Microsoft 365 Outage Knocks Out Outlook, Teams and Copilot Worldwide as Servers Fail and First Fixes Fall Short

Microsoft 365 went down for users around the world on Thursday, November 12, 2026, knocking out Outlook email, Teams calls and messages, SharePoint files and the company’s Copilot artificial intelligence assistant in a single afternoon of failures. Microsoft said a large number of its own servers had unexpectedly become unavailable, and by the evening it admitted that its first attempts to fix the problem had not given the relief it expected. Outage trackers logged more than 130,000 reports about Outlook alone at the peak of the disruption, and the company had still not declared the incident over by late Thursday night. The failure reached beyond Microsoft’s own products, breaking the connectors that OpenAI and Anthropic use to reach Microsoft accounts, and it left offices, schools and hospitals scrambling for workarounds on an ordinary working day. This is the story of what failed, when it failed, what Microsoft said caused it, and what is still unknown, reported here as the Microsoft 365 outage November 2026 Outlook Teams Copilot story.

1. What Went Down

The outage did not arrive all at once. It built up across the working day in the United States, starting with a smaller failure in the morning and turning into a worldwide disruption by the early afternoon. Microsoft’s own incident records show three separate entries for the day, and the first of them was not the one that caused the most damage. The morning problem was limited to Teams in the Americas. The afternoon problem was different in kind: it touched the mailboxes at the heart of Microsoft 365, and from there it spread to almost everything the suite offers.

For the people affected, the experience was the same in offices from New York to London. Email stopped arriving. Messages would not send. Calls would not connect. Files stored in the cloud would not open. The tools that millions of workers treat as the basic plumbing of the working day were simply not there, and there was no warning before they went away.

Microsoft posts its updates through the Microsoft 365 Status account on X and through its service health pages, and it was through those channels that administrators first learned how wide the failure was. The company began the day treating the problem as a regional Teams issue. By the afternoon it was telling users in any region that they could be affected, and by the evening it was talking about servers that kept failing even after they had been brought back.

1.1 The Morning Started With Teams

The first sign of trouble came in the morning in the Americas. Microsoft recorded a Teams incident, tracked as TM1550488, that affected users in North and South America from 9:45 a.m. to 10:53 a.m. Eastern Time. Teams is the company’s chat and video meeting service, and for many workplaces it is the first tool opened in the morning, before email and before the calendar. When it stopped working, meetings did not start, messages did not arrive, and people who were working from home found themselves cut off from their colleagues.

At the time, the morning failure looked like an ordinary, limited incident. Services fail from time to time, and a regional Teams problem in the morning is the kind of thing that is usually fixed within the hour. Microsoft worked on it, and by late morning the Teams incident had run its course. But the day was not finished. Within an hour of the Teams problem ending, a bigger failure was beginning, and this time it would not stay in one region or in one product.

The morning incident matters because it shows that the day was already unstable before the main failure began. Microsoft has not said whether the two incidents were connected, and there is no public evidence that they were. What is known is the sequence: a Teams failure in the Americas in the morning, then an Exchange Online failure before midday, then a suite-wide advisory in the early afternoon. The day moved from one incident to the next without a clear break, and by the time most workers in the eastern United States were returning from lunch, the outage was everywhere.

For administrators, the morning Teams incident was a warning that was easy to miss. Many will have seen the alert, noted that it had been resolved, and moved on. The people who run Microsoft 365 for their companies had no reason to expect that the same day would bring the worst outage of the year. The morning failure was over. The afternoon failure was only beginning.

1.2 The Afternoon Collapse

Microsoft dates the start of the main incident to 11:17 a.m. Eastern Time, when users began having trouble reaching their mailboxes. The incident, tracked as EX1550543, covered Exchange Online, the service that holds Microsoft 365 email. People trying to open Outlook on the web, on their desktop computers or on their phones found that their mailboxes would not connect. Some could still read mail that was already downloaded to their devices, but nothing new arrived, and nothing they wrote would go out.

At 1:26 p.m. Eastern Time, Microsoft widened the incident. It opened a broader advisory, MO1550821, saying that users might be unable to connect to Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR. The language was careful, as service notices usually are, but the meaning was plain: this was no longer a mailbox problem. It was a Microsoft 365 problem, and it could reach users in any region.

