On November 12, 2026, a major Microsoft 365 outage left many businesses without email and Teams and, for many administrators, without their management tools. No small business could have prevented this incident. Each one can, however, decide in advance how it will keep working and communicating when its main platform stops responding.
Status as of midday Eastern time, November 13, 2026. Microsoft reports encouraging recovery progress: availability and email delivery are improving, and message queues are approaching normal levels. Intermittent issues remain possible and no timeline has been announced for full recovery. Microsoft has not yet published the cause of the outage; the explanations below are those communicated during the incident and may be refined in its incident report.
What happened?
The outage began around 18:00 UTC (1 p.m. Eastern). Exchange Online, Teams, Copilot and Defender for Office 365 were among the unavailable services, along with some administration tools. The Register.
Microsoft first said servers were failing automated health checks and becoming unavailable. Its investigation then pointed to a core process becoming overwhelmed on the affected servers, causing them to stop responding and reducing available capacity.
On Downdetector, Outlook reports peaked at about 130,000 shortly after 1 p.m. Eastern. These are user reports, not a verified count of affected organizations. Al Jazeera.
To recover, Microsoft validated an alternative health check method on a subset of servers, then restarted components and reintroduced traffic in stages. By the evening, some restored servers could still stop responding once they received traffic again. The Register.
On the evening of November 12, Microsoft began rolling back a recent network configuration change, without saying whether it caused the problem. On the morning of November 13, recovery was progressing in Europe, Asia Pacific and North America. The incidents remained open in Service health under MO1550821 (Microsoft 365) and EX1550543 (Exchange Online). SecurityWeek, Al Jazeera.
No indication of a cyberattack, Microsoft says
Microsoft says it has found no indication that the outage was caused by malicious activity. BleepingComputer. It has promised a post-incident report with the root cause and repair actions once the situation is stable. SecurityWeek.
An Outlook flaw reported the same week is a separate matter. The vulnerability CVE-2026-124194, fixed by Microsoft on November 10, is actively exploited according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which added it to its catalog of exploited vulnerabilities that day. It can expose authentication data when a user opens a crafted file in a vulnerable Outlook client. CISA, SecurityWeek. Neither Microsoft nor CISA has linked it to the outage.
The useful step is simple: confirm that the November Microsoft 365 Apps and Office updates are installed on your computers, and stay cautious with unexpected attachments, even from a known sender.
What the incident reveals
Microsoft 365 often brings together email, meetings, chat, shared files and device management. That simplifies daily work. It also means a single interruption can affect, all at once, how you receive a request, discuss it and find the document you need.
This time, some administration tools, such as Intune and the Microsoft 365 Apps admin center, were also unreachable. The team responsible for diagnosing the situation could lose its own means of observation and communication exactly when it needed them most.
The cloud does not eliminate outages: it hands their resolution to the provider. Your business still remains responsible for its clients, its commitments and its communication during the interruption.
What happens to email received during an outage?
When a destination server does not respond, a compliant sending server generally keeps the message and tries again later. The SMTP standard recommends continuing attempts for at least four to five days before giving up. RFC 5321, section 4.5.4.1.
An outage of a few hours therefore does not necessarily mean lost messages, but it can cause delays. During this incident, Microsoft also extended its own email timeout window to 48 hours to help preserve delayed messages. This does not change other senders’ retry rules and does not guarantee that every message will be delivered. BleepingComputer. The exact behavior depends on each sender and on the type of error. After recovery, it is still worth checking urgent requests expected during the affected period.
Avoid changing your MX records or other DNS settings in a hurry. An improvised change can route email to a server that is not ready to accept it and extend the effects of the outage after the service returns.
Preparing for the next interruption
For management
Identify critical activities. List the processes that depend on email, Teams or SharePoint: receiving orders, customer service, payroll, exchanges with a partner.
Plan a fallback channel. Agree on a way to reach the team outside Microsoft 365, such as phone, text messages or another tool already approved. It should be known before the outage, not chosen during it.
Prepare a message for clients. A short note explaining that email is disrupted and giving a phone number can be posted quickly on your website or social channels.
Decide who announces what. One person responsible for communication avoids contradictory messages between teams.
For IT leads
Know the official status sources. Check Service health in the Microsoft 365 admin center first, as it gives information specific to your organization. If it is unreachable, the Microsoft 365 status page serves as a fallback. Keep these addresses accessible outside your mailbox. Microsoft 365 incident readiness.
Keep an offline contact list. Numbers for key employees, suppliers and your IT partner should not exist only in Outlook.
Make use of local copies. In classic Outlook for Windows, Cached Exchange Mode lets people read messages already downloaded. In OneDrive, select “Always keep on this device” for essential files ahead of time, let them finish downloading and check that they open offline. OneDrive Files On-Demand. These copies do not restore email delivery or online collaboration, but they give access to information already received.
Document the incident. Record the start time, the affected services, the observed effects and the actions taken. These notes will help you compare with Microsoft’s report and improve your plan.
After recovery
For certain incidents, Microsoft publishes a post-incident report (PIR) in Service health in the admin center. This report sets out the identified cause and planned measures. Microsoft. It is worth reading before drawing final conclusions.
Microsoft’s online services are also covered by a service level agreement that may provide credits when monthly availability falls below the guaranteed level. These credits generally have to be claimed by the customer, according to the terms of its agreement. Service Level Agreements for Microsoft Online Services.
Finally, learn from the experience while it is fresh. What did your teams miss? Who could not be reached? Which client requests went unanswered? These answers are worth more than a theoretical plan.
Review your continuity with Nuagerie
Our team can help you review the role Microsoft 365 plays in your operations, prepare fallback communication channels and clarify what falls to the provider or to your organization. Discover our email and collaboration services.
For an existing service, find our contact details on the support page. To arrange a review of your environment, let’s discuss your needs.