Microsoft 365 outage stretches past 24 hours; email flow still catching up

Microsoft reported broad recovery across its Microsoft 365 services as of 6:00 p.m. UTC (1 p.m. ET) on Friday, Nov. 13 — more than 24 hours after a global outage disrupted businesses that run email, chat and device management on the platform. Exchange Online remains the sticking point, with Microsoft still reporting service degradation in M365 components that interact with it.

For employers and HR teams, the outage's reach went well beyond delayed email. Microsoft's service health dashboard confirmed that Copilot 365 Chat, Microsoft Intune device enrollment, check-in and compliance policies, a long list of Microsoft Purview and Teams functions, and parts of the Microsoft 365 Admin Center were all unavailable or intermittently impacted.

What caused the outage?

Microsoft ruled out the two theories that spread fastest. The company said the outage was "not caused by a cyberattack or by AI." It traced the failure to a technical issue "introduced by an earlier network capacity upgrade that surfaced following a recent network change."

The recovery itself was deliberately slow. "Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration," Microsoft said on its service health dashboard.

Which services were hit?

The blast radius covered tools many HR and IT departments treat as always-on infrastructure:

• Exchange Online and email, which may be delayed or inaccessible; M365 components that don't interact with Exchange Online remained functional
• Microsoft 365 Admin Center, where some pages wouldn't load, along with Cloud Update, Cloud Policy and Inventory in the Apps Admin Center
• Copilot 365 Chat, both the web version and the app — users couldn't load it or receive responses
• Microsoft Intune, where device enrollment, device check-in and device compliance policies "may have been intermittently impacted"
• Microsoft Purview and Teams, with a long list of functions affected
• Windows 365 Cloud PCs for tenants configured to use Microsoft Purview Customer Key — some users couldn't connect at all
• Word and Excel, where users may have been unable to view recently used files

An update posted at 8:00 p.m. UTC (3 p.m. ET) signaled that full normalization wasn't in sight. "As infrastructure stabilizes, we're still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes," Microsoft said.

Why the recovery creates a security risk?

The aftermath is a social-engineering window, according to Matt Hull, vice president of cyber intelligence and response at NCC Group. He warned that "cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create. Organizations should remind colleagues to be particularly vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay."

Attackers typically impersonate Microsoft or internal IT teams during recovery periods. "We could see attempts to convince people to reset passwords, approve multi-factor authentication requests or provide remote access to their devices," Hull said.

That warning translates directly into people-process decisions: communications teams should push verification guidance through channels that don't depend on the affected services, and helpdesks should expect a spike in password-reset and MFA-approval requests — legitimate and otherwise.

What happens next?

Microsoft has promised a full post-incident report once its review is complete. "We are deeply sorry for the disruption this incident has caused you and your business. We know the trust you place in our services and take that responsibility extremely seriously," the company said in its status update.

Until that report lands, employers lack root-cause detail on how a routine capacity upgrade cascaded into a day-long global outage. Expect procurement and IT risk teams to raise continuity questions — and single-vendor dependency arguments — when the findings are published.