Massive Microsoft 365 Outage Impacts Exchange Online, Teams, SharePoint, Copilot, and Defender XDR Users - CyberSecurityNews
A major Microsoft 365 outage disrupted cloud service access on November 12 and continued into November 13, 2026, as Microsoft worked to restore failing infrastructure.
Microsoft confirmed that connectivity problems could affect users in any region, expanding the scope beyond its initial investigation into Exchange Online mailbox access in the Americas. The reported impact spans Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR, although the exact service and feature restrictions remain subject to Microsoft's updated advisory.
We're investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas. More details can be found in the Microsoft 365 admin center under EX1550543.
Server Failures Complicate Recovery
Early findings pointed to heavy load across several regions. Microsoft later clarified that the pressure did not come from increased traffic. Instead, servers had unexpectedly become unavailable, leaving the remaining infrastructure to handle connections. Engineers began moving traffic across Microsoft's worldwide systems to reduce pressure on the affected environment.
Microsoft identified failed automated health checks as a key part of the current problem. These checks determine whether servers remain available to handle requests. Investigators focused on a component responsible for processing server health, while testing a configuration change and restarting affected servers to bring capacity back online.
According to Microsoft's official incident updates, an alternative health check method allowed some servers to return to service. Engineers began applying that approach more widely and preparing automated recovery systems to detect and restart unresponsive machines. However, these measures did not immediately deliver the expected improvement.
Security and Business Impact
For security teams, reported Defender XDR disruption raises questions about access to alerts and investigations. A previous Microsoft Defender portal access incident showed how dashboard availability can interrupt security workflows. However, portal access problems alone do not establish that endpoint protection or background detection has stopped working.
Administrators should follow EX1550543 and MO1550821 in the Microsoft 365 admin center and use Microsoft's public service status page when the admin center is unavailable. Microsoft's public updates describe infrastructure failures and recovery work, rather than presenting evidence of a confirmed cyberattack behind this disruption.
We've reviewed known impact scenarios and revised the list of impacted services and features, which can be viewed in the 'more info' section of the communication MO1550821 in the Microsoft 365 admin center.
Recovery Progress
Microsoft has reported further progress in restoring affected Microsoft 365 services, with recovery actions completed across portions of the impacted infrastructure and user traffic gradually being restored. The company confirmed improvements in key services, including Exchange Online mailbox access and delayed email processing, although some users may continue to experience intermittent disruptions.
Engineers are now expanding recovery measures to the remaining affected infrastructure while working to stabilize services and increase server capacity to ensure consistent performance. The company has extended the email timeout window to 48 hours to protect delayed messages while it continues processing mail queues and backlogs.
Microsoft has not yet confirmed full service restoration, with further updates available under incident ID MO1550821 in the Microsoft 365 admin center. The company is evaluating traffic throttling, protocol adjustments, and failover routing to increase frontend server capacity and improve stability.
Related
