Microsoft 365 outage drags past 13 hours as Exchange fix stalls

By Daniel Okafor

Microsoft could not fully restore Microsoft 365 more than 13 hours after an Exchange Online failure began, telling customers overnight that its latest fixes were "not taking as expected." The outage, which started at 16:17 UTC on Nov. 12, spread from Outlook to Teams, SharePoint, Copilot and parts of Microsoft's own security tooling. For HR and internal-comms teams, the practical consequence is blunt: the channels through which most workforce communication runs were unreliable for a full business day.

Downdetector logged more than 130,000 Outlook problem reports at the peak. That is the scale of the dependency in question.

What actually broke?

Microsoft first flagged that users could not reach their mailboxes through Outlook on the web, desktop Outlook (MAPI), Exchange ActiveSync (EAS), or REST-based connections, with email delivery delayed. Users in the Americas were hit first; within two hours Microsoft said any region could be affected. It then opened a wider incident covering Teams, SharePoint Online, Copilot, Defender XDR, Intune, Power BI and several Purview services.

The company's diagnosis evolved across the day. It initially investigated elevated infrastructure load and whether a recent change had contributed. It then ruled out a traffic spike.

"We've determined that the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure," Microsoft said in its Exchange Online incident update.

A later update identified a specific culprit: a process on the affected servers responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests. Microsoft prepared a configuration change, tested it on a subset of servers, and reverted a recent network configuration change that correlated with the start of the disruption.

Recovery, meanwhile, has been two steps forward and one back. Microsoft restricted some traffic and reintroduced connections gradually to check whether servers remained stable under load. Some did not, becoming unresponsive again once traffic returned. In its updates for incident MO1550821, Microsoft also reported a surge in outbound calls from routing services to backend servers — partly a side effect of its own traffic-rebalancing measures — and said it was scaling virtual machines to add capacity.

How far did the impact reach?

Microsoft said impact varied by service, depending largely on whether it relied on Exchange Online:

• Teams: core messaging and online meetings largely functional, but calendar access and meeting scheduling — Exchange-dependent features — could fail.
• SharePoint Online: direct file access worked; Exchange-dependent features did not.
• Copilot: users might be unable to load Copilot Chat or receive responses, and Copilot experiences might lose access to work data such as email, calendars and files.
• Security and compliance: Defender for Office 365 Safe Links might be unable to verify URLs clicked in Outlook and Teams; some Defender XDR portal pages, selected Intune device enrolment and compliance scenarios, and Purview functions including data loss prevention, automatic labelling and communication compliance were also affected.

That last bullet deserves HR attention. Communication compliance and DLP (data loss prevention, the automated blocking of sensitive content leaving the organization) sitting on the same estate as email means a mail outage can also pause the controls that police the mail.

Is concentration the real story?

The incident has renewed focus on what happens when email, collaboration and security run inside one cloud ecosystem.

"Enterprises have priced Microsoft 365 as a licence and never as a single point of failure," said Sanchit Vir Gogia, chief analyst at Greyhound Research.

His prescription is not a second suite. "The answer is not a second suite. It is a rehearsed fallback for the few things that cannot stop: an out-of-band channel for incident command, mail continuity for critical roles, and a written decision on whether each security control fails open or closed."

For security teams, Microsoft's notification on Safe Links points to a specific URL-verification impact rather than the loss of all Defender for Office 365 capabilities — a distinction worth preserving when briefing leadership. Gogia added that enterprise customers will want a detailed account of the incident, including a timeline of when Microsoft identified the different causes and how it validated recovery measures.

Microsoft has continued publishing updates through its Microsoft 365 service status portal. It has not yet published a final post-incident root-cause report — and until it does, every continuity-planning conversation this outage triggers is running on partial information.