Microsoft Outlook went down for many users on November 12, and the outage ran for about 30 hours before Microsoft confirmed full restoration on Saturday morning. Downdetector reports peaked at 138,000 in the United States, according to The Korea Times, and the tracker was still showing more than 18,000 Outlook reports by around 11:30 p.m. ET, according to USA Today.
Microsoft confirmed an Exchange Online incident, tracked as EX1550543, after users found they could not reach their mailboxes, according to USA Today. The company said the problem may affect Microsoft 365 service connectivity for users in any region, in a statement quoted by the Glasgow Times. Exchange Online is the cloud service behind Outlook mail for work and school accounts. Microsoft’s own affected-services list names Exchange Online, not Outlook.com separately, according to Technobezz.
Update, 14 November: Microsoft names the cause, apologises, and confirms full restoration
Microsoft has apologised for the outage and named its cause. “We are deeply sorry for the disruption this incident has caused our customers and partners. We know the trust they place in our services and take that responsibility extremely seriously,” the company said on Friday. The cause was “a technical issue not related to cyber or AI / agents,” introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change, Microsoft said. The company said it had addressed the underlying issue and was restoring service gradually, validating stability at each stage, and that a full post-incident report will follow once its review is complete.
Service is now fully restored. Microsoft’s service-health page showed “All products are operational” on Saturday morning, 14 November, and @MSFT365Status said it had “completed our efforts to address the underlying issue of the incident and restored service to the remaining impacted customers and regions.” Microsoft’s final update, at 03:51 UTC on 14 November, confirmed that services “across the previously affected environments have fully recovered and the backlog of email messages has been processed, thus this issue is remediated.” The incident ran from 10:05 UTC on Thursday 12 November to 4:10 p.m. UTC on Friday 13 November, about 30 hours, and about 36 hours passed from the first user reports to full restoration on Saturday morning.
Microsoft’s investigation points to “cascading failures + thundering herds at our network perimeter” that made recovery harder than normal. The company also extended the email timeout window to 48 hours overnight so delayed messages would not expire before delivery.
What happened to Outlook on November 12?
Microsoft’s own incident log starts at 11:17 a.m. ET, with the first entry at 11:20 a.m., according to WOM Technology, which read the log through a public mirror kept by the University of Pennsylvania. The company’s first public post about mailbox access went out at 12:54 p.m. ET, 97 minutes after the incident began. Downdetector said user reports indicated problems with Microsoft Outlook since 12:27 p.m. ET.
The reports then climbed fast. Just before 1 p.m. ET, Outlook reports stood just shy of 83,000, with Microsoft 365 at 22,323, Teams at about 2,000 and Copilot at about 4,400, according to USA Today. The peak came in the early afternoon: USA Today recorded 128,874 reports at 1:09 p.m., Reuters counted more than 130,000 at 1:27 p.m., and The Korea Times put the precise peak at 138,058. Microsoft opened a wider Microsoft 365 incident record, MO1550821, at 1:26 p.m. ET, according to BleepingComputer.
There was also an earlier wave. Channel News reported more than 2,100 Outlook problems by about 9:30 a.m. ET on Thursday morning, with users unable to log in to Microsoft accounts. No source has reconciled that morning wave with the afternoon spike.
The outage was not limited to Outlook. Microsoft’s status page listed Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365 and Microsoft Defender XDR as potentially impacted, according to Engadget. The list later grew: TechCrunch confirmed OneDrive and Office for the web were affected, USA Today listed Microsoft To Do and Purview, On-Site Technology reported Intune, Defender for Office 365 and Power BI joining the list, and WebProNews reported Windows 365 Cloud PCs for customers using Microsoft Purview Customer Key. Google Workspace users also reported trouble reaching their Google-hosted email through Outlook clients, according to SecurityWeek. The disruption even reached the connectors OpenAI and Anthropic use to reach Microsoft accounts, according to Reuters, and Anthropic said at 9:18 p.m. UTC that most email and calendar queries through its Microsoft 365 integration were still failing, according to CEO Magazine Poland.
By the evening the report counts were falling, but the outage was not over. Outlook reports stood at about 54,000 at 4:20 p.m. ET, 32,513 at 6:25 p.m. ET and more than 18,000 at about 11:30 p.m. ET, according to USA Today. Microsoft 365 reports fell from a peak above 47,000 to about 5,000 by the same late-night check.
How big was the outage, really?
Downdetector counts reports, not people, and Reuters itself cautioned that the actual number of affected users may vary. No confirmed count of affected users exists. The report counts are still the clearest measure of scale, and they tell a story of a sharp spike and a slow fall.
At about 1 p.m. ET, a single USA Today snapshot showed roughly 83,000 Outlook reports, 22,323 Microsoft 365 reports, about 2,000 Teams reports and about 4,400 Copilot reports, about 111,700 reports across Microsoft services. Under 30 minutes later, a single Reuters snapshot showed more than 130,000 Outlook reports, more than 46,000 Microsoft 365 reports and about 3,000 Teams reports, about 179,000 in total. The afternoon spike in the United Kingdom alone passed 5,000 reports by 5:40 p.m., according to BritBrief.