By early afternoon, the reports were coming in from around the world. Downdetector, the outage tracking service that counts user-submitted problem reports, logged more than 97,000 reports about Outlook at 2:07 p.m. Eastern Time, and more than 38,000 about Microsoft 365. The numbers kept climbing, and by the peak of the afternoon the Outlook reports had passed 130,000. Reports also spread to OneDrive, Copilot and Azure, according to the technology press, and the company’s own status page listed Microsoft 365 as a service degradation, warning that users might be unable to connect to multiple services.

The afternoon collapse was fast, and that speed is part of what made it so disruptive. There was no gradual decline that gave people time to prepare. One moment the tools were working, and the next they were not. Emails that had been sent sat unsent. Meetings that were about to start could not start. Documents that people needed for the afternoon’s work were locked inside a service that would not answer. The working day did not slow down. It stopped, and it stopped for a very large number of people at the same time.

2. Which Services Stopped Working

The list of affected services was long, and it grew as the day went on. Microsoft’s first advisory named five services. Later notices, and the company’s own service health pages, named many more. The breadth of the list is what turned a bad afternoon into a serious incident: this was not one product failing, but the shared infrastructure underneath a whole suite of products failing at once.

That shared infrastructure is the point. Microsoft 365 is not a collection of separate tools that happen to share a name. Outlook, Teams, SharePoint and Copilot all run on the same cloud platform, and they share the systems that check whether a user is who they say they are, that route requests to the right server, and that keep track of where each person’s data lives. When the servers underneath that platform began to fail, the failure showed up in every product at once, and fixing one product did not fix the others.

For the people trying to work through the outage, the practical effect was that there was no easy substitute inside the Microsoft world. If Outlook was down, Teams was often down too. If Teams was down, SharePoint was often down as well. The tools that were supposed to back each other up were all drawing on the same failing infrastructure, and so they failed together.

2.1 Email First

Email was the first thing to fail, and it was the failure that most people noticed first. Microsoft’s Exchange Online incident, EX1550543, covered mailbox access through Outlook on the web, through Outlook on the desktop using the MAPI protocol, through mobile mail apps using Exchange ActiveSync, and through the programming interface that other software uses to reach mailboxes. In practice, that meant almost every way of reaching a Microsoft 365 mailbox was affected.

The one exception was mail that was already stored on a person’s own device. If Outlook had downloaded messages before the outage began, those messages could still be read. Nothing new could arrive, and nothing written during the outage could be sent. For people who were waiting for a contract, a decision or a reply from a client, the silence was the problem. There was no error message that explained what was happening, only a mailbox that would not refresh and a send button that did nothing.

Email is the oldest of Microsoft’s cloud services, and it is also the one that most businesses depend on most heavily. A company can survive for an afternoon without a video meeting, but it cannot easily survive without email. Contracts are signed by email. Invoices are sent by email. Customers write in by email, and suppliers confirm deliveries by email. When email stops, the flow of business stops with it, and the longer it stays stopped, the more work piles up behind it.

By the evening, the reports of Outlook problems had fallen from their peak, which suggested that some mailboxes were coming back. But Microsoft had not declared the incident over, and the company was still warning that servers it had returned to service could stop responding again once traffic reached them. For the people waiting on email, the afternoon ended with a question rather than an answer: would the inbox work in the morning, or would the problem still be there?

2.2 Beyond Email

Once the mailbox failure had spread, the list of affected services kept growing. Microsoft’s advisory MO1550821 named Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR. Later reporting, drawing on Microsoft’s own service health pages, added Microsoft Planner, Microsoft To Do, Microsoft Intune, Microsoft Defender for Office 365, several Microsoft Purview services, part of Power BI, parts of the Microsoft 365 Apps admin center, Universal Print and Windows 365 Cloud PCs that use Customer Key.

SharePoint matters because it is where many companies keep their documents. When SharePoint stopped responding, files that teams share and edit together became unreachable. People who needed a presentation for a meeting, a spreadsheet for a report or a contract for a signature could not open them. The files were not lost, as far as anyone knows, but they were out of reach, and for the hours of the outage that was almost as bad.

Teams mattered because it is where meetings happen and where quick conversations take place. After the morning’s regional incident, Teams was hit again as part of the wider failure, and this time the problem was not limited to the Americas. People who had moved their meetings to Teams because email was down found that Teams was down too, and the fallback plans ran out quickly.

