Microsoft 365 Outage Runs Into Second Day as Fixes Fail to Hold; Company Sees No Sign of Cyberattack

Microsoft's global outage was still unresolved early Friday, Nov. 13, roughly 15 hours after Downdetector reports of Outlook failures peaked at about 130,000 shortly after 1 p.m. Eastern on Thursday, Nov. 12.

Outlook, Teams, Copilot and other Microsoft 365 services have been hit. Microsoft says users in any region could be affected, and problems spread to Asia and Australia on Friday morning.

What Microsoft says broke

The company first blamed "elevated load" on parts of its infrastructure. It later corrected that account: the extra load did not come from a surge in user traffic. A number of servers unexpectedly became unavailable, and that put pressure on the ones still running.

Microsoft said it had identified an issue causing servers to fail automated health checks before dropping offline. Its efforts to restore those servers and manage traffic across the system were "not working as expected."

The company has tried to limit traffic to certain parts of its infrastructure, tested a configuration change to redistribute load, and restarted affected services. It reported "partial recovery" in some regions, but not sustained recovery. In an update posted Friday, Microsoft said it was adding server capacity and repairing machines affected by recent network changes, and that some systems remain stuck in a faulty state, which keeps fixes from syncing. Microsoft's admin center tracks the Exchange Online mailbox problems under incident EX1550543.

Microsoft has said it is working "with urgency" and reviewing additional actions to improve infrastructure stability. It has not given a restoration time.

Cyberattack and rogue-AI theories

The outage hit as concern about cyber threats and AI-enabled attacks is running high, and two theories spread fast on social media: a coordinated attack, and an AI agent gone rogue inside Microsoft's own systems.

Charles Lamanna, Microsoft's executive vice president of Copilot, Agents and Platform, addressed the first directly in a post on X. "We regret that today's outages caused disruptions for our customers, and we are working to address the issue," he wrote. "For now I can confirm that there is no indication this is the result of malicious or cyber activity."

Microsoft has not publicly said anything about an AI agent being involved, and no source in this story has produced evidence for that theory. Microsoft has also not published a root cause. Lamanna said only that more information would follow as the company has it.

Australia's Home Affairs and Cyber Security Minister Tony Burke offered the closest thing to an outside read. He said Microsoft believes it is not dealing with a cyberattack. "They believe they are dealing in some ways similar to what we saw with respect to CrowdStrike where there is an update that has gone awry," Burke told a news conference. He added that the impact is "very much on email systems."

That is Burke relaying Microsoft's belief. It is not a finding. Microsoft's own statements point to failed server health checks and recent configuration and network changes, but the company has not said what changed or who approved it.

Governments and hospitals caught in it

The disruption is not confined to office workers missing email.

In Japan, Deputy Chief Cabinet Secretary Masanao Ozaki said the outage affected the government's IT infrastructure and that officials were monitoring the situation closely. In Australia, the domestic spy agency and the federal police were among the organizations caught up in it.

In Britain, the National Health Service relies on Microsoft 365 under a five-year agreement. The Central and North West London NHS Foundation Trust reported problems with Outlook and Teams and told patients to phone their usual service rather than email, warning that "emails may not be received." Teams is also used for remote consultations, including therapy sessions.

The concentration problem

This is the second major software-driven outage, after CrowdStrike, which Burke compared it to. In both cases, one vendor's failure took email and collaboration tools offline for agencies and institutions in several countries at once, with no attacker required.

Government bodies and public health systems that pay for these contracts with taxpayer money depend on a single provider for communications. Whether any of them had a working fallback is not yet known. Few have said so publicly.

What remains open is the cause. Microsoft has said it will share more as it learns more, and the questions it has not answered are what configuration or network change preceded the server failures, why the first restoration attempts failed, and when mailboxes and Teams will be fully back for customers still locked out.