)
Last updated: November 13, 2026
What was the Microsoft outage? On November 12, 2026, a Microsoft outage cut users off from Outlook and Exchange Online mailboxes, then from Teams features, SharePoint, Microsoft 365 Copilot and Defender XDR, in at least 74 countries. At Microsoft's last update we read, 10:01 UTC on November 13, recovery was still under way. AI agents that read Microsoft 365 data were hit too.
TL;DR: Key Takeaways
- Exchange Online mailboxes began failing around 16:17 UTC on November 12, 2026, and a broader incident covering Teams, SharePoint, Copilot and Defender XDR opened at 18:26 UTC (Azure Blog UK).
- Microsoft says servers became unexpectedly unavailable and failed health checks, then that a process for secure connections was overwhelmed, and it began reverting a recent network configuration change (Azure Blog UK).
- Microsoft says it has no evidence of malicious activity and has promised a post-incident report with the root cause after recovery (LADbible).
- Copilot, Graph requests and Exchange-backed features failed, and OpenAI and Anthropic reported problems with their Microsoft connectors (Benzinga).
- The business impact reached earnings releases, airline customer email and UK police online forms (CNBC, TechRadar).
- Treat Microsoft 365 as a dependency of every agent that reads mail, calendar or files, with backoff, a degraded mode and no fail-open fallback (OWASP).
Microsoft Outage at a Glance
The November 2026 Microsoft outage was a service failure that started in Exchange Online and spread to everything that depends on it. It reached users in at least 74 countries, ran for more than 15 hours for the broader incident as of the last update we read, and still had no confirmed root cause.
| Fact | What the sources say |
|---|---|
| Dates | November 12 to 13, 2026; recovery still under way at last update |
| Incident IDs | EX1550543 (Exchange Online), MO1550821 (Microsoft 365), TM1550488 (earlier Teams incident, resolved) |
| Scope | At least 74 countries; Microsoft first said the Americas, then any region |
| Peak user reports | About 130,000 to 140,000 for Outlook on Downdetector, depending on the outlet; these are reports, not a customer count |
| Stated cause so far | Servers unexpectedly unavailable and failing health checks, a process for secure connections overwhelmed, a recent network configuration change being reverted |
| Cyberattack | Microsoft says it has no evidence of malicious activity |
Source: BleepingComputer, TechRadar, Benzinga, LADbible and Azure Blog UK (2026). The 15-hour figure is our arithmetic from 18:26 UTC to 10:01 UTC.
How we researched
On November 13, 2026 we read BleepingComputer, CNBC, Benzinga, LADbible, TechRadar's live blog and a UK admin blog that relays Microsoft's service-health posts, plus OWASP's lists. The BBC live page and Microsoft's admin center were not available to our tools, so Microsoft's wording comes from relays and may be updated. We tested no agent.
Microsoft Outage Timeline: What Happened and When
The Microsoft outage unfolded in two stages. A Teams incident hit the Americas in the morning US time and was fixed. Then Exchange Online mailboxes failed from about 16:17 UTC and a broader incident opened at 18:26 UTC. Microsoft's explanation changed several times as its fixes failed to bring lasting relief.
| Time (UTC, US Eastern in brackets) | What happened |
|---|---|
| Nov 12, 14:45 to 15:53 (9:45 to 10:53 a.m.) | Separate Teams incident TM1550488 in the Americas: delayed or failed chat messages, blamed on resource contention, resolved |
| 16:17 (11:17 a.m.) | Exchange Online incident EX1550543: users cannot open mailboxes |
| 18:26 (1:26 p.m.) | Microsoft opens MO1550821 for Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR |
| About 19:00 to 19:30 | Deployments paused; Microsoft says the load comes from servers unexpectedly unavailable, not from more traffic |
| About 21:00 (4 p.m.) | An alternative health-check method returns a subset of servers to service; by 22:00 Microsoft says a core process on the servers is overwhelmed and relief has not come |
| Nov 13, 00:00 to 01:50 | Returned servers fail again under traffic; Microsoft limits traffic types and begins reverting a recent network configuration change that correlates with the start of impact |
| About 07:30 | Positive results after patching an upstream authentication and routing configuration component on part of the infrastructure |
| 09:10 to 10:01 | Early signs of stabilization, email timeout window extended to 48 hours, incident still listed as service degradation |
Source: BleepingComputer, CNBC and Azure Blog UK (2026). We converted times to UTC; Microsoft's own posts use several time zones.
Downdetector also showed spikes for AWS, Google and Cloudflare. Amazon said an unrelated disruption elsewhere on the internet was prompting inaccurate reports, and TechRadar saw no other sign of outages there (CNBC, TechRadar, 2026). User reports cannot tell you which provider failed.