Microsoft 365 Copilot, the company’s artificial intelligence assistant, was also listed as affected. Copilot is built into Word, Excel, Outlook and Teams, and it answers questions, drafts text and summarises meetings by reaching into a user’s mailbox and documents. When the services underneath it stopped responding, Copilot stopped with them. The security services were affected as well: Defender XDR, the system that watches for threats across a company’s devices and email, was named in the advisory, and so were Intune, which manages company devices, and the Purview services that handle compliance and data protection. The outage did not just stop people working. It also weakened the tools that watch over their work.

3. The Scale of the Disruption

It is hard to say exactly how many people were affected, because Microsoft has not published a number, and the company may never publish one. What is known is that the reports were very large, that they came from many countries, and that they covered the most widely used business tools in the world. Microsoft 365 is used by hundreds of millions of people, and on a normal working day Outlook and Teams are open on screens in almost every large office. An outage that touches those tools touches a very large share of the working world.

The numbers that do exist come from Downdetector, which counts the problem reports that users submit to it. Those numbers are not a count of affected users, and they should not be read as one. A single person can submit more than one report, and many affected people never submit any report at all. But the numbers are a useful measure of how widely the failure was felt, and how quickly it was felt, and on both counts the numbers were very large.

The other measure of scale is the geography. Microsoft said users in any region could be affected, and the reports bore that out. The outage was reported across the Americas and in Europe, and the company’s own notices spoke of infrastructure in several regions. This was not a failure in one data centre. It was a failure that crossed regions, and that is one of the reasons it took so long to fix.

3.1 What Downdetector Showed

Downdetector logged more than 97,000 reports about Outlook at 2:07 p.m. Eastern Time on Thursday, and more than 38,000 reports about Microsoft 365. About 4,500 reports concerned Teams. Those were the numbers at a single moment in the early afternoon, and they kept rising. By the peak of the outage, the Outlook reports had passed 130,000, according to CNBC, and the Microsoft 365 reports had passed 38,000. The peak for Outlook was the highest that many people tracking the outage had seen for a single Microsoft service.

By 6 p.m. Eastern Time, the reports about Outlook had fallen to about 34,500, which suggested that some users were getting back in. The fall was real, but it was not the same as a recovery. Microsoft had not declared the incident over, and the company was still warning that servers could fail again once traffic returned. A falling number of reports can mean that a service is coming back, but it can also mean that people have stopped reporting a problem they have already reported, or that they have given up trying for the day and gone home.

The Downdetector numbers also showed something about which services people noticed first. Outlook dominated the reports, which is what would be expected when email is the first thing to fail and the thing most people check first. Teams had far fewer reports, partly because the morning’s Teams incident had already passed and partly because many people discovered the Teams failure only after they had already discovered the email failure. The numbers are a rough map of the outage, not a precise one, but they show a failure that peaked in the middle of the American working afternoon and was still being felt into the evening.

It is worth remembering what Downdetector is. It is a website that collects reports from users, and it is not owned by Microsoft. Its numbers are not official, and Microsoft has not confirmed them. But they are the best public measure of how widely an outage is felt, and they are the numbers that journalists, administrators and ordinary users turn to when a service goes down and the company has not yet said how big the problem is. On Thursday, those numbers told a clear story: this was not a small failure, and it was not a local one.

3.2 Offices, Schools and Hospitals

The people who felt the outage most directly were the people whose working day runs on Microsoft 365. In offices, that meant email that would not arrive and meetings that would not start. In schools, it meant lessons that depended on Teams and SharePoint could not go ahead as planned. In hospitals and clinics, it meant staff who use Outlook to coordinate care and Teams to consult with colleagues had to find other ways to reach each other. The outage did not choose its victims. It hit whoever happened to be using the tools at the time, and that was a very large number of people.

For office workers, the practical effect was a day of improvisation. People switched to personal email accounts, to phone calls, to text messages and to whatever other tools they had available. Some of those workarounds worked. Many did not, because the people they needed to reach were also offline, or because the documents they needed were locked inside SharePoint. The work did not disappear. It waited, and it piled up, and the people who would have to deal with it in the morning were the same people who had spent the afternoon trying to work around it.

