Microsoft 365

Microsoft 365 suffered a widespread outage Thursday that extended into Friday, disrupting business email and other cloud services across multiple regions.

Microsoft initially reported that users in the Americas were having trouble connecting to Exchange Online mailboxes. It later identified potential disruption to Teams, SharePoint Online, Microsoft 365 Copilot, Defender XDR, and many other services.

The Cascade

The company traced the increased load on its infrastructure to a large number of servers becoming unavailable, leaving the remaining systems to handle the traffic. Notably, Microsoft said overall traffic had not increased.

So the load problem was supply-side, not demand-side. Fewer servers, same volume.

What Microsoft Said It Found

A process that establishes secure connections was becoming overwhelmed, causing affected servers to stop handling requests.

Microsoft began rolling back a recent network configuration change that coincided with the start of the disruption, and monitored whether the rollback helped.

The Timeline of Updates

Both incidents remained open on Microsoft's service health dashboard.

• EX1550543 - the Exchange Online incident
• MO1550821 - the broader Microsoft 365 incident

The Partial Functionality Detail

One point from Microsoft's guidance is worth understanding, because it explains why some things broke and others did not.

Features of many Microsoft 365 services that interact with Exchange Online and email services are impacted. Elements of those services that do not depend on interaction with Exchange Online remain functional.

That is why a SharePoint site might load fine while a Teams notification about an email fails. The dependency graph, not the service itself, determines what broke.

Was This a Cyberattack?

Microsoft says no.

"At this time, we have no evidence of malicious activity associated with this incident," the status page stated. "We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete."

That is the current position. Microsoft has not confirmed the root cause, so the post-incident report is the document to watch.

The Patch Tuesday Proximity

The disruption came two days after Microsoft released its November Patch Tuesday updates, which addressed 1,094 vulnerabilities across its products.

One of those was CVE-2026-124194, an Outlook spoofing flaw Microsoft says attackers have exploited. It can expose a user's authentication material if the user opens a specially crafted file in an affected Outlook client.

Microsoft's service advisories have not linked that vulnerability to the Exchange Online outage.

That proximity will invite speculation. There is currently nothing to support it beyond the calendar.

Google Workspace Users Were Affected Too

Some users of Google Workspace, formerly G Suite, reported trouble accessing their Google-hosted email through Outlook desktop and mobile email clients.

That detail points at the client or connection path rather than Google's infrastructure. Google Workspace itself was not reported as degraded. Outlook was the common component.

What Administrators Should Do

• Check the admin center, not social media. Track EX1550543 and MO1550821 in the Microsoft 365 admin center for authoritative status.
• Do not expect a clean cutover. Microsoft has confirmed signs of improvement from server restarts but has not confirmed full recovery. Plan for intermittent failures.
• Test the specific dependency paths. Email-dependent features in Teams, SharePoint, and Copilot will lag behind the recovery of the underlying services. Verify the workflows your users actually depend on.
• Hold non-critical changes. If Microsoft is still rolling back a network configuration change, adding your own network changes to the mix makes attribution harder for both parties.
• Prepare for the post-incident report. Microsoft has committed to publishing root cause and defense-in-depth actions. That document will be more useful than any status update.
• Separate the outage from the patching question. CVE-2026-124194 is a real, exploited Outlook flaw. Patch for it because it is exploited, not because the outage happened.
• Have a secondary access path. If Outlook connectivity is your only route to corporate mail, an outage like this becomes a productivity event. Consider what your fallback is.

FAQ

Is Microsoft 365 still down?

As of the latest update, Microsoft said restarting affected servers was showing signs of improvement, but it had not confirmed full recovery and was still monitoring stability.

What services were affected?

Exchange Online was the initial and primary disruption. Microsoft later identified potential impact to Teams, SharePoint Online, Microsoft 365 Copilot, Defender XDR, and other services.

What caused the outage?

Microsoft has not confirmed a root cause. It traced the problem to a large number of servers becoming unavailable while overall traffic stayed flat, and said a process establishing secure connections was being overwhelmed. It rolled back a recent network configuration change and was monitoring the result.

Was it a cyberattack?

Microsoft says there is no evidence of malicious activity associated with the incident. It has committed to publishing a full post-incident report after mitigation.

What are EX1550543 and MO1550821?

They are Microsoft's incident identifiers. EX1550543 tracks the Exchange Online disruption, and MO1550821 tracks the broader Microsoft 365 incident. Both are visible in the Microsoft 365 admin center.

Why did some Microsoft 365 features keep working?

Because Microsoft says features that interact with Exchange Online and email services are impacted, while elements that do not depend on that interaction remain functional.

Did this affect Google Workspace?

Some Google Workspace users reported trouble accessing their Google-hosted email through Outlook desktop and mobile clients. Google's infrastructure was not reported as degraded.

Is this connected to the November Patch Tuesday updates?

Microsoft has not linked the outage to those updates. The timing is two days apart, but no evidence connects them.

What is CVE-2026-124194?

An Outlook spoofing flaw Microsoft says has been exploited. It can expose a user's authentication material if they open a specially crafted file in an affected Outlook client.

When will the post-incident report be published?

Microsoft has not given a date. It said it will share the report with root cause and defense-in-depth actions after mitigation is complete.

Source: SecurityWeek