Microsoft 365 services are now mostly operational following a global outage that left users without access for more than 24 hours. By 6:00 p.m. UTC on Friday, November 13, the company announced significant progress in restoring functionality, though some issues persist with Exchange Online. Recovery efforts proceeded cautiously to prevent further instability, with Microsoft confirming the disruption originated from a flaw in a recent network update.
The outage was triggered by a network modification that exposed problems in an earlier capacity expansion. Microsoft ruled out any involvement of cyberattack or AI-related failures, but the incident caused widespread service interruptions. Beyond email delays and login difficulties, users also reported problems accessing Microsoft 365 Admin Center dashboards, Copilot 365 Chat responses, and Intune device management policies. Some applications, including Word and Excel, failed to load recently opened files, while Teams and Purview features experienced sporadic failures.
An update at 8:00 p.m. UTC clarified that while sign-in problems were easing, mail processing and message delivery remained delayed. Microsoft said that infrastructure stabilizes, they are still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes.
Security experts have highlighted growing risks during the outage. Matt Hull, vice president of cyber intelligence at NCC Group, cautioned that attackers could take advantage of the confusion to launch phishing campaigns. He urged organizations to verify any unusual requests, such as password resets or multi-factor authentication prompts, before approving them. Impersonation attacks posing as Microsoft or IT support teams represent a particular threat.
Microsoft has promised a full post-incident report once its review is complete, and said in its status update, “We are deeply sorry for the disruption this incident has caused you and your business.”