For the companies that run Microsoft 365, the outage was a reminder of how much of their working day depends on a single supplier. A business that uses Microsoft for email, for meetings, for documents and for security has put a very large part of its daily operation into one company’s hands. When that company’s services fail, the business has few alternatives, because the alternatives are the very services that have failed. The outage was a test of that dependence, and for many businesses the test was not passed comfortably.

There is also a human side to an outage like this one. People who work from home lost their connection to their colleagues. People who were travelling could not reach their offices. People who were waiting for news, for a job offer, for a medical result or for a decision that would change their day, waited without knowing whether the silence meant that nothing had arrived or that everything had arrived and could not be delivered. The outage was a technical failure, but it was felt as a personal one, by people who had done nothing wrong and who had no way to fix it.

4. What Microsoft Said Caused It

Microsoft’s explanation for the outage changed during the day, and the change itself is part of the story. At first, the company blamed heavy workloads across several regions, suggesting that too much demand was overwhelming its infrastructure. Later, it corrected itself. The problem was not that too many people were using the services. The problem was that too many of the company’s own servers had stopped working, and the servers that were left were carrying more than they could handle.

The correction matters, because the two explanations point in different directions. If the problem had been too much demand, the answer would have been to add capacity, and the failure would have been a sign that Microsoft had underestimated how much its customers needed. If the problem was that servers were failing on their own, the answer is different and harder: something was making healthy servers stop responding, and until that something is found and fixed, bringing servers back is only a temporary repair.

Microsoft has not yet published a full root cause, and it may be some time before it does. The company’s public statements so far describe what was happening, rather than why it was happening, and they describe the steps being taken to restore service rather than the fault that made restoration necessary. That is normal in the middle of an incident. The full explanation usually comes later, in a report that is published after the service is stable. For now, the cause is described in outline, and the outline is that servers failed, and the failure spread.

4.1 Servers Going Dark

Microsoft said the outage came from a large number of servers becoming unexpectedly unavailable. The company’s own words, published in its service health notices, were that it had determined the elevated load was not driven by an increase in traffic, but by a number of servers being unexpectedly unavailable, and that the remaining infrastructure was being strained by the extra work it had to carry. In plain language, servers were going dark without warning, and the servers that stayed up had to do the work of the ones that had gone down.

The company also said that servers were failing automated health checks and dropping out of service. A health check is a routine test that a system runs on itself to confirm that it is working properly. When a server fails a health check, it is taken out of service so that it cannot serve users badly. That is a safety mechanism, and it is supposed to protect users. But when many servers fail their health checks at the same time, the safety mechanism becomes part of the problem, because the pool of working servers shrinks faster than it can be refilled.

Microsoft said it was working to return the failed servers to service safely, and that it had begun doing so during the afternoon. Some servers did come back. But the company also warned that servers it had returned to service could stop responding again once traffic reached them, which suggested that the underlying problem had not been fixed. A server that comes back and then fails again is not a repaired server. It is a server that is still affected by whatever made it fail in the first place.

What made the servers fail is still unknown. Microsoft has not said whether the fault was in software, in hardware, in a configuration change or in something else entirely. The company has said only that the servers were unexpectedly unavailable, and that the load on the remaining infrastructure was the result of that unavailability rather than the cause of it. The distinction is important, and it is the clearest thing Microsoft has said about the cause so far.

4.2 Not a Traffic Surge

The first explanation Microsoft offered was that the problem was caused by heavy demand. The company initially blamed high infrastructure demand across several regions, which would have meant that too many people were trying to use the services at the same time. That explanation was later withdrawn. Microsoft found that increased traffic was not the cause, and it said so in its updated notices.

The correction is worth noting, because it rules out the simplest explanation and leaves a harder one in its place. A traffic surge is an external problem: too many users, too much demand, a system that cannot keep up. A server failure that happens without a traffic surge is an internal problem: something inside the system is making servers stop, and that something needs to be found. The first explanation suggested that the system was overwhelmed. The second suggests that the system was failing from within.

There was no obvious event on Thursday that would have caused a surge in demand. There was no major product launch, no widely reported news event that would have driven millions of extra people onto Microsoft’s services at the same time. The absence of a surge is consistent with what Microsoft eventually said, and it is also consistent with the pattern of the outage, which began in the morning, grew in the afternoon and persisted into the evening without any single moment of peak demand to explain it.

