Microsoft’s Outlook outage stretches past 17 hours as failing servers stall email for businesses, schools and governments

Microsoft’s Outlook email and many tools tied to it were still not fully working early Friday, about 17 hours after the trouble began, according to the company’s service health page.  At 2:01 a.m. Friday, Microsoft said it saw “incremental improvement in several workloads,” but capacity had “not yet fully returned to baseline.”  The outage hit businesses, schools, police and governments on several continents, including Stanford University and city halls around the Bay Area.

Microsoft says it does not know of any malicious activity behind the failure.  Instead, it describes a chain reaction inside its own systems:  servers that run Exchange Online, the cloud service behind work and school Outlook accounts, began failing automatic health checks and dropping out of service.  That pushed their traffic onto the servers that were left, which then buckled too.  The company has promised a full post-incident report on the root cause once service is restored.

What broke, and when

All times are Pacific.  The failure started in Exchange Online at 8:17 a.m. Thursday, Nov. 12, according to Microsoft’s service health dashboard as reported by the trade publication CIO.  Separately, Microsoft had reported a Teams problem in North America at 7:40 a.m. and said at 9:09 a.m. that it was fully fixed.  Microsoft has not said whether the two were linked.

• 9:54 a.m.  Microsoft 365 Status, the company’s official account on X, said it was looking into reports that users in the Americas could not reach their Exchange Online mailboxes.
• 10:07 a.m.  It said the problem could affect users “in any region.”
• 11:12 a.m.  It paused all deployments, moved traffic off the affected servers and began restarting them.
• 11:31 a.m.  It ruled out a traffic surge.  The load came from “a number of servers being unexpectedly unavailable.”
• 11:50 a.m.  It said a problem was causing servers to “fail automated health checks and become unavailable.”
• 12:19 p.m.  It said it had found no recent change tied to the start of the outage, and that the failed checks might come from one component that processes server health.
• 2:09 p.m.  It said its fixes had “not provided the anticipated relief” and that “a core process on affected servers” was being overwhelmed.
• 4:06 p.m.  It said servers it brought back “can become unresponsive again once they receive traffic.”
• 7:13 p.m.  It said its latest changes were “not taking as expected.”
• About 11 p.m.  Its status page reported “positive results for server stability” after a patch to “an upstream authentication/routing configuration component” on part of its systems.
• 1:14 a.m. Friday  It extended how long email waits in line before it bounces to 48 hours, to protect delayed messages.
• 2:01 a.m. Friday  Its status page reported “incremental improvement in several workloads” but said service health “remains variable.”

The cause, as far as it is known

Microsoft’s public account of the cause has changed during the day.  At first it looked at whether a recent change set things off.  At 12:19 p.m. it said it had found none.  At 1:40 p.m. it said it was weighing whether to undo “a small number of recent configuration updates” to speed recovery.  In later updates to IT administrators, Microsoft said a process “responsible for establishing secure connections” on the servers became overwhelmed, and that it was reverting a network configuration change that lined up with the start of the outage, CIO reported.

Australia’s Home Affairs Minister Tony Burke told reporters Friday that Microsoft had compared the event to the July 2024 CrowdStrike outage, “where there is an update that has gone awry,” the Associated Press reported.  Microsoft itself has not publicly named a faulty update as the cause.  What is not confirmed:  which change, if any, started the failure, why the health checks failed, and why restarted servers kept falling over.  Microsoft says its post-incident report will cover the root cause and “defense-in-depth” fixes, meaning extra layers of protection.

“We regret that today’s outages caused disruptions for our customers,” Charles Lamanna, a Microsoft executive vice president, wrote on X Thursday evening, adding there was “no indication” of a cyberattack.

What stopped working

Email was the center of the outage, but the damage spread to anything that talks to Exchange Online, according to Microsoft’s service health page.  That list included:

• Outlook  on the web, on desktops and on phones, with delayed email delivery.
• Teams  calendars, meeting invites and scheduling.  Microsoft said joining calls, meetings, group chats and channel messages mostly kept working.
• Copilot, Microsoft’s AI assistant, which could fail to load or to reach work email, calendars and files.
• Security tools  such as Defender’s Safe Links, which checks web links in email.  Links rewritten by Safe Links could fail to open.
• Other services  including Intune device management, Planner, To Do, Purview data-protection tools, Power BI exports and Universal Print.

Microsoft’s separate consumer status feed also listed trouble with Outlook.com, OneDrive, OneNote, To Do, Teams and Microsoft 365 for the web.  Files stored directly in SharePoint stayed reachable, the company said.  Its Azure cloud platform reported no issues.

Reports of Outlook problems on the tracking site Downdetector rose from 214 to 2,934 in 15 minutes after about 9:20 a.m. Thursday and peaked at 131,114 at 10:20 a.m., the San Francisco Standard reported.  Downdetector counts user complaints, not confirmed outages.

Who was hit

Bay Area.  Stanford University’s IT office told its community Thursday afternoon that “most users” could not reach Outlook email and calendars, and that paging, fax and conference-room display services tied to Outlook were affected.  It said email sent during the outage “is being held safely and has not been lost.”  San Francisco’s Department of Technology told city workers by recorded message that it was having “a Microsoft 365 service disruption,” the San Francisco Standard reported.  San Ramon said on Facebook that it could not send or receive email, Patch reported.  Contra Costa County and the cities of Oakley, Sebastopol and Vallejo also reported problems, according to Bay City News, as published by SFGATE.  San Jose State University’s public status page listed no incidents for Thursday or Friday.  The Daily News found no public statement from the city of San Jose.

