A Microsoft 365 outage that began around 18:00 UTC Thursday continued beyond 27 hours into Friday, November 13, disrupting Exchange Online and dependent services across multiple regions, The Register reported. By the outlet’s 21:44 UTC update Friday, Microsoft was reporting stabilization but still had no estimate for full recovery.
The disruption left users unable to access email, attend Teams meetings, use cloud PCs or consult Copilot, while also limiting access to another 15 hosted services. Microsoft said services that do not need Exchange Online remained functional.
Recovery efforts brought some regional improvements, but several earlier measures failed to deliver the relief Microsoft expected. The company warned that restored access would not necessarily mean email delivery and processing had caught up.
Microsoft 365 disruption centers on Exchange Online
Microsoft described the affected services as those “that interact with Exchange Online and email services.” That placed Exchange Online and the services relying on it at the center of the disruption, rather than every hosted service being unavailable.
In Australia, The Register reported that the incident was being called the “Microsoft long weekend,” with organizations relying on Microsoft’s online services facing a heavily disrupted Friday. The trouble extended across regions as Microsoft worked to manage traffic and restore affected infrastructure.
A status update at 12:00 UTC Friday still acknowledged that users were “unable to connect to multiple Microsoft 365 services.” Later reports of recovery progress continued to include warnings about intermittent access and delayed messages.
Health-check failures give way to unsuccessful fixes
Microsoft initially attributed the outage to a “problem that’s causing servers to fail automated health checks and become unavailable.” The company thought it had identified a remedy, but subsequently acknowledged: “Actions taken thus far have not provided the anticipated relief.”
The Register traced the recovery attempts through Microsoft’s status RSS feed, which preserved earlier updates even though the status page displayed only the most recent message. Those updates described repeated adjustments that either did not take effect as expected or produced improvements that did not last.
Microsoft first reported applying infrastructure capacity improvements to support traffic in regions coming online. After monitoring the changes, it said they were not taking as expected. It then reviewed traffic flows and affected infrastructure for routing improvements, while checking the reasons for service failures to develop more specific corrective actions.
Virtual machines remain stuck in a bad state
As the incident continued, Microsoft said it was identifying alternative ways to increase capacity amid sustained traffic-management imbalances. Adjustments produced partial recovery in some regions, but the company said those gains were not sustained.
Another effort involved scaling up virtual machines to increase capacity and reduce load. That work encountered a separate obstacle: Microsoft said machines were stuck in a bad state, preventing changes from syncing as expected.
The company described its continuing investigation in a status update:
“We’re continuing to pursue multiple workstreams to pinpoint the underlying cause of the traffic influx and advance the recoverability of the backend servers,” Microsoft wrote.
Microsoft also said it was taking a measured approach to identifying and repairing affected infrastructure, checking that changes had actually been applied and monitoring whether servers showed the intended recovery and performance.
Regional improvements leave email backlogs unresolved
At 13:00 UTC Friday, Microsoft reported continued recovery progress across affected regions. It described broader improvements in North America, sustained improvements across much of Europe and encouraging recovery signals in Asia Pacific.
That update nevertheless cautioned that some users could continue to experience intermittent access problems or delayed email delivery while mitigation proceeded across the remaining affected infrastructure.
By The Register’s 21:44 UTC update, Microsoft was still describing stabilization rather than full restoration. Its latest status message had been issued at 20:02 UTC.
“As infrastructure stabilizes, we’re still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up,” Microsoft said.
The company added: “We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes.” It promised another update by 00:00 UTC Saturday.
Microsoft reports no known malicious activity
Microsoft also adjusted its wording about whether malicious activity was involved. At 04:11 UTC, it said there was “no indication this is the result of malicious activity.”
An update timestamped 05:46 UTC instead said: “As of now, we are not aware of any malicious activity that is causing this incident.” The Register noted the change in language and reported that the company had not completely ruled out a cyberattack.
Microsoft’s subsequent updates continued to describe work on traffic, capacity and affected servers. With regional improvements still accompanied by queued messages and access issues, full recovery remained without an estimated completion time.