For the people trying to understand the outage, the correction also matters because it affects what happens next. If the cause had been a traffic surge, the fix would have been more capacity, and the lesson would have been about planning. If the cause is servers failing on their own, the fix is to find out why they failed, and the lesson is about the reliability of the systems that are supposed to keep them running. Microsoft has not yet said which of those lessons it has learned, because it has not yet said why the servers failed.

5. The Fixes That Did Not Work

The most striking part of Microsoft’s public updates on Thursday was not the description of the failure, but the admission that the fixes were not working. Companies rarely say that in public, and they rarely say it in the middle of an incident. Microsoft said it at 5 p.m. Eastern Time, and the admission told the people waiting for their email to come back that the problem was worse than it had looked a few hours earlier.

The admission came after a day of repair attempts that had shown early promise and then faded. A new method of checking whether servers were healthy had brought some servers back into service in the afternoon. For a short time, it looked as though the recovery was under way. Then the servers began to fail again, and Microsoft had to tell its users that the actions it had taken so far had not provided the relief it had expected. The outage was not a problem that could be fixed by restarting a few machines. It was a problem that kept coming back.

For the administrators who were watching the service health pages, the 5 p.m. update was the moment the day changed from an inconvenience into a serious incident. An outage that lasts a few hours is a bad day. An outage in which the company’s own fixes do not work is a different kind of event, because it means that the company does not yet fully understand what is wrong. Until it does, there is no reliable timetable for recovery, and no promise that the service will stay up once it comes back.

5.1 The First Repair Attempts

Microsoft’s first response was to pause all deployments and to redistribute connection traffic across its worldwide infrastructure. Pausing deployments means stopping any changes that were being rolled out to the company’s systems, so that nothing new could make the problem worse. Redistributing traffic means moving users away from the servers that had failed and towards the servers that were still working. Both are standard steps in an incident, and both are usually effective. On Thursday, they were not enough.

The company also began returning servers to service. By 3:30 p.m. Eastern Time, it was restarting servers and restoring service, according to the reporting of the day, and a new health check method brought some servers back around 4 p.m. Eastern Time. For a while, the recovery seemed to be working. The number of problem reports on Downdetector began to fall, and some users found that their email was working again. The improvement was real, but it did not last.

Microsoft also moved additional traffic away from the affected systems, trying to give the remaining infrastructure room to breathe. The idea was simple: if the servers that were still working were being overloaded by the work of the servers that had failed, then moving some of that work elsewhere would help them cope. The company has data centres around the world, and it has the ability to shift traffic between them. That ability is one of the reasons cloud services are supposed to be resilient. On Thursday, it was tested, and it was not enough on its own.

The first repair attempts were not wasted. They brought some service back, and they gave Microsoft information about what was and was not working. But they did not solve the problem, and by the evening the company was saying so in public. The servers that had been brought back were failing again, and the recovery was not holding. The first attempts had shown what did not work. The next attempts would have to be different.

5.2 An Overwhelmed Core Process

At 5 p.m. Eastern Time, Microsoft gave a more specific account of what was happening inside the affected servers. It said that a core process on the affected servers was becoming overwhelmed and making them stop responding, and that it was isolating a portion of its infrastructure to validate a recovery approach before applying it elsewhere. The language was technical, but the meaning was clear enough: something at the heart of the servers was being overloaded, and the overload was stopping them from working.

A core process is one of the basic programs that a server runs in order to do its job. It is not an optional extra. It is the software that handles the work the server exists to do, and if it becomes overwhelmed, the server cannot do that work. Microsoft did not say what the process was, or why it was becoming overwhelmed, or what had changed to make it overwhelmed on Thursday when it had not been overwhelmed on Wednesday. Those details were not in the public update, and they may not be known even inside Microsoft yet.

The decision to isolate a portion of the infrastructure and test a recovery approach there before applying it more widely was a careful one. It meant that Microsoft was not going to apply an untested fix to the whole system at once, because an untested fix could make things worse. Instead, it would try the fix on a small part of the system, watch what happened, and then decide whether to use it everywhere. That is a sensible way to proceed when the cause of a failure is not fully understood, but it is also a slow way to proceed, and it meant that full recovery would take longer.

