Microsoft rules out cyber attack and AI-related cause in roughly 24-hour Microsoft 365 outage

Microsoft ruled out a cyber attack and an AI-related cause for its roughly 24-hour Microsoft 365 outage, which began around 1 p.m. ET on Thursday, Nov. 12, 2026, and knocked out e-mail, calendars, Teams and OneDrive for businesses, schools and local governments across the US.

Charles Lamanna, a Microsoft executive, said late Thursday that there was no sign the outage came from malicious or cyber activity.

Microsoft said late Thursday that there was no sign the outage grew out of malicious or cyber activity, and by Nov. 13, 2026 it was unaware of any malicious activity behind the incident. The company ruled out an AI-related cause and found no evidence of malicious activity.

The outage affected Outlook, Teams, Microsoft 365, Copilot, OneDrive, Exchange Online, SharePoint Online, Microsoft Store, Microsoft Defender XDR, Planner, To Do, administrative tools and some SharePoint functions. Files stored directly in SharePoint remained accessible. Teams kept most calling and messaging functions running, though users could still run into errors when booking meetings, processing invitations or editing calendar entries. Outages affected some Teams contact and channel management features.

Exchange Online sat at the center of the incident, and users of Outlook on the web, desktop or mobile might not have been able to open mailboxes. Messages may have been delayed for affected users. Exchange accounts reached through clients besides Outlook, including Apple Mail, were also hit because the problem lay in Microsoft’s underlying infrastructure. Copilot conversations might have stopped working, and the assistant could have failed to get work email, calendars or files.

At 12:30 p.m. ET on Thursday, Nov. 12, 2026, Downdetector recorded concurrent reports across the US. The number reached roughly 120,000. Shortly after 1 p.m. Eastern on Nov. 12, 2026, Downdetector recorded nearly 130,000 Outlook reports. The Associated Press supplied the figure.

At 2:57 p.m. ET on Nov. 12, 2026, Downdetector showed more than 77,000 Outlook reports, down from a peak above 131,000. The disruption spread to at least 74 countries worldwide, and Japan confirmed a significant impact on government IT systems.

Microsoft tracked the issue as incident EX1550543 after users in the Americas reported trouble reaching Exchange Online mailboxes through multiple connection methods. Unexpectedly unavailable servers shifted load to remaining infrastructure, causing elevated load not driven by a traffic increase.

A configuration test and restarts of affected servers addressed automated health check failures. The company created and checked a different health check method, which let some affected servers return to service.

We've validated an alternative service health check method, which allowed a subset of affected servers to successfully return to service.

@MSFT365Status, Yahoo Tech

Microsoft halted all deployments and configuration changes while it reviewed recent changes for any link to the event. Microsoft is working on automated recovery systems. They will detect and restart servers that stop responding.

A 48-hour e-mail timeout window protected delayed messages. Repair work in Asia Pacific improved mailbox access and helped delayed e-mail messages move through the system. Microsoft added recovery capacity in more regions, though intermittent failures could persist.

Outlook began returning to normal operations on Friday morning, and Microsoft said service availability was improving. Even as operations resumed, some local services stayed unavailable. Some users still faced intermittent access issues or delayed e-mail delivery as recovery continued. Microsoft has not provided a deadline for full restoration.

Leaders in Miami, Maryland, and Los Angeles spoke to residents. They said some staff members or services stayed unavailable due to the outage. A detention facility in Arapahoe County, Colorado could not take online bond payments to release detainees because of the outage. People posting bond for immediate release went to the jail in person until Outlook e-mail returned.

The sheriff’s department in Los Angeles County warned that disruptions affected its e-mail and other communications platforms. Emergency management in Fredericksburg and Gillespie County, Texas could not receive e-mails and told residents and partners to call instead. The Washington Suburban Sanitary Commission warned that technicians may experience delays and customers may struggle with water bill payments.

During the lame duck session, congressional staffers continued to complain about the outage’s impact. Staffers told Politico that negotiating pending legislation and planning for the next Congress made the disruptions especially disruptive. Sharon Eliza Nichols, communications director for congresswoman Eleanor Holmes Norton of Washington DC, wrote:

Shall we start conducting all official business via DM?

Sharon Eliza Nichols, The Guardian

School districts in Richmond, Virginia, and Port Washington, New York told parents about outages and asked them to call or use other online learning platforms. The Albany school district said its services resumed. The Colorado School of Mines asked faculty to be flexible with deadlines and understanding of students who could not finish work because Microsoft tools were down. Many of its systems ran on unaffected platforms including Google Workspace and Canvas.

Claude said recovery from the Microsoft outage was starting to appear, but warned that some users might still receive errors. OpenAI said it was still investigating Microsoft connector issues that hurt performance. Workhorse Group, an industrial manufacturer, postponed a Thursday afternoon Q3 earnings call because of the outage.