Microsoft 365 Outlook outage nears full recovery after daylong global disruption

A nearly daylong Microsoft 365 outage cut off email for businesses, schools and governments worldwide on Thursday, and by 5 a.m. Pacific Friday the company reported email queues were "significantly reduced and approaching normal levels." For HR teams that run recruiting, benefits communications and payroll approvals through Outlook, the disruption arrived without warning and without an explanation that same day.

The failure began Thursday morning in Exchange Online, the service that runs Outlook email for organizations, and spread to dependent Microsoft 365 services including Teams calendars, Copilot and SharePoint. Microsoft said its servers were failing automated health checks and dropping out of service, which overloaded the servers that remained. The company paused all deployments while it worked on a fix, and some repairs attempted Thursday evening were "not taking as expected," according to its status page.

Microsoft has not identified a root cause. It said it has no evidence of malicious activity. It has promised a full report once the problem is resolved.

What do we know about the cause?

Two external accounts point toward an internal configuration problem rather than an attack. Tom Warren of The Verge reported on X that his sources linked the outage to configuration changes in Azure Virtual Network, Microsoft's cloud networking service.

Australia's Home Affairs Minister, Tony Burke, told reporters in Sydney that Microsoft believes it is dealing with something similar in some ways to the 2024 CrowdStrike outage, "where there is an update that has gone awry," the Associated Press reported. Microsoft has not responded to a media inquiry about the cause.

In its 5 a.m. Pacific update, Microsoft said it was seeing "broader improvements now observed in North America and sustained improvements across much of Europe," along with early signs of recovery in Asia Pacific. Some users could still have trouble signing in or see delayed messages as queues drain.

How far did the disruption reach?

The outage stretched well beyond inboxes. Government offices in Japan, Singapore and the Philippines reported disruptions, according to the AP. Workhorse Group delayed its quarterly earnings call. OpenAI and Anthropic both reported problems connecting with Microsoft 365 tools.

The disruption also hit close to Microsoft's home. Ansel Herz, a spokesperson for the Seattle mayor's office, told the Seattle Times the outage did not bring city government to a halt but knocked out the systems that move documents and messages around City Hall. The newspaper quoted Herz calling the outage "a huge pain." In a post on X, he objected that the paper had trimmed his remark, which GeekWire presumed was "a huge pain in the ass."

What are the financial consequences?

Credit rating agency Morningstar DBRS estimated insured losses of $300 million to $500 million from the event. That figure sits well below estimates for the 2024 CrowdStrike outage, which ranged from $400 million to $1.5 billion.

Morningstar DBRS noted an important caveat for employers reviewing their coverage: some cyber insurance policies cover only malicious attacks, and a non-malicious infrastructure failure may fall outside them. The firm also said the toll could grow if the outage drags on for several days.

What should employers take from the incident?

For HR and business continuity leaders, the episode repeats a familiar pattern: a single vendor's internal change can freeze hiring pipelines, onboarding schedules, benefits enrollment windows and internal approvals across entire regions at once. Teams calendars and SharePoint went down alongside email, which meant scheduling and document workflows failed together rather than offering a fallback.

Microsoft's status page remains the authoritative source for residual delays, and its promised root-cause report will determine whether the incident traces to the Azure Virtual Network configuration changes cited by Warren's sources. Until that report lands, employers weighing renewal talks or single-vendor consolidation may want to press for clearer contractual commitments on recovery times and post-incident disclosure.