The impact reached beyond inboxes. In Southern California, NBC 4 Los Angeles reported that the Los Angeles County Sheriff’s Department and other government agencies had trouble with their communications services, and the Los Angeles County Medical Examiner’s Office said its email was down due to a nationwide Microsoft Outlook outage, according to USA Today. In Arapahoe County, Colorado, the sheriff’s office said online bond payments could not be processed because jail officials were not receiving the email notifications they need, so anyone posting bond had to do it in person, according to USA Today.
The outage also crossed into Friday in Asia and the Pacific. More than 5,500 Australian users reported Outlook problems on Friday at 9 a.m., and the Australian Federal Police, the Australian Security Intelligence Organisation and Queensland Health, which relies on Microsoft email for a 130,000-strong workforce, were all affected, according to AAP. In Singapore, Outlook reports stood at 250 at 7:05 a.m. on Friday, according to Channel News Asia. In India, Downdetector recorded a second spike on Friday morning, with 2,254 reports by 8:59 a.m. IST, above Thursday’s first spike of 2,162, according to Gadgets360. New Zealand organisations including the University of Auckland, Air New Zealand’s corporate offices, 2Degrees and New Zealand Police reported disruptions, and Hamilton City Council’s email was down with its e-services paused, according to NewsViews.
Mail itself was also delayed. Since about 5:30 p.m. UTC on November 12, Microsoft’s mail servers have answered a large share of delivery attempts to Outlook.com, Hotmail, Live, MSN and Office 365 recipients with temporary errors, according to SparkPost, which queues the messages and retries them automatically. The messages were queued for retry rather than rejected outright. Microsoft later extended the timeout window to 48 hours, and its final update confirmed the backlog has been processed.
What Microsoft said, and what it kept changing
Microsoft’s explanation changed through the day, and the changes are the story. At 1:43 p.m. ET the company said a portion of infrastructure was experiencing elevated load across multiple regions, which was likely contributing to the connectivity errors, according to Arbora Managed IT. At 2:43 p.m. ET the incident log said affected servers were failing automated health checks, possibly tied to a recent change to a component involved in processing those checks, according to WOM Technology. Microsoft’s word was “may”, a mechanism under investigation, not a confirmed cause.
At 4 p.m. ET Microsoft said it had validated an alternative way of checking server health, which let a subset of affected servers return to service, and it was applying the change more broadly, according to USA Today. By 5:11 p.m. ET the tone had turned: its actions so far “have not provided the relief it expected”, and its investigation had found a core process on the affected servers becoming overwhelmed, which makes the servers stop responding, according to On-Site Technology, which read the status page entry.
At 6:06 p.m. ET Microsoft reported improvements in some regions, with the restored servers operating stably so far, according to CEO Magazine Poland. Then came a setback. At 6:59 p.m. ET the company said servers returned to service “initially remain healthy” but “can become unresponsive again once they begin receiving traffic”, according to WebProNews. Engineers were analysing diagnostic data, temporarily limiting which types of traffic could reach the affected infrastructure in specific locations, and rebuilding a subset of servers with a previous software configuration.
Overnight the diagnosis moved again. Microsoft said a process on the affected servers responsible for establishing secure connections becomes overwhelmed, and it had begun reverting a recent network configuration change that correlates with the start of impact, according to the azureblog.co.uk live page, which quotes Microsoft’s service-health text verbatim. That reverses the company’s position at 7:57 p.m. UTC, when it said it had not identified any recent change correlated with the start of impact. Microsoft has since named the cause; the full post-incident report is still to come.
One thing Microsoft said from the start still matters. There is no evidence of a cyberattack: in an overnight service-health update Microsoft said there was “no indication this is the result of malicious activity”. The November Patch Tuesday updates came two days before the outage. According to SecurityWeek, they addressed 1,094 vulnerabilities, including an Outlook spoofing flaw attackers have exploited, and Microsoft’s service advisories have not linked the vulnerability to the Exchange Online outage.
What should I do if my Outlook mail is still late?
Service is restored, but delayed mail may still be arriving. Microsoft extended the email timeout window to 48 hours overnight so delayed messages would not expire before delivery, and its final update confirmed the backlog has been processed. If a message is still missing, check the usual places before assuming it is lost.
- Check Microsoft’s status page or its verified @MSFT365Status account for the final update before trying anything else.
- Do not reinstall or reconfigure Outlook, since the fault was on Microsoft’s side.
- Expect some inbound mail to arrive late even now, as the backlog clears.
- Treat any message claiming to be Microsoft support about the outage as suspicious, and verify it through official channels first.
- Ask your IT admin to check the Microsoft 365 admin center if your work email is affected.
What to watch next
Two things are still to come. The first is Microsoft’s full post-incident report, which the company promised once its review is complete. The second is whether the network configuration change Microsoft reverted fully explains why the servers went unavailable. The morning wave of reports, more than 2,100 by 9:30 a.m. ET, has never been reconciled with the afternoon spike, and Microsoft has not said whether the two are connected. And the separate Teams incident that morning, which ran from 9:45 to 10:53 a.m. ET and which Microsoft attributed to resource contention, is also unresolved: Microsoft has not indicated whether the two incidents are related, according to BleepingComputer.
Users should also expect scam attempts. McAfee warned that phishing lures impersonating Microsoft support are expected while users cannot reach Outlook, and users should check status only on Microsoft’s own status page or its verified @MSFT365Status account. In Australia, ING and the Customer Owned Banking Association warned customers that scammers would exploit the outage, including vishing calls, according to Australian Broker.