As of 7:08 p.m. Eastern Time, Microsoft was still describing the incident as a service degradation, with no estimated time for full recovery. The company said that servers it returned to service could stop responding again once traffic reached them, which was a warning that the recovery was fragile. The core process was still overwhelmed, the fix was still being validated, and the people waiting for their email were still waiting.

6. The AI Knock-On Effect

The outage did not stop at Microsoft’s own products. It reached the artificial intelligence services that depend on Microsoft’s infrastructure, and in doing so it showed how deeply the company’s cloud is woven into the wider technology industry. OpenAI and Anthropic, two of the most prominent AI companies in the world, both reported problems with the connectors they use to reach Microsoft 365 accounts, and those problems were caused by the same outage that had knocked out Outlook and Teams.

A connector is a piece of software that lets one service reach into another. OpenAI’s and Anthropic’s connectors let their AI assistants read a user’s email, calendar and documents in Microsoft 365, so that the assistant can answer questions and do work on the user’s behalf. When Microsoft 365 stopped responding, the connectors could not reach the data they needed, and the AI services that depended on them stopped working properly. The failure of one company’s cloud had become a failure of several companies’ products.

The knock-on effect matters because it shows how concentrated the technology industry has become. A small number of companies provide the cloud infrastructure that almost everything else runs on, and when one of them fails, the failure spreads far beyond its own customers. The people who were affected by the Microsoft outage included people who had never bought anything from Microsoft, but who used an AI service that happened to depend on Microsoft’s cloud.

6.1 OpenAI and Anthropic Hit Too

OpenAI reported problems with its Microsoft connectors, saying that new connections might fail and that its tools might not work properly. Anthropic also reported an issue with its Microsoft 365 connector, caused by a problem at an upstream provider. Both companies were careful to say that the problem was not in their own systems, but in the Microsoft services they depended on. The distinction mattered to their users, but it did not change the experience: the AI assistant that was supposed to help with email and documents could not reach them.

Reuters reported that the disruption hit the connectors that OpenAI’s and Anthropic’s AI services use to reach Microsoft accounts, and the report was picked up widely because it showed the outage reaching beyond Microsoft’s own brand. A person using ChatGPT to summarise their inbox, or using Claude to draft a reply to an email, would have found that the assistant could not do the job, not because the assistant had failed, but because the inbox it needed to read was unreachable.

The effect on the AI companies was a reminder that the new generation of AI products is built on top of the old generation of cloud products, and that it inherits their weaknesses as well as their strengths. An AI assistant is only as reliable as the services it connects to, and on Thursday those services were not reliable. The companies that build AI assistants can test their own software, but they cannot test the cloud that it runs on, because that cloud belongs to someone else.

There is a wider point here, and it is about the shape of the technology industry. The companies that make AI assistants are some of the most valuable in the world, and they present themselves as independent. But their products depend on infrastructure owned by a handful of cloud providers, and when one of those providers fails, the independence disappears. The outage was a Microsoft failure, but it was felt by the customers of other companies too, and that is a measure of how much the industry depends on a small number of suppliers.

6.2 Copilot Down at the Worst Moment

Microsoft 365 Copilot was among the services listed as affected, and its failure was felt in a particular way. Copilot is the company’s AI assistant, and it is built into Word, Excel, Outlook and Teams. It drafts emails, summarises meetings, answers questions about documents and helps people find information in their own files. It is, in Microsoft’s own telling, the tool that makes the rest of the suite more productive. On Thursday, it was down at the same time as the tools it was supposed to make more productive.

The timing was unfortunate. Copilot is most useful when people are busy, and people were never busier than on the afternoon of the outage, when they were trying to work around the failure of their email and their meetings. An assistant that could have helped them catch up on missed messages, summarise the meetings they could not attend, or draft the emails they could not send was itself unavailable, because it depended on the same services that had failed. The tool that was supposed to help with the outage was a victim of the outage.

There is an irony in that, and it is worth noting. The technology industry has spent the last few years telling workers that AI assistants will make them more productive, and Microsoft has spent more than most on that message. Copilot is at the centre of the company’s strategy, and it is the product that Microsoft points to when it talks about the future of work. On the day that future was tested, the assistant was down, and the workers it was supposed to help were left to manage on their own.

