- 08:06Nov 13Patch stable where applied, now expanding region by region; still degraded
Hit
Exchange Online mail in Outlook, Teams calendars, SharePoint features, Microsoft 365 Copilot, Defender XDR portal, Purview and more
AI connectors
OpenAI and Anthropic reported errors in their Microsoft 365 connectors
Earnings call moved
Workhorse Group: from Nov 12 to Nov 16, citing the Microsoft outage
Sources: Microsoft 365 Status on X (Nov 12, 17:54–21:00 UTC); Microsoft service health EX1550543 (Nov 12, 23:59 UTC; Nov 13, 08:06 UTC) and status.cloud.microsoft MO1550821 (Nov 13, 07:29 UTC); Anthropic and OpenAI status pages; Workhorse Group press release, Nov 12, 2026. Server pool is a schematic, not real server counts.
Graphic: Powered by Thorsten Meyer AI
Outage Disrupts Connected Work Tools
The disruption matters because email access is tied to more than inboxes. Exchange Online connections support scheduling and other functions across Microsoft 365, so a problem there can interrupt coordination even when a service’s other features remain available. Users may face difficulty accessing mail, arranging meetings or using tools that rely on Exchange data.
The effects have also reached organizations’ operations. Workhorse Group postponed its third-quarter earnings call from Nov. 12 to Nov. 16 because of the outage, according to the source material. That is a specific example of a business changing its schedule, not evidence that all affected organizations have had the same impact.
Reports from Downdetector cited in the source material indicate the scale of complaints, but they are not verified counts of people unable to work. Reuters, as published by The Korea Times, reported more than 130,000 U.S. Outlook problem reports at the peak, around 1 p.m. ET Thursday. Business Standard, citing Downdetector, reported complaints from 74 countries. Downdetector records user reports; these figures do not establish the number of affected users or the outage’s full reach.
Products Worth Considering
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
FlexiSpot E6 Electric Standing Desk, 55 × 28 in, Bamboo Top, White Frame
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
How the Incident Developed Overnight
Microsoft’s first public notice came at 17:54 UTC Thursday, saying it was investigating reports of Exchange Online mailbox access problems through multiple connection methods in the Americas. A copied service health post cited in the source material lists the incident start as 16:17 UTC. At 18:07 UTC, Microsoft said the issue could affect connectivity for Microsoft 365 users in any region.
During Thursday evening and overnight, the company described multiple troubleshooting steps. It redistributed traffic, paused deployments and restarted servers. At 19:31 UTC, Microsoft said unexpected server unavailability—not increased traffic—was putting pressure on remaining infrastructure. Later, it said affected servers were failing automated health checks and that an alternative health-check method had allowed some servers to return to service. Those restarts did not provide lasting relief: Microsoft subsequently said some servers became unresponsive again once traffic resumed.
At 01:06 UTC Friday, Microsoft said a process responsible for establishing secure connections was becoming overwhelmed and that it had begun reverting a recent network configuration change that correlated with the start of the impact. A later change was not working as expected. Microsoft also said at 04:10 UTC there was no indication of malicious activity. A separate Teams incident earlier Thursday, tracked as TM1550488, was marked fully resolved at 17:09 UTC; Microsoft has not said whether it was related.
“Servers are stable where a patch was applied, and Microsoft is expanding the patch region by region.”
— Microsoft, in its 08:06 UTC service health update for EX1550543
Root Cause and Recovery Remain Unknown
The root cause has not been disclosed. Microsoft said it had not identified a recent change correlated with the start of the impact, then reported that it was reverting a network configuration change that correlated with the outage. Those statements do not establish that the configuration change caused the incident. The company’s later patch update also does not explain why the servers or secure-connection process became overwhelmed.
It is not yet clear how many users, organizations or regions remain affected, how quickly the patch can be expanded, or when services will return to normal. The complaint counts reported by Downdetector are user reports, not a verified total of affected people. Microsoft said it was not aware of malicious activity, but a final account of the cause and response is still pending.
Microsoft to Expand the Server Patch
Microsoft said it was expanding the patch region by region, prioritizing areas in or entering peak business hours, while monitoring server stability. Its status page remained at “Service degradation” at 08:35 UTC, so users should treat the incident as ongoing rather than resolved.
The next clear milestone is a further Microsoft service health update stating whether the rollout is improving stability across more infrastructure and whether affected Microsoft 365 services are recovering. Microsoft has promised a Post-Incident Report once the problem is mitigated. Until that report or additional status updates are published, the cause, full impact and recovery timeline remain unconfirmed.
Key Questions
Is the Microsoft 365 outage over?
No. Microsoft’s status page still listed “Service degradation” at 08:35 UTC on Nov. 13. The company said the patch had stabilized servers where applied, but it was still expanding the fix.
Which Microsoft 365 services are affected?
The main reported issue is access to Exchange Online mailboxes through Outlook on the web, desktop and mobile apps, and REST connections. Effects have also been reported in tools that depend on Exchange Online, including Teams calendars and meeting scheduling, parts of SharePoint Online, Copilot, Defender XDR, Purview and Planner. The extent varies and has not been fully detailed.
What caused the outage?
Microsoft has not named a root cause. It said servers became unexpectedly unavailable and described an overwhelmed process responsible for establishing secure connections. It also said it was reverting a network configuration change that correlated with the start of the impact, but did not confirm that this change caused the outage.
When will Microsoft 365 return to normal?
Microsoft has not provided a confirmed restoration time. It said it was expanding the patch systematically and monitoring server stability. The service status and subsequent incident updates are the available indicators of progress.
Was the outage caused by a cyberattack?
Microsoft said at 04:10 UTC Friday that there was no indication of malicious activity. The supplied information does not include a completed investigation or final incident report.
Source: ThorstenMeyerAI.com
