Definition
A Microsoft 365 incident ID is the reference Microsoft gives to each service health issue, such as EX1550543. It is two capital letters that identify the affected service, followed by a number. The same ID appears in the admin centre, in Microsoft's status posts and in press coverage, so it is the quickest way to find updates on one specific problem.
What the Prefixes Mean
Microsoft's documentation does not publish a prefix table. The mapping below is what the service field showed for real issues in admin centre data over the 30 days to November 13, 2026.
| Prefix | Service | Example |
|---|---|---|
| EX | Exchange Online | EX1550543 |
| MO | Microsoft 365 suite, used when several services are affected | MO1550821 |
| TM | Microsoft Teams | TM1550488 |
| SP | SharePoint Online | SP1548842 |
| OD | OneDrive | OD1530155 |
| CP | Microsoft 365 Copilot | CP1540142 |
| CW | Microsoft 365 Copilot Chat | CW1530649 |
| PP | Power Platform | PP1550869 |
| PB | Power BI | PB1528889 |
| IT | Intune | IT1549289 |
| DZ | Defender XDR | DZ1528963 |
| MP | Purview | MP1507695 |
| MV | Viva | MV1526068 |
| OO | Microsoft 365 for the web | OO1547737 |
| OP | Microsoft 365 apps | OP1549991 |
| WP | Windows 365 | WP1539043 |
| DV | Dataverse | DV1550921 |
| CR | Dynamics 365 apps | CR1551339 |
Incident or Advisory
Every ID is classified as one of two things.
- Incident: Microsoft calls it "a critical issue" where "the service or a major function of the service is unavailable".
- Advisory: a problem "affecting some users, but the service is still available", often with a workaround.
Status Values
| Status | Meaning |
|---|---|
| Investigating | Microsoft is aware of a possible issue and is gathering information |
| Service degradation | An issue is confirmed that may affect use of a service or feature |
| Service interruption | Users cannot access the service, and the problem is significant and reproducible |
| Restoring service | The cause is identified and the fix is known |
| Extended recovery | The fix is in progress but will take time to reach all affected systems |
| Service restored | The fix resolved the problem and the service is healthy |
| False positive | The service was healthy, or the cause was outside the service |
| Post-incident report published | A report with root cause and next steps is available |
Where to Look Up an ID
- Admins: the Microsoft 365 admin centre, under Health, then Service health. The Issue history tab shows issues resolved in the last 7 or 30 days.
- Everyone else: the public page at status.cloud.microsoft, which Microsoft offers for issues that prevent signing in, and the @MSFT365Status account on X.
- Email alerts: each admin can register up to two addresses for service health notifications.
Microsoft says it posts updates hourly during an incident unless it states another cadence.
Worked Example
In the outage of November 12, 2026, Microsoft opened EX1550543 at 16:17 UTC for Exchange Online. When other services failed it opened MO1550821 at 18:26 UTC for the suite, and PP1550869 for Power Platform. An unrelated Teams incident that morning was TM1550488. The prefixes show at a glance that email failed first and the wider impact came two hours later.
After the Incident
For incidents with broad impact, Microsoft commits to a preliminary post-incident review within 48 hours of resolution and a final one within five business days. Smaller issues get a closure summary and no review.
Sources
Microsoft Learn: check service health and Microsoft Learn: service health and continuity, read November 13, 2026.