Microsoft's records put the start of the outage at 16:17 UTC on Thursday, November 12, 2026, when users began losing access to Exchange Online mailboxes. It spread to Teams, SharePoint, Microsoft 365 Copilot and other services, and was still listed as open at 18:00 UTC on Friday, November 13, more than 25 hours later. Microsoft has not published a root cause. It has said twice that it has no evidence of malicious activity.
Key Facts
| Item | Detail |
|---|---|
| Start | November 12, 2026, 16:17 UTC (11:17 a.m. Eastern) |
| Status at 18:00 UTC, November 13 | Open, listed as service degradation, with recovery under way |
| Main incident IDs | EX1550543 (Exchange Online) and MO1550821 (Microsoft 365) |
| Related advisory | PP1550869 (Power Platform), restored November 13 at 15:50 UTC |
| Root cause | Not published. The admin centre field read "N/A" |
| Cyberattack | Microsoft says it has no evidence of malicious activity |
| Azure platform | No incident listed on the Azure status history for November 12 |
| Peak Downdetector reports for Outlook | About 130,000 around 18:00 UTC. These are reports, not users |
Timeline
Times are UTC. Eastern Time is five hours behind. Entries paraphrase Microsoft's admin centre updates for EX1550543.
| Time | What Microsoft reported |
|---|---|
| Nov 12, 16:17 | Incident begins. Users may be unable to connect to Exchange Online mailboxes. |
| 17:45 | Connectivity errors on a portion of Exchange Online infrastructure. |
| 18:19 | Affected infrastructure is under elevated load across multiple regions. |
| 18:26 | Second incident, MO1550821, opened for multiple Microsoft 365 services. |
| 19:06 | All deployments and configuration changes paused. |
| 19:18 | The load is not driven by an overall increase in traffic. |
| 19:43 | Affected servers are failing automated health checks. |
| 20:38 | Many affected servers have become unresponsive. |
| 22:00 | A core process on the affected servers is becoming overwhelmed. |
| 23:59 | Servers that return can become unresponsive again once they take traffic. |
| Nov 13, 01:06 | The overwhelmed process is the one that establishes secure connections. Microsoft begins reverting a recent network configuration change that lines up with the start of impact. |
| 03:34 | No indication of malicious activity. |
| 04:12 | Partial recovery in some regions, not sustained. |
| 07:25 | Server stability improves after a patch to an upstream authentication and routing configuration component. |
| 11:01 | Recovery actions completed in part of Asia Pacific. |
| 12:18 | Europe and North America improving, Japan more stable. |
| 14:01 | Email queues significantly reduced and approaching normal. |
| 15:53 | Sustained availability gains with intermittent issues remaining. No evidence of malicious activity. |
Search interest in the United States began rising at about 17:50 UTC, roughly an hour and a half after Microsoft's recorded start.
What Was Affected
- Email: Exchange Online through Outlook on the web, desktop and mobile, with delayed delivery. Outlook.com for consumers.
- Collaboration: Teams scheduling and channel creation, SharePoint Online, OneDrive, Planner and To Do. Core Teams calling and messaging were reported as largely unaffected.
- AI: Microsoft 365 Copilot. Reports say Copilot Chat could fail to load or to reach email, calendar and files.
- Security and management: Defender for Office 365, Purview, Intune, Windows 365 and the admin centres.
- Automation: Power Platform flows, apps and connectors, which Microsoft tied to an unavailable authentication dependency.
The outage began in the Americas and then reached every region. Asia Pacific recovered first.
What Caused It?
Microsoft has not published a root cause and has promised a post-incident report after mitigation is complete. Its updates describe a sequence: servers became unavailable, the remaining servers took more load, and a process that sets up secure connections was overwhelmed. Two actions lined up with recovery: reverting a recent network configuration change, and patching an authentication and routing component. Microsoft has not said that either change caused the outage.
An Australian minister, Tony Burke, said Microsoft told him it believed the cause was an update that had gone wrong, according to Reuters and Al Jazeera. That is a second-hand account.
Was Microsoft Hacked?
Microsoft says no. Its admin centre updates at 03:34 and 15:53 UTC on November 13 state that it has no evidence of malicious activity, and executive Charles Lamanna said the same publicly. We found no claim of responsibility from any group. TechCrunch reported that a Microsoft spokesperson did not answer when asked how the company could verify that.
How Many People Were Affected?
Microsoft has not given a number. Downdetector counts are user reports, and outlets disagree on them. Several put the Outlook peak at about 130,000 reports around 18:00 UTC on November 12. Al Jazeera cited at least 43,000 reports from 72 countries on Friday morning. Reported effects include UK health service systems, the US House of Representatives' email, and government systems in Singapore, Japan and Australia.
Earlier Microsoft 365 Outages
| Date | Duration | Cause as Microsoft described it |
|---|---|---|
| July 9-10, 2025 | Reported as 11 to 21 hours | Part of the mailbox infrastructure was not performing as expected |
| October 29-30, 2025 | 8 hours 24 minutes | An Azure Front Door configuration problem, with Microsoft 365 hit downstream |
| January 22-23, 2026 | Almost 10 hours | Part of the North American service infrastructure was not processing traffic as expected |
| July 23, 2026 | 4 hours 57 minutes | An Azure West US network repair that was applied too widely |
| August 31 to September 3, 2026 | About 3 days | Authentication configuration issues inside Exchange Online |
| November 12-13, 2026 | More than 25 hours, still open when last checked | Not yet published |
For outages at the cloud providers themselves, see the 2026 cloud outage tracker.
Methodology
The timeline and incident IDs come from Microsoft 365 admin centre messages as mirrored by the University of Pennsylvania, last read at 18:00 UTC on November 13, 2026, when the latest update was from 15:53 UTC. Microsoft's own status page could not be read directly. Other facts come from BleepingComputer, CNBC, TechCrunch, Al Jazeera and the Azure status history. This page will change when Microsoft publishes its post-incident report.