Kiran 
A major Microsoft 365 outage began on November 12 and ran into November 13, 2026. Microsoft blamed failing server infrastructure, not a cyberattack, and had not confirmed full restoration in the latest updates available.
Microsoft first investigated reports of users in the Americas unable to reach Exchange Online mailboxes through multiple connection methods, tracked as EX1550543. It then confirmed the problem could affect Microsoft 365 connectivity for users in any region.
Reported impact covers Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR. The exact service and feature restrictions depend on Microsoft’s updated advisory under incident MO1550821, and Microsoft has not said every customer is affected.
Microsoft 365 Outage Disrupts Outlook
Microsoft initially said elevated load across multiple regions likely caused the connectivity errors. It later clarified that traffic had not increased. Several servers became unexpectedly unavailable, straining the remaining infrastructure. Engineers began redistributing connection traffic across Microsoft’s wider worldwide infrastructure.
Microsoft identified servers failing automated health checks and becoming unavailable. It tested a configuration change and restarted all affected servers. It said it had not found a recent change correlated with the start of impact. Its investigation pointed to a specific component that processes server health.
An alternative health check method let a subset of servers return to service, and Microsoft began applying it more broadly. It also prepared automated recovery systems to detect and restart unresponsive machines.
Those steps did not deliver the expected relief. Microsoft then found a core process on affected servers becoming overwhelmed, which caused further capacity loss. Some restored servers stayed stable at first. They later became unresponsive again once traffic reached them, and Microsoft was analyzing diagnostic data to find the trigger.
Engineers paused all deployments, moved traffic to alternate routes and assessed whether reverting a small number of recent configuration updates could speed recovery. That rollback is a recovery option, not proof of root cause. Microsoft was also temporarily limiting which types of traffic could reach the affected infrastructure.
In July 2026, a separate outage (MO1437424) hit Teams, SharePoint Online, OneDrive and Copilot Chat. It mainly affected traffic routed through North America. Microsoft linked that incident to a network configuration change and restored service after reverting it. Microsoft has not established the same cause for the current disruption.
Reported Defender XDR disruption raises questions about SOC access to alerts and investigations. A December 2025 Defender portal incident (DZ1191468) followed a traffic spike and blocked analysts from the security dashboard.
Reporting at the time said background protection such as Defender Antivirus likely kept running while administrative visibility was cut. Portal problems alone do not show that endpoint protection or backend detection stopped.
Guidance for Administrators
- Track EX1550543 and MO1550821 in the Microsoft 365 admin center.
- Use the public status page at status.cloud.microsoft if the admin center is unreachable.
- Treat partial recovery as unstable until Microsoft confirms sustained service, since restored servers have failed again under load.
- Document operational impact, including delayed mail, Teams disruption and gaps in security monitoring.
- Check Defender alert queues for gaps once access returns, and do not assume endpoint protection failed.
Microsoft’s public updates describe infrastructure failure and recovery work. They provide no evidence of a confirmed cyberattack and no firm completion time. Organizations should expect further advisory updates as engineers work to safely restore the remaining capacity.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Hari 
