Microsoft says worldwide Microsoft 365 outage was not a cyber attack

Microsoft said a worldwide disruption affected Outlook, Teams, Copilot, Exchange Online and SharePoint Online, and began at 11:17 a.m. ET on Thursday and was not caused by a cyber attack.

The outage lasted more than 20 hours and stretched into Friday, Nov. 13, with recovery fixes remaining largely unsuccessful and intermittent access issues continuing. Microsoft extended the e-mail timeout window to 48 hours to preserve delayed messages during the event.

Microsoft cited high infrastructure stress after many servers unexpectedly went offline and said it was not aware of any malicious activity causing the incident. Australian Home Affairs Minister Tony Burke said Microsoft Australia and New Zealand does not believe it is dealing with a cyber event, comparing the incident to the 2024 CrowdStrike update failure rather than a cyberattack.

Exchange Online users could not access mailboxes through Outlook web, desktop, ActiveSync or REST connections, and delayed messages would show delivery time rather than send time. Teams calls and chats kept working, but calendar scheduling and private channel creation faced issues. Copilot 365 users could not load Copilot Chat or reach work e-mail, calendar and files, while Intune device enrollment and compliance policies were intermittently affected. Azure showed no issues during the outage.

Microsoft’s website states that more than 430 million people use its 365 apps. Downdetector recorded 140,000 people from 74 countries reporting Outlook problems on Thursday evening, and Downdetector said problem reports spread to 74 countries and territories within roughly one hour. The outage tracking site recorded a high of 19,650 reports per minute across five Microsoft services, far above a normal Thursday volume of under 15. Internet connectivity firm Kentik reported a steep decline in Exchange Online traffic while services were down, and Microsoft said e-mail queues had fallen substantially and neared normal levels, and reported encouraging recovery progress across Europe with improving conditions in North America.

Courts from Los Angeles to Texas warned that e-mail delivery might be delayed. In Britain, general practitioner surgeries, pharmacies, police and schools were affected, and some surgeries asked patients not to submit messages through their websites. Britain’s government said it worked with Microsoft to assess service impacts and had contingency plans. The U.K. National Pharmacy Association said the outage delayed prescription communication between doctors and pharmacies, while West Yorkshire Police warned that some online form submissions might be affected and told people to call 101, and Ariel Healthcare in southwest England could not handle online consultation requests or transmit important patient updates.

The outage disrupted Australian government services. A Toronto health care network operating several hospitals experienced e-mail issues without affecting patient care. Baltimore County Government staff could not send or receive e-mail, though 911 and essential services remained unaffected, and City of Austin employees faced the same e-mail block while phone lines stayed operational.

The Arapahoe County Sheriff’s Office in Colorado said online bond payments were hit, requiring in-person payments at the jail. The Philippine Supreme Court said e-mail responses and transactions would be delayed. Euronext listing teams experienced e-mail communication issues, and IndiGo, Akasa Air and Air India reported affected e-mail support services. Workhorse Group delayed its earnings announcement to Thursday, while Switzerland’s Richemont put back its first-half results until Friday.

Japan’s government said its shared IT platform and inter-ministerial communications were disrupted, including Outlook e-mail, though Chief Cabinet Secretary Minoru Kihara said medical care and financial services were not significantly disrupted. Microsoft described Japan as comparatively more stable during the outage. OpenAI and Anthropic reported trouble linking to Microsoft services, which caused some tools to malfunction.

Outlook previously went down on Aug. 31 and was restored by 11 p.m. ET that night. Other major outages include an Amazon Web Services failure in October last year and the 2024 CrowdStrike update that knocked out 8.5 million Windows computers. James Ferryman, a professor at the University of Reading, said the server component that manages secure connections became overwhelmed and stopped responding, and Gergely Orosz, a former software engineer at Skype and Uber, said it could be the most disruptive business e-mail outage ever. “Microsoft is a massive part of the internet backbone and reminds us how critical email still is,” said Troy Hunt.

Ciaran Martin, former head of the U.K. National Cyber Security Centre, said the outage looks like one of the biggest ever. Microsoft said recovery moved in phases with incremental improvement in several workloads, though capacity had not returned to baseline. The company said some servers returned to service may become unresponsive again when traffic arrives, and it was shifting traffic to alternate routes while streamlining the return of remaining servers.

Microsoft has not provided an estimated timeframe for full restoration. Charles Lamanna, Microsoft’s EVP of Copilot, Agents and Platform, said teams are reviewing the incident to prevent future outages. Lamanna said, “We’re seeing encouraging recovery progress, with service availability and email delivery performance improving across a growing portion of affected infrastructure.” Microsoft said it would release a full post-incident report with root cause details after recovery finishes.