Microsoft 365’s Outage Runs Into a Second Day: A Timeline of What Broke, What Microsoft Has Said, and What It Hasn’t
A Microsoft 365 disruption that began Thursday afternoon cut users off from Exchange Online mailboxes, Teams, SharePoint and more, and recovery was still under way Friday morning. Microsoft says it has seen no evidence of malicious activity. Here is the timeline so far.
For many businesses, Thursday afternoon brought a sudden silence: Outlook would not connect, Teams messages stalled, and shared files went out of reach. A wide Microsoft 365 disruption that started in the Americas spread to users in every region and was still not fully resolved on Friday morning. Here is how it unfolded, with all times in Eastern Time.
This timeline is drawn from BleepingComputer’s running coverage of the Microsoft 365 outage, SecurityWeek’s updates, and Microsoft’s public service status page.
Thursday, November 12
- 9:45 to 10:53 a.m. A separate Microsoft Teams incident, tracked as TM1550488, hits users in North and South America. Messages are delayed or fail, and chats will not load or update. Microsoft blames resource contention in its infrastructure and later marks the incident resolved. It has not said whether this incident is connected to what follows.
- Before the broader incident (time not given). Microsoft begins looking into reports that users in the Americas cannot connect to their Exchange Online mailboxes. That incident is tracked as EX1550543.
- 1:26 p.m. The broader incident, MO1550821, begins. Microsoft warns that customers may be unable to reach several services, including Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR. Outage reports spike on Downdetector, and the company later says users in any region could be affected.
- Afternoon. Microsoft first points to elevated load across several regions, then corrects itself. The load did not come from more traffic. A number of servers had unexpectedly gone offline, straining the rest. Microsoft pauses deployments, spreads connections across its global infrastructure and starts restarting affected servers.
- Just before 3 p.m. Per SecurityWeek, Microsoft says affected servers are failing automated health checks. It is testing a workaround that bypasses the component handling those checks and is also looking into high processor use.
- About 7 p.m. Microsoft reports limited recovery as some servers come back and stay stable. It says earlier recovery steps had not helped as expected. A core process on the affected servers was being overwhelmed, and the company is considering rolling back a small number of recent configuration changes.
- About 9 p.m. Microsoft says the overwhelmed process is one that sets up secure connections. It begins rolling back a recent network configuration change that coincided with the start of the trouble. Restarts show improvement, but full recovery is not confirmed.
Friday, November 13
- Overnight into the morning. Microsoft’s status updates say it has seen no evidence of malicious activity. It promises a full post-incident report with the root cause once the problem is fixed.
- Morning updates. Microsoft reports recovery work completed on parts of its infrastructure in the Asia Pacific region and says it is extending those steps to other regions. Some users may still see intermittent problems. To protect delayed mail, it has extended the email timeout window to 48 hours so that queued messages are held rather than dropped while delivery catches up.
- As of publication. Microsoft’s public status page still lists Microsoft 365 for business and enterprise as a service degradation.
What is still unknown
- The confirmed root cause. The configuration rollback is a lead Microsoft is testing, not a final explanation.
- Whether the morning Teams incident and the afternoon outage are related.
- When full service will return everywhere.
One side effect was reported by SecurityWeek: some Google Workspace users who read their mail in Outlook desktop or mobile apps also had trouble getting to it.
What this means for your company
Cloud services are very reliable, but “very reliable” still includes days like this one. A few steps make the next outage far less painful:
- Have a backup channel. Agree in advance how staff will reach each other and key customers if email and chat are down, whether by phone tree, text group or a secondary messaging tool, and keep a contact list that does not live only in the affected system.
- Know where to look. Make sure whoever handles IT knows how to check the official service health dashboard and public status page, so they do not waste hours troubleshooting a problem on your end that is really the provider’s.
- Don’t “fix” what isn’t broken. Rebuilding mail profiles, resetting passwords or reinstalling apps during a provider outage usually adds work later.
- Expect a backlog. With mail queued for up to 48 hours, messages may arrive late or out of order. Re-confirm anything time-sensitive, such as payments or contracts, by another channel.
- Stay alert. Treat unexpected “outage fix” emails, calls or login prompts with suspicion, and verify through a known contact.
If this outage exposed gaps in how your team keeps working when cloud tools go dark, we can help you plan for the next one. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