The failure of Copilot does not mean that AI assistants are useless, and it does not mean that Microsoft’s strategy is wrong. It means that an assistant is only as reliable as the infrastructure it runs on, and that when the infrastructure fails, the assistant fails with it. The people who were affected by the outage will remember that Copilot was down, and they will remember it the next time someone tells them that an AI assistant will always be there to help. On Thursday, it was not.

7. Was It a Cyberattack?

When a service as large as Microsoft 365 goes down for a whole afternoon, the first question many people ask is whether someone attacked it. The question is natural. A failure that affects millions of people, that crosses regions, and that resists the company’s first attempts to fix it looks, from the outside, like the kind of damage a deliberate attack would cause. Microsoft has said nothing to support that idea, and the reporting so far points the other way. But the question was asked, and it deserves a careful answer.

The answer, on the evidence available on Thursday evening, is that there is no sign of a cyberattack. Microsoft has published no statement suggesting one, and the security press has reported that the company has disclosed no evidence of one. The cause that Microsoft has described, servers failing their health checks and dropping out of service, is a technical failure, and it is a kind of failure that can happen without any outside interference. That does not prove that there was no attack, but it does mean that there is no evidence for one, and that the explanation Microsoft has given does not require one.

It is important to be careful here, because the question of a cyberattack is the kind of question that can run ahead of the facts. A rumour that Microsoft was attacked would be widely shared, and it would be hard to correct once it had spread. The responsible thing is to report what Microsoft has said, to report what the security press has found, and to say plainly what is not known. What is known is that Microsoft has described a server failure. What is not known is the full root cause, and until that is published, the question will remain open in the minds of some people, even though the evidence points away from an attack.

7.1 What Microsoft Has Said

Microsoft has said that the outage came from a large number of its servers becoming unexpectedly unavailable, and that the elevated load on the remaining infrastructure was not driven by an increase in traffic. The company has not mentioned an attack, a breach, a hack or any outside interference in any of its public updates. Its service health notices describe a technical failure and a recovery effort, and they describe the steps being taken to return servers to service. There is nothing in those notices that points to a cyberattack.

SecurityWeek, a security news publication, reported that Microsoft had disclosed no evidence of a cyberattack, and that reporting was picked up by other outlets covering the outage. The absence of evidence is not the same as proof of absence, but in this case the absence is significant, because Microsoft has a strong incentive to say if it had been attacked, and because the company’s own description of the failure is consistent with a technical fault rather than an attack. A cyberattack that took down a large number of servers would leave traces, and Microsoft would be expected to say so.

The company’s first explanation, that the problem was caused by heavy demand, was wrong, and Microsoft corrected it. That correction is a reason to trust the company’s later statements, not a reason to doubt them. A company that is willing to admit in public that its first explanation was wrong is a company that is trying to tell the truth about what happened, even when the truth is embarrassing. The correction also shows that Microsoft’s understanding of the failure was developing during the day, and that its statements were being updated as new information came in.

For now, the official position is that this was a technical failure, not an attack. That position may change if new evidence appears, and it should be reported if it does. But on the evidence available on Thursday evening, there is no reason to believe that the outage was caused by anyone outside Microsoft, and there is every reason to believe that it was caused by something inside the company’s own systems.

7.2 Why People Asked

People asked whether it was a cyberattack for good reasons. Microsoft is a frequent target of attacks, and its services are used by governments, by banks, by hospitals and by the military, which makes it an attractive target for anyone who wants to cause disruption. The company’s own security services have reported attacks on its customers many times, and the idea that someone might attack Microsoft itself is not far-fetched. When a service that large goes down, the possibility of an attack is one of the first things that comes to mind.

There is also the scale and the stubbornness of the failure. A failure that affects millions of people, that crosses regions, and that resists the company’s first attempts to fix it looks like a deliberate attack, because deliberate attacks are designed to be hard to fix. A technical failure that is hard to fix can look the same, from the outside, as an attack that is hard to fix, and the people watching from the outside have no way to tell the difference. They can only ask, and wait for the company to answer.

The history of large outages also plays a part. In recent years, there have been outages caused by software updates, by configuration changes and by hardware failures, and there have been outages caused by attacks. The public has learned that a big outage can have many causes, and that the cause is not always clear in the first hours. The question of a cyberattack is a reasonable one to ask, and it is a question that should be asked, as long as it is asked carefully and answered with the evidence that is available.

