Executive Summary
A Microsoft 365 outage on Thursday 12 November 2026 cut users off from Outlook, Teams and other services for hours. Microsoft said a number of servers failed automated health checks and dropped out of service which overloaded the rest. It tracks the incident as EX1550543 for Exchange Online and MO1550821 for the wider suite which also covers SharePoint Online, Copilot and Defender XDR. Early on Friday Swedish time Microsoft reported that some servers were back but could stop responding again under traffic. It has published no root cause and no time for full restoration. Its posts mention no attack. CERT-SE had published nothing on the outage as of 13 November.
Microsoft 365 Outage Began With Exchange Online Mailboxes
The trouble started around midday US Eastern time, early evening in Sweden. In its first post on X the Microsoft 365 Status account said it was “investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas”. That scope didn’t hold. Microsoft soon wrote that the issue “may affect Microsoft 365 service connectivity for users in any region”.
A second notice, MO1550821, listed Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365 and Microsoft Defender XDR as potentially affected. Defender XDR is Microsoft’s console for detecting and responding to attacks across email, endpoints and identities. Downdetector, which collects user reports, logged about 130,000 Outlook complaints at the peak. OpenAI and Anthropic each said their Microsoft 365 connectors were hit.
Microsoft’s notices address business and enterprise customers. The company hasn’t said whether consumer Outlook.com mailboxes were affected. A separate Teams incident in North America earlier the same day was resolved and Microsoft gave no word on whether the two were connected.
Failed Health Checks Took Servers Out of Service
Microsoft’s first explanation was elevated load on part of its infrastructure. It then corrected the picture. The load came from a number of servers being unexpectedly unavailable and straining the rest, the company wrote, not from any rise in traffic. A later post said engineers had “not identified any recent change correlated with the start of impact” and that the failed health checks “may originate from a specific component that’s responsible for processing server health”. They tested a configuration change, restarted servers and validated an alternative health check method that returned a subset of them to service.
It wasn’t enough. “We’re opening all available pathways to restore service, as our actions taken thus far have not provided the anticipated relief,” Microsoft said, adding that “a core process on affected servers is becoming overwhelmed, causing capacity loss”.
No root cause has been published.
Status on 13 November
By 00:35 UTC on 13 November Microsoft had said that servers brought back “initially remain healthy” but “can become unresponsive again once they begin receiving traffic”. Users may see a gradual recovery as their applications reconnect. Microsoft’s posts on the Microsoft 365 outage mention no attack and no link to the security updates it released on 10 November. Administrators are pointed to EX1550543 and MO1550821 in the Microsoft 365 admin center or to status.cloud.microsoft if the admin center itself can’t be reached.
Second Capacity Failure in Microsoft 365 This Year
This is the second time in 2026 that lost server capacity has taken down several Microsoft 365 services at once. On 22 January Microsoft reported that part of its North American infrastructure was not processing traffic as expected. That incident, MO1221364, was declared resolved the next day. The November notice lists Defender XDR among the affected services. The outage therefore reached security monitoring as well as mail. Swedish operators covered by the Cybersecurity Act (2025:1506) must send an early warning within 24 hours of a significant incident. Whether a supplier outage on a Thursday evening met that bar is for each operator to assess.
References
- Microsoft 365 Status, post on unavailable servers, 12 November 2026
- Microsoft 365 Status, post on failed health checks, 12 November 2026
- Microsoft 365 Status, post on overwhelmed core process, 12 November 2026
- Microsoft 365 Service Health Status
- Microsoft 365 Status, incident MO1221364, 22 January 2026
- Incidentrapportering enligt cybersäkerhetslagen
This post is also available in:
Svenska
