AW Dev Rethought Flash: Outlook and Microsoft 365 Down Into a Second Day, With No Root Cause Yet

Microsoft 365 started failing on the evening of Thursday 12 November UTC, which was late Thursday night in India. About twenty hours later it still hadn't fully recovered.

Outlook reports on Downdetector peaked above 131,000. Microsoft says recovery is progressing in North America and across much of Europe. It has not confirmed a root cause.

What Is Down

The trouble began with Exchange Online. Users in the Americas couldn't connect to their mailboxes, and Outlook stopped sending and receiving.

Microsoft then widened the warning. Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR could all be affected, and users in any region might see problems. Some Google Workspace users were caught too, because they read Gmail through Outlook's desktop and mobile apps.

Microsoft is tracking it under two incident IDs: EX1550543 for Exchange Online and MO1550821 for the wider Microsoft 365 disruption. Admins can follow both in the Microsoft 365 admin centre.

What Microsoft Has Said

The explanation has become more specific over two days, but it is still not a root cause.

First, a large number of servers became "unexpectedly unavailable." The servers that were left had to carry everyone's traffic and were overloaded. Microsoft was clear that traffic itself had not increased.

Next, Microsoft said the unavailable servers were failing automated health checks, and suspected the component that processes those checks.

Its latest finding goes a level deeper. A process on the affected servers that sets up secure connections was being overwhelmed, and the servers stopped handling requests.

Microsoft is also rolling back a recent network configuration change whose timing matched the start of the outage. It has not said that change was the cause. The confirmed root cause is promised in a post-incident report.

Microsoft knows which process failed on those servers. It has not said what overwhelmed it.

On the question everyone asks first: Microsoft says it has found no malicious activity "as of now."

Why the Fix Kept Slipping

The recovery has been slow for a reason that anyone who runs services at scale will recognise.

Microsoft restarted servers and returned them to service. It also warned that those servers might "become unresponsive again once they receive traffic." Some did. At one point the company said its efforts "have not provided the anticipated relief."

This is the usual shape of a capacity collapse, described in general terms. When a large share of a fleet drops out, the demand doesn't go away. Each server that comes back is hit with far more than its normal share, because so few others are up. It overloads and drops out again.

Getting out of that loop means bringing capacity back faster than the load can knock it down. Microsoft's steps fit that pattern:

• It paused deployments.
• It moved traffic away from affected infrastructure and limited which traffic could reach some locations.
• It validated an alternative health check method so healthy servers stopped being rejected.
• It patched an upstream authentication and routing configuration component, and reported "positive results for server stability."
• It is rolling that patch out in stages, starting with regions entering business hours.

By Friday, Microsoft's updates moved from "early stabilization" to "encouraging recovery progress" at 13:29 UTC.

This Is Not the Outlook Zero-Day

Two Outlook stories landed in the same week, and they are being confused.

On Tuesday, Microsoft patched CVE-2026-124194, an Outlook flaw that attackers are actively exploiting to steal NTLM hashes. On Thursday, Outlook went down.

Microsoft has not linked the two. Its service advisories don't mention the vulnerability, and it reports no sign of an attack. The only connection anyone has shown is that they happened two days apart.

Keep them separate in your own planning. The outage will end without any action from you. The vulnerability needs the patch.

What To Do While It Recovers

Your email is delayed, not lost. Microsoft extended the delivery timeout to 48 hours, so messages held up during the outage should still arrive. Don't resend everything. The duplicates will all land at once when the queue drains.

Expect it to come and go. Microsoft has warned that intermittent problems are possible while capacity returns. A mailbox that works at noon may fail again at one.

Use another channel for anything urgent. If a message can't wait, phone the person or use a tool that doesn't run on Microsoft 365.

Check the incident IDs before you troubleshoot. If EX1550543 or MO1550821 is still open, the problem is very likely Microsoft's. Reinstalling Outlook or resetting profiles won't help.

Still install Tuesday's patch. The outage is no reason to put off CVE-2026-124194.

When Microsoft publishes its post-incident report, look for two answers: what overwhelmed the secure-connection process, and whether that rolled-back network change started it.