The lesson of Thursday is that the question should be asked, but that it should not be answered before the facts are in. Microsoft has given an explanation, and that explanation does not involve an attack. The security press has found no evidence of an attack. Until new evidence appears, the responsible course is to report the technical explanation, to note that the full root cause has not yet been published, and to leave the question open without treating an unproven possibility as a fact.

8. What Comes Next

By late on Thursday night, Microsoft had not declared the incident over. The company’s service health pages still listed the Exchange Online incident and the broader Microsoft 365 advisory as service degradations, with no estimated time for full recovery and no published root cause. Some servers had been brought back, some users had got their email back, and the number of problem reports had fallen from its peak. But the recovery was fragile, and the company was still warning that servers could fail again once traffic reached them.

What comes next will happen in two stages. The first stage is the recovery itself, which will continue until Microsoft can say that the services are stable and that the risk of another failure has passed. The second stage is the explanation, which will come in a report that Microsoft publishes after the incident is over, setting out what went wrong, why it went wrong, and what the company will do to stop it happening again. The first stage matters to the people who use the services. The second stage matters to everyone who depends on them.

For the people who were affected, the immediate question is simple: will the services work in the morning? Microsoft has not given an answer to that question, and it may not be able to give one until the recovery is complete. The company has said that it is isolating part of its infrastructure to validate a recovery approach, which suggests that the recovery is being tested carefully before it is applied widely. That is the right way to proceed, but it is a slow way, and it means that the people who depend on Microsoft 365 may have to wait.

8.1 The Recovery Still Under Way

As of the evening of Thursday, November 12, the recovery was still under way. Microsoft said it had begun returning servers to service, and that a new health check method had brought some servers back in the afternoon. It also said that the fixes it had tried so far had not provided the relief it expected, and that a core process on the affected servers was becoming overwhelmed. The company was isolating a portion of its infrastructure to test a recovery approach, and it had not yet said whether that approach was working.

The recovery is complicated by the fact that the servers that come back can fail again. Microsoft warned that servers it returned to service could stop responding once traffic reached them, which means that the recovery is not a simple matter of restarting machines. Each server that comes back has to be watched, and if it fails again, it has to be taken out of service and tried again. That cycle takes time, and it means that the recovery will be gradual rather than sudden.

There is also the question of the emails and messages that were sent during the outage. Some of them will have been queued and will arrive once the services are back. Others may have been lost, or may arrive late, or may arrive twice. Microsoft has not said what will happen to the messages that were caught in the outage, and the people who sent them will have to check whether they arrived. The recovery of the services is one thing. The recovery of the work that was interrupted is another, and it will take longer.

For administrators, the recovery will also involve checking that nothing else was damaged. The outage affected security services as well as email and meetings, and the people who run those services will need to confirm that they are working properly again. They will also need to check that no data was lost, that no messages were delivered to the wrong people, and that the systems that protect their companies are back to full strength. The recovery is not over when the email comes back. It is over when everything that depends on the email is back as well.

8.2 The Bottom Line

The Microsoft 365 outage of November 12, 2026, was a reminder of how much of the working world depends on a small number of companies, and how quickly that dependence can become a problem. A failure in one company’s servers knocked out email, meetings, documents and AI assistants for users around the world, and it reached beyond Microsoft’s own customers to the AI services that depend on its cloud. The failure was not caused by a surge in demand, and there is no evidence that it was caused by an attack. It was caused, as far as Microsoft has said, by its own servers failing, and by the strain that failure put on the servers that were left.

Microsoft has not yet said why the servers failed, and it has not yet said when the services will be fully restored. It has said that its first fixes did not work, and that it is testing a recovery approach on part of its infrastructure before applying it more widely. Those are honest statements, and they are more useful than a false promise of a quick fix. But they are also a reminder that the company does not yet fully understand what went wrong, and that until it does, the recovery cannot be guaranteed.

The outage will be remembered, if it is remembered at all, as a bad day for Microsoft and for the millions of people who use its services. It will also be remembered, by the people who run those services for their companies, as a test of how much they depend on a single supplier, and of how little they can do when that supplier fails. The question that remains, after the email comes back and the meetings resume, is whether the companies that depend on Microsoft will change anything because of what happened on Thursday, or whether they will go back to work on Friday as if nothing had happened. The coming days will provide the answers.

Comments

comments