Microsoft 365 went down for users around the world on Thursday 12 November 2026, taking Outlook, Teams, SharePoint, Copilot and Defender XDR with it. Microsoft says the cause was a large number of its own servers becoming unexpectedly unavailable, not a surge in traffic, and nothing it has published points to a cyberattack. By 3:30 p.m. ET (20:30 UTC) it was restarting servers and restoring service.
Outage trackers also lit up for Amazon Web Services, Google and Gmail, which is why the day felt like half the internet had failed. Their own status pages did not agree. This is what is confirmed, what is not, and why an outage like this is still a security problem.
Is Microsoft down right now?
Not fully. When this article was last updated, at 21:55 UTC on 12 November, Microsoft had not declared the incident over. Its 4 p.m. ET status update said a different way of checking server health had returned some of the failed servers to service and was being applied more widely, and that automated restarts were being prepared for servers that stop responding. Administrators can follow it in the Microsoft 365 admin center under EX1550543 and MO1550821.
Was the Microsoft outage a cyberattack?
Nothing Microsoft has said points to one. Its first diagnosis was that part of its infrastructure was under elevated load in several regions. It then narrowed that down: the load did not come from more traffic, it came from “a number of servers being unexpectedly unavailable”, as ABC News reported, which pushed the work onto the machines that were left.
That detail matters. A denial-of-service attack shows up as a flood of traffic, and Microsoft is describing the opposite, lost capacity under normal demand. What Microsoft has not yet explained is why the servers dropped out. Until it publishes a post-incident review, the honest answer is that there is no evidence of an attack and no full root cause either.
What went down, and when?
Microsoft’s advisory lists Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR, according to BleepingComputer. The timeline shows when users noticed the problem and what Microsoft said at each step.
How the Microsoft 365 outage unfolded
Thursday 12 November 2026. Times are US Eastern (ET), with UTC alongside.
Morning Microsoft
A separate Teams incident hits users in North and South America. Microsoft says it is resolved and has not said whether the two are linked.
12:39 p.m. ET 17:39 UTC User reports
Outlook problem reports start to climb on Downdetector, Variety reports.
12:54 p.m. ET 17:54 UTC Microsoft
Microsoft says it is investigating failed access to Exchange Online mailboxes in the Americas. It later says users in any region may be affected.
1:09 p.m. ET 18:09 UTC User reports
Downdetector has logged more than 129,000 Outlook reports. CP24 counted nearly 140,000 by 1:30 p.m.
1:35 p.m. ET 18:35 UTC Microsoft
Microsoft blames elevated load on part of its infrastructure in several regions. About 15 minutes later it starts spreading connections across the rest of its network.
2:12 p.m. ET 19:12 UTC Microsoft
Microsoft pauses all deployments, moves more traffic off the affected systems and starts restarting servers.
2:31 p.m. ET 19:31 UTC Microsoft
Microsoft rules out a traffic surge. The load comes from servers that became unexpectedly unavailable, which strains the ones still running.
Why it matters: a denial-of-service attack looks like a flood of traffic. This is the opposite.
2:50 p.m. ET 19:50 UTC Microsoft
The servers are failing automated health checks, Microsoft says. It tests a configuration change and restarts all of them.
3:15 p.m. ET 20:15 UTC User reports
More than 63,000 Outlook reports remain on Downdetector.
3:19 p.m. ET 20:19 UTC Microsoft
No recent change lines up with the start of the outage, Microsoft says. It suspects the component that processes server health.
4:00 p.m. ET 21:00 UTC Microsoft
A different way of checking server health brings some servers back. Microsoft starts applying it more widely.
Status Now
Microsoft has not declared the incident over. Checked at 21:55 UTC on 12 November.
Microsoft’s statements are timed by its Microsoft 365 Status posts on X. Report counts are Downdetector figures as published by the outlets linked in this article. Last checked 21:55 UTC, 12 November 2026.
Why does Downdetector show AWS, Google and Gmail too?
Because Downdetector counts what users report, not what providers measure. When email and meetings stop working, people report whatever they were using at the time, and the charts for unrelated services rise together.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
The providers’ own dashboards told a different story. PCWorld checked during the outage and found no issues on Cloudflare Radar or Google’s cloud status page, and only a local problem in Tokyo on the AWS Health Dashboard. The scale was different too: CP24 saw about 1,350 reports for AWS and 1,000 for Gmail, against well over 100,000 for Outlook.
Why is an outage a security problem?
For three reasons, none of which need an attacker to have caused it.
- Defender XDR was on the list. For a few hours, security teams could not rely on the console many of them use to see alerts and run investigations. Anything that happened in that window deserves a second look once the portal is stable.
- Outages make good phishing lures. Expect emails and texts offering to “restore your mailbox” or “re-verify your Microsoft 365 account”. Cheap, fluent lures are easier to write than ever, as we covered in how large language models are reshaping phishing.
- Workarounds outlive the outage. Staff move work to personal email and chat apps, and administrators relax sign-in rules to get people back in. Both leave gaps that stay open after service returns.
What should admins and users do?
- Follow the official record. Use the Microsoft 365 admin center entries EX1550543 and MO1550821, not social media screenshots.
- Do not loosen MFA or conditional access to work around sign-in errors. If you changed a policy today, change it back.
- Review the gap. Once Defender XDR is healthy, check alerts and sign-in logs for the hours it was unavailable.
- Warn staff about recovery scams. Microsoft will not email a link to restore a mailbox. A stolen session is enough to get past MFA, which is why session-cookie theft is the attack to watch after an event like this.
- Pull work back from personal accounts and unofficial channels, and delete what was copied there.
Frequently asked questions
Was the Microsoft outage on 12 November 2026 a cyberattack?
There is no evidence that it was. Microsoft says the outage came from a large number of its servers becoming unexpectedly unavailable, not from a surge in traffic. It has not yet said why those servers failed.
Which Microsoft services were down?
Microsoft’s advisory lists Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR. Users also reported problems with Outlook, OneDrive, Azure and the Microsoft Store on Downdetector.
Were AWS and Google down as well?
Their status pages did not show it. Downdetector recorded about 1,350 reports for AWS and 1,000 for Gmail, but Google’s cloud status page reported no issues and the AWS Health Dashboard showed only a local problem in Tokyo.
How many people were affected by the Outlook outage?
Microsoft has not given a number. Downdetector logged more than 129,000 Outlook problem reports by 1:09 p.m. ET and nearly 140,000 by 1:30 p.m., and those are user reports, not a count of affected accounts.
How do I check whether Microsoft 365 is working again?
Administrators can check the Microsoft 365 admin center under incident EX1550543 and advisory MO1550821. Everyone else can use Microsoft’s service health status page. Do not follow links in emails that offer to restore your account.
Sources and further reading
- BleepingComputer: Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide (12 November 2026)
- ABC News: Outlook outage, Microsoft reports issues with Teams and email (12 November 2026)
- Variety: Outlook outage, Microsoft’s email service goes down nationwide (12 November 2026)
- XDA: Microsoft is suffering a major outage (12 November 2026)
- PCWorld: Outlook’s outage may be cascading across the internet, users report (12 November 2026)
- CP24: Widespread issues reported with Microsoft products, Downdetector (12 November 2026)
- Microsoft 365 Status on X: updates on incident EX1550543 (12 November 2026)
- Tom’s Guide: live updates on the Microsoft 365 outage (12 November 2026)
- Related reading on Ransomnews: the ransomware incident response runbook.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.