Governments.  The Australian government activated a June agreement with Microsoft that commits both sides to “prioritise the recovery of Australia’s digital economy” after major outages in Microsoft’s systems, according to the agreement text and Burke’s remarks reported by CNA and ABC News.  Australia’s spy agency and federal police said they were affected, CNA reported.  The British government said it was “working closely” with Microsoft, and several U.K. police forces asked people to report crimes by phone, The Guardian reported.

Businesses and services.  Indian airlines IndiGo and Akasa Air said their email support was affected.  Japanese shipper Sagawa Express could not take some online bookings, and drugmaker Taisho took orders by phone, The Guardian reported.  OpenAI and Anthropic said tools that connect their AI services to Microsoft 365 were not working properly, the paper reported.

Not the first time

Thursday’s failure is the latest in a run of cloud outages that each started with a single fault inside one company.

• July 2024, CrowdStrike.  A bad update from the security company CrowdStrike crashed about 8.5 million Windows computers, Microsoft estimated.  It was not a Microsoft failure.  Microsoft said its “broad economic and societal impacts” came from CrowdStrike’s use by companies that run critical services.
• October 2025, Amazon Web Services.  A hidden flaw in the automated system that manages internet addresses for Amazon’s DynamoDB database left an empty address record in its Northern Virginia region, Amazon’s incident summary says.  Other AWS services that rely on DynamoDB failed too, and some problems lasted into the afternoon of Oct. 20, 2025.
• October 2025, Azure Front Door.  For about eight hours on Oct. 29, 2025, Microsoft’s Front Door traffic service failed after valid customer settings exposed a hidden software bug, Microsoft’s post-incident review says.  It also disrupted Microsoft 365.
• September 2026, Azure networking.  From Sept. 30 to Oct. 1 this year, Azure networking services in 33 regions had failures when a burst of paused updates resumed at once and overloaded a shared control system, according to Microsoft’s review.

Each began with a fault inside one company’s own systems, not an attack, according to the companies’ reports, and each spread to customers who had no part in it.  In the September case, Microsoft wrote that its existing throttling and load-protection tools “did not sufficiently protect critical processing.”

What it means for the future

Thursday’s outage shows how much daily work now runs through one supplier.  When email, meetings, AI tools and security checks all depend on the same service, one failure can stop all of them at once.  “Enterprises have priced Microsoft 365 as a licence and never as a single point of failure,” Sanchit Vir Gogia, chief analyst at Greyhound Research, told CIO.

Regulators were already watching.  In October, Britain’s Competition and Markets Authority proposed giving Microsoft “strategic market status” in business software, a label that would let it set rules for the company.  The agency said the ability to choose and switch providers “without being overly dependent on a single technology provider” matters for resilience.  In March, it said Microsoft and Amazon had agreed to steps that make it cheaper to use more than one cloud.

In Europe, financial regulators in November 2025 named Microsoft’s Irish unit, along with Amazon Web Services and Google Cloud, as “critical” technology suppliers to banks and insurers under a law called the Digital Operational Resilience Act, which puts them under direct oversight.  Asked whether Australia should rely less on Microsoft, Burke said diversity was relevant in many areas, ABC News reported.

Experts quoted in coverage did not call for dropping Microsoft.  “The answer is not a second suite,” Gogia told CIO.  He said companies need a rehearsed backup plan for the few things that cannot stop, including another way to talk during a crisis and email backup for key staff.  Mark Gregory, an associate professor of engineering at RMIT University in Australia, told The Guardian that companies should test configuration changes more before they go live and that businesses should have backup options.

What it means for you

For most people, the outage means late or missing work email, broken calendar invites and a slow Friday.  Microsoft and campus IT offices say a few steps can help:

• Don’t assume your email is lost.  Microsoft extended its holding window to 48 hours so delayed mail is kept, and Stanford says held messages should arrive on their own once service returns.
• Check the official page.  Microsoft points users to its public status page when company admin portals are down.
• Use what still works.  Microsoft says Teams calls, chats and meetings mostly work, and files stored in SharePoint can still be opened directly.  Power Apps users who are already signed in should stay signed in.
• Watch for scams.  During the 2024 CrowdStrike outage, the federal Cybersecurity and Infrastructure Security Agency urged people to “only follow guidance from legitimate sources” as criminals sent fake fix-it emails.  Treat any unexpected “Microsoft support” call or message with care.
• Small businesses:  the experts’ advice comes down to keeping customer and staff phone numbers somewhere other than Outlook and agreeing on a backup way to reach each other before the next outage.

Microsoft has not said when service will be fully restored.

Source:  Microsoft 365 service health status;  Microsoft 365 Status on X;  Charles Lamanna on X;  Stanford University IT;  Australian Home Affairs–Microsoft agreement;  Microsoft Azure post-incident reviews;  AWS incident summary;  U.K. Competition and Markets Authority;  European Securities and Markets Authority.