Skip to main content

Microsoft 365 Outage, November 2026: Cause and Recovery

  • Published
  • 10 min read
Cover image: Microsoft 365 Outage, November 2026: Cause and Recovery
Contents9

On 12 November 2026 (UTC), the early hours of Friday 13 November in Japan, a global outage hit Microsoft 365. Outlook could not open mailboxes, email did not arrive or was delayed, Teams could not handle meeting schedules, and Copilot did not respond. The impact lasted for nearly a full day.

Microsoft says that, as of the morning of 14 November (Japan time), it has confirmed broad, stable recovery. However, the incident has not yet been declared "resolved". Based on Microsoft's official announcements, this article covers what happened, the cause, the latest status, and what companies should check.

Key points

  • It began as an Exchange Online (Outlook email) outage and spread widely to features linked to email, including Teams, Copilot, SharePoint, Defender, Purview and Intune.
  • Microsoft explains the cause as an issue from an earlier network capacity upgrade that surfaced after a recent network change, and says it was not related to cyber attacks or AI. A detailed post-incident report has not yet been published.
  • So that delayed email is not lost, Microsoft extended the email timeout to 48 hours. Check whether email you sent or received on 13 November was delivered.
  • Security features were also affected, including DLP, sensitivity labels and Intune. After recovery, check that they worked as configured.

About 30 hours

From the start (~16:17 UTC, 12 Nov) to Microsoft's latest update (22:00 UTC, 13 Nov); not yet declared resolved

20

Services and features Microsoft listed as affected

48 hours

Email timeout after Microsoft extended it, so delayed mail is kept

Terms used here

Exchange Online: the email and calendar system of Microsoft 365. Outlook and the Teams calendar connect to it to work.

MO1550821 / EX1550543: the numbers Microsoft gave this incident. You can follow its progress by these numbers under "Service health" in the admin center.

Health check: an automatic check of whether a server is working normally. Servers that fail the check are removed from service.

What happened

According to Microsoft, the outage began at around 16:17 UTC on 12 November (around 1:17 on 13 November in Japan). First, in Exchange Online, users could not connect to their mailboxes from Outlook on the web, the Outlook desktop app, smartphone mail apps (Exchange ActiveSync) and others. Then, at around 18:26 UTC, it was changed to a wider incident (MO1550821), described as a possible inability to connect to multiple Microsoft 365 services.

According to international media reports, reports to the outage tracking site Downdetector exceeded 130,000 at their peak. In Japan, the outage covered the whole of Friday's working hours. Japan's Ministry of Economy, Trade and Industry (METI) advised on 13 November that emails might not have reached it and that urgent matters should be handled by phone, and announced it would take steps such as extending deadlines for tenders and public calls for applications.

Timeline (UTC)

Based on Microsoft's service health updates, its official X account (@MSFT365Status) and its status page (status.cloud.microsoft). Items that appear only in media reports are marked as such.

Time (UTC)Microsoft announcements and other events
12 Nov ~16:17Exchange Online outage begins (start time given by Microsoft)
12 Nov 17:54Official X account posts that it is investigating reports that users in the Americas cannot connect to Exchange Online mailboxes
12 Nov ~18:26Handled as MO1550821, an outage that has spread to multiple services
12 Nov 19:30Microsoft says it has halted all deployments and configuration changes. It explains that the high load is not due to increased usage but because many servers suddenly became unavailable
12 Nov 19:43Servers found to be failing automated health checks and being removed. A recent change to the component that processes these checks may be involved
12 Nov 20:38While trying a fix, many servers stop responding
12 Nov 22:58Microsoft begins returning some servers to service
13 Nov 00:00Confirms that returned servers stop responding again once they start receiving traffic. Traffic restricted in some regions
13 Nov 01:12Explains that the process that sets up secure connections cannot cope with the load. Begins rolling back a recent network configuration change whose timing coincides with the start of the outage
13 Nov ~03:34Says there are no signs that the outage is caused by malicious activity
13 Nov 04:10Partial recovery in some regions, but not yet a stable recovery
During 13 NovExtends the email timeout to 48 hours so delayed mail is kept
13 Nov 11:11Recovery work completed in parts of Asia-Pacific (reported by Petri)
13 Nov 12:18Recovery progressing in Europe, Japan relatively stable, North America improving (reported by Petri)
13 Nov 14:41Email backlog greatly reduced and nearing normal (reported by Petri)
13 Nov ~18:09Announces broad recovery and stability. Explanation of the cause and an apology (see below)
13 Nov 22:00Latest update. Stable recovery continues, but Microsoft is monitoring for longer as a precaution and will not declare the incident resolved until all queued email has been processed

Note: Microsoft posts its updates in US time or UTC. This table uses UTC (Japan is UTC+9).

The cause: Microsoft's explanation

In the early hours of 14 November, Japan time (13 November UTC), Microsoft gave the following explanation, according to media reports.

  • "This was a technical issue not related to cyber or AI / agents."
  • "The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change."

Microsoft also apologised to users and businesses: "We are deeply sorry for the disruption this incident has caused you and your business."

The cause is still "provisional" (as of 01:00 UTC, 14 November 2026)

Microsoft says it will publish a detailed Post-Incident Review after its investigation is complete. At the time of writing, no Post-Incident Review was found. Microsoft's updates during the outage mentioned the health check component, the process that sets up secure connections and network configuration changes, but how these were connected has not yet been officially explained.

