Microsoft Exchange Online failure knocks out Outlook, Teams and Copilot for nearly a day worldwide

Microsoft's cloud email backbone began failing on the afternoon of 12 November 2026. The first incident, EX1550543, opened at 16:17 UTC for Exchange Online, the mailbox and scheduling service behind Outlook. A second, MO1550821, opened at 18:26 UTC as trouble spread to Teams, SharePoint, OneDrive and Copilot. SocRadar reported on 13 November 2026 that what began as a mailbox access problem in the Americas widened into a global Microsoft 365 degradation.

Outlook and Teams have hundreds of millions of users, so the loss was felt immediately. Reuters reported on 13 November 2026 that the outage lasted more than 12 hours, crippled communications for businesses and governments, forced some organisations back to fax machines and halted at least one bond repurchase in Europe. Employees could not send email, manage calendars or host meetings. Trading firms saw delays, companies struggled to publish earnings, and airlines warned of communication lags.

Public institutions were hit alongside private ones. Government agencies from Australia to Japan and the United States were affected. A UK government spokesperson said officials were working with Microsoft on an outage that hit the NHS and London's Metropolitan Police, where loss of email affected the reporting of some crimes online, though call response was unaffected. Al Jazeera reported on 13 November 2026 that systems in Singapore and Japan were disrupted, communications at the Supreme Court of the Philippines were hit, and Australia's spy agency and federal police were affected.

Microsoft's message was consistent: a server problem, not an attack. It said it was not aware of any malicious activity and promised a full post-incident report. NBC News reported on 13 November 2026 that Microsoft had made progress more than 12 hours after the outage began and had ruled out malicious activity. Behind that summary sat failed health checks, paused deployments, a reverted network change and a patch that finally produced results.

Key Facts

EX1550543 opened at 16:17 UTC on 12 November and MO1550821 at 18:26 UTC, according to SocRadar, which reported on 13 November 2026 that the affected list included Teams, SharePoint Online, Microsoft 365 Copilot, Defender XDR, Defender for Office 365, Purview, Intune, Planner, To Do, Power BI, Fabric, Microsoft Graph, Universal Print, Windows 365 and the admin center. Reports came from at least 74 countries and territories.

Demand data matched. The Guardian reported on 13 November 2026 that Downdetector showed nearly 130,000 reports across 74 countries at about 6pm GMT on Thursday, covering Word, Excel, PowerPoint, Outlook, Teams, SharePoint and OneDrive. SocRadar put the global Outlook peak near 140,000 on 12 November, more than 130,000 of them in the United States. Al Jazeera reported on 13 November 2026 that by about 07:00 GMT Friday Downdetector still had at least 43,000 Outlook reports from 72 countries.

The recovery ran through the night. At about 19:06 UTC Microsoft paused all deployments and configuration changes and said elevated load came from servers becoming unexpectedly unavailable rather than from a traffic rise. It restarted servers failing automated health checks, saw restored machines go unresponsive again under traffic around midnight, and at 01:06 UTC began reverting a recent network configuration change that correlated with the start of impact without confirming it as the cause. At 04:57 UTC it scaled up virtual machines. At 07:45 UTC it reported positive stability results after patching an authentication and routing configuration component, and at 09:10 UTC it extended the email timeout window to 48 hours so queued mail would keep retrying.

NBC News reported on 13 November 2026 that Microsoft warned almost 12 hours in that attempts to improve serviceability were not taking as expected, then reported positive server stability about 2:30 a.m. ET Friday. At about 9 a.m. ET it said email queues were significantly reduced and approaching normal levels, warning of intermittent access and delayed delivery. Charles Lamanna, executive vice president of Copilot, Agent and Platform, said availability and delivery performance were improving across a growing portion of affected infrastructure and that the company regretted the impact.

Microsoft shares fell 1.7% before the bell, lagging the broader market, though they had gained roughly 8% so far in 2026. More than 430 million people use Microsoft 365 apps, and more than 90% of Fortune 500 companies use Copilot, according to company figures cited by The Guardian. Microsoft has not confirmed how many users were affected.

Analysis

The technical story is a cascade rather than a single bug. Servers failed automated checks, were restarted, came back, then buckled again under normal traffic. Microsoft's first assumption, that elevated load reflected a traffic spike, gave way to the finding that load came from capacity disappearing. What this really means is that the failure lived in the control plane: the systems that decide which servers are healthy and how traffic is routed made bad decisions at scale, and adding capacity did not address the cause. The 48-hour email timeout extension is a queue-management workaround, not a repair.

Al Jazeera reported on 13 November 2026 that Microsoft had not confirmed a root cause but said the outage was not the result of a cyberattack, and that it was rolling back a network change without saying whether that change was to blame. Correlation is not causation, and Microsoft has been careful to say so. Still, the sequence matters: a change, a rollback, a patch to an authentication and routing component, then stability. A report that does not explain how the change passed existing safeguards will leave customers with the same exposure.

Reuters reported that this is the second disruption to Microsoft's services this year, and the repetition changes how the incident reads. eToro analyst Josh Gilbert said the bigger worry is that this is not the first Microsoft 365 outage this year, and that if reliability looks like a recurring problem it hands every IT department a reason to think twice before putting even more of its business in one provider's hands. That is the commercial risk beneath the operational one. Microsoft's growth story leans on Copilot, and Copilot runs on the same infrastructure.

Walter Pasquarelli, an affiliate researcher at the University of Cambridge's Bennett School of Public Policy, told Al Jazeera that about 430 million people use Microsoft services and that this is first and foremost a communication risk. The phrasing is precise. Email and calendaring are not glamorous workloads, but they are the coordination layer for courts, police forces, health services and trading desks. When that layer goes down, the damage shows up as delayed filings, missed trades and citizens unable to complete a transaction with their government.

Why It Matters

The outage showed how much public administration runs through one vendor's control plane. The Metropolitan Police lost the ability to report some crimes online, though emergency call response was unaffected. NHS local services moved to other systems or paper. Communications at the Supreme Court of the Philippines were disrupted, and Australia's spy agency and federal police were affected. These are not edge cases; they are the normal operating environment for governments that have consolidated productivity software onto Microsoft 365.

It also exposed the limits of contingency planning. Some organisations reached for fax machines because their fallback for email was effectively paper. A halted bond repurchase in Europe and delayed earnings publications show that financial operations are exposed too. Downtime is not only lost messages; it stops transactions with legal deadlines attached.

The procurement question follows. More than 90% of Fortune 500 companies use Copilot, and more than 430 million people use Microsoft 365 apps. Concentration on that scale is efficient and is also a single point of failure. The 1.7% premarket share decline suggests investors currently treat reliability as a manageable cost. A pattern of long outages could change that calculus, especially if customers start pricing in the operational burden of fallbacks they never needed before.

Next Up

Microsoft has promised a full post-incident report covering the root cause and preventive measures. Customers will ask why servers failed automated health checks, why restored capacity collapsed under traffic, and why a network configuration change correlated so tightly with the onset of impact. Until the report lands, the 48-hour retry window and the patched authentication and routing component are the only public account of how service came back.

The larger test is whether this is treated as an isolated failure or a reliability signal. Microsoft has said it found no indication of malicious activity, which removes one reassuring answer. What remains is an engineering and governance problem: how to change configuration on the systems that keep Microsoft 365 running without taking down services that hundreds of millions of people depend on. The next update will be judged less on the recovery timeline than on whether it explains how this cascade can be prevented.