Affected services

According to Microsoft, Exchange Online and features that exchange data with email were affected, while parts that do not depend on email kept working. The main ones are below.

ServiceMain impact
Exchange Online / OutlookMajor impact Could not connect to mailboxes. Email delivery delayed
Microsoft TeamsCalls, joining meetings and chat mostly worked. Calendar-related actions (scheduling, inviting to and changing meetings), creating live events, and creating or deleting private channels failed
Microsoft 365 CopilotCopilot Chat would not open or respond. It could not refer to email, calendars or files
SharePoint OnlineProblems sharing files with people outside the organisation. Files could still be opened directly
Microsoft Defender XDR / Defender for Office 365Portal pages would not open. Policy decisions that use information such as DLP may be delayed or fail
Microsoft PurviewCheck needed DLP, sensitivity labels, auto-labelling, audit log search, eDiscovery and more were affected
Microsoft IntuneDevice enrolment, check-ins and compliance policies may have been temporarily affected
Power AppsSigning in to the mobile app sometimes failed. Microsoft advised using the web version, and that people who are signed in should not sign out or reinstall the app
Power BI / Microsoft FabricReports with sensitivity labels could not be exported to PDF or PowerPoint
Windows 365In setups using Purview Customer Key, users sometimes could not connect to their Cloud PCs

Microsoft also listed Microsoft Graph (the API for working with email and calendars), Planner, To Do, Universal Print and some pages of the Microsoft 365 admin center. Azure was not included: as of the morning of 14 November (Japan time), the Azure status page showed no problems.

Latest status (as of 01:00 UTC, 14 November 2026)

  • The status page still shows "Service degradation".
  • Microsoft says stable recovery is continuing in affected environments and, given the scale of the impact, it is monitoring for longer.
  • It plans to declare the incident resolved only after confirming that all email queued during the outage has been processed.
  • It says the impact on related products has mostly cleared.
  • Consumer services (Outlook.com, OneDrive and others) are also showing as healthy again.

Microsoft's next update is due by 02:30 UTC on 14 November. We will update this article when there is new information.

Five things companies should check

  1. Check the status through official sources

    In the Microsoft 365 admin center, check MO1550821 and EX1550543 under "Service health". If the admin center won't open, the same information is on status.cloud.microsoft. Summary sites and social media sometimes give different times or causes.

  2. Check whether email from around 13 November arrived

    Because the email timeout was extended to 48 hours, much of the delayed mail is still to arrive. Avoid resending the same email again and again. Once the outage is resolved, use "Message trace" in the Exchange admin center to check important emails, such as contracts, quotes and submissions with deadlines. It also helps to ask business partners to contact you another way if an email they expected has not arrived.

  3. Check that security features worked

    DLP, sensitivity labels, Defender for Office 365 and Intune are on the list of affected services. Check whether any email or files passed through without being checked during the outage, and whether Intune compliance status is back to normal. If you temporarily removed labels to export from Power BI, put them back. If audit log search or eDiscovery was unavailable, record the period.

  4. Watch out for phishing that exploits the outage

    After a major outage, fake emails and messages posing as "mailbox recovery" or "account re-verification" tend to spread. Microsoft's official updates on this outage do not ask users to open links or sign in again. An Outlook vulnerability is also being exploited this month, so please also see "Microsoft's November security updates".

  5. Review your procedures for when email stops

    When email, calendars, chat, AI and security tools all depend on the same platform, an outage has a bigger impact. Decide in advance on other ways to communicate (phone, another chat tool, a backup copy of contact details), who informs staff, and alternatives for procedures with deadlines.

Prepared vs. unprepared

If you are not prepared

  • When email stops, you cannot tell staff or business partners what is happening
  • You notice only later that emails did not arrive or deadlines were missed
  • You don't notice that security features stopped during the outage

If you are prepared

  • Monitoring spots problems early, and you inform people inside and outside the company with a set procedure
  • You can keep urgent work going through other ways to communicate
  • After recovery, you can check email and security status step by step

Let Digi Dinos help

Digi Dinos supports companies with DX, security, and system operations and maintenance. We are ISO 27001 certified and offer server and cloud operations and 24/7 monitoring (NOC). Our team works with you in Japanese.

  • Outage procedures: we set out the ways to communicate, the order of checks and who is responsible when a cloud service goes down.
  • Monitoring and operations: we watch over your servers and cloud and set up systems that spot problems early.
  • Operations takeover: we can take over systems whose staff have left or that another company managed.

Not sure what to check after this outage? Just ask (free consultation)

From checking the impact to setting up operations that are ready for outages, we guide you in Japanese.

Frequently asked questions

Was it a cyber attack?

Microsoft says it was a technical issue not related to cyber attacks or AI. Its updates during the outage also said there were no signs of malicious activity.

Have the emails I sent on 13 November arrived?

Many are likely to arrive late. Microsoft extended the email timeout to 48 hours and is continuing to process the backlog. However, not every email is guaranteed to arrive. For important emails, check with the recipient that they arrived.

Did systems running on Azure go down too?

According to Microsoft, this outage affected Microsoft 365, and the Azure status page showed no problems. However, if a system on Azure uses Microsoft 365 email or APIs, that part may have been affected.

Is there any compensation (refund)?

As of 14 November 2026, we found no announcement of special compensation for this outage. Microsoft 365 has a service level agreement (SLA), so please check the terms of your contract.

Related articles