)
Which Microsoft Services Were Affected
Microsoft said features that interact with Exchange Online and email were affected, while parts that do not depend on Exchange kept working. Core Teams calls, meetings and chat mostly worked, and files in SharePoint stayed reachable. Mail access, Copilot, Graph requests and several security and compliance tools were the main casualties.
| Service | What Microsoft listed as affected | What kept working |
|---|---|---|
| Exchange Online | No mailbox access in Outlook on the web, desktop, mobile or REST; delivery may be delayed | Delayed mail keeps retrying for up to 48 hours |
| Teams | Calendar scheduling, invites, meeting edits, creating events, some channel actions | Joining calls, meetings, group chats, channel messages |
| SharePoint Online | Features that depend on Exchange Online | Opening stored files |
| Microsoft 365 Copilot | Copilot Chat may not load or answer, and may not reach email, calendar or files | Not stated |
| Microsoft Graph | Requests for mail, calendar and contacts may time out | Not stated |
| Defender and Purview | Safe Links failures, portal pages not loading, DLP and auto-labelling affected | Not stated |
Source: Microsoft's MO1550821 posts as relayed by Azure Blog UK (2026), and CNBC.
Mail that was delayed was not lost, because Microsoft extended the email timeout window to 48 hours (CNBC, 2026). For a period, Microsoft's status page also would not load, TechRadar reported.
What Microsoft Says Caused the Microsoft Outage
Microsoft has not published a root cause. Its updates describe servers that became unexpectedly unavailable, health checks that failed, a process for secure connections that became overwhelmed and a recent network configuration change that correlates with the start of impact. A post-incident report is promised once mitigation is complete.
Microsoft first blamed heavy load across regions, then said it came from unavailable servers, not more traffic. Around 19:57 UTC it had found no recent change linked to the start of impact. Overnight it began reverting a recent network configuration change that correlates with it (Azure Blog UK, 2026).
Later updates described a surge of calls from routing services to backend servers and a patch to an upstream authentication and routing component. Executive vice-president Charles Lamanna said on X that there was no indication of malicious or cyber activity (LADbible, 2026).
Whatever the final cause, the pattern is a cascading failure: a fault in a shared layer cut capacity, the remaining servers took on the load and restarted servers failed again when traffic returned. That is our reading, not Microsoft's wording.
What the Microsoft Outage Means for AI Agents
The outage was not an AI failure, but it showed how many AI agents sit on top of Microsoft 365. Copilot reads email, calendar and files through Microsoft Graph, so when Exchange failed it had little to read. Agents built on connectors or Graph calls shared the same dependency.
| Dependency | What failed | Consequence for agents |
|---|---|---|
| Microsoft 365 Copilot | Chat may not load; no access to email, calendar or files | No work data to ground answers |
| Microsoft Graph mail, calendar, contacts | Requests may time out | Inbox triage, scheduling and summary jobs hit timeouts and retries |
| Third-party AI connectors | OpenAI said new Microsoft connector connections could fail; Anthropic traced Microsoft 365 connector problems to an upstream provider | Chat assistants lost Microsoft data because of an upstream fault |
| Security and compliance tools | Safe Links failures, Purview DLP and auto-labelling affected | Controls an agent relies on can fail closed or go missing |
| Status and admin access | Status page unreachable at times | Teams could not see the incident that was breaking them |
Source: Azure Blog UK relaying Microsoft, Benzinga citing Reuters, LADbible and TechRadar (2026).
Three failure modes matter. Retries add load to a service already short of capacity. Guessing is when an agent that cannot read the mailbox answers from stale context instead of saying so. Workarounds are people pasting work content into unapproved tools under pressure.
Microsoft did not name Copilot Studio or Azure AI Foundry in the updates we read. A model provider outage is a different failure, which our Is Claude down? page tracks.
Resilience Playbook for Admins and AI Teams
You cannot fix a Microsoft outage from inside your tenant, so resilience means how fast you detect it, what your agents do while it lasts and what you keep afterward. Start with the admin steps below, then apply the agent controls in the table that follows them.
- Check Service health in the Microsoft 365 admin center, or status.cloud.microsoft if it will not load, and follow incident IDs such as MO1550821 instead of social media (Azure Blog UK).
- Tell users once, through a channel outside Microsoft 365, such as SMS.
- Freeze your own changes, as Microsoft paused its deployments, so any new fault is clearly theirs.
- Warn staff about phishing. TechRadar cautioned that attackers may send password-reset texts and emails as services return (TechRadar).
- After recovery, download the post-incident report and keep a copy, because Service health keeps issue history for 30 days (Azure Blog UK).
| Agent control | What to do | Failure it limits |
|---|---|---|
| Backoff and circuit breaker | Exponential backoff with jitter on Graph calls, a breaker that stops calls after repeated errors, a dead-letter queue for jobs | Retry storms on a degraded service |
| Degraded mode | When Microsoft data is unavailable, the agent says so, queues the task and does not answer from stale context | Confident answers with no data |
| Fail closed for writes | Block send, delete and approve actions when policy, DLP or approval services are unreachable | Actions without the usual controls |
| Approved fallbacks | Pre-approve which alternative tools and models may receive work content in an outage | Data pasted into unapproved tools |
| Model failover | Route model calls across providers so a model API outage does not stop agents | Model-side outages |
Source: our analysis, based on Microsoft's updates above and OWASP guidance.
An AI gateway can cover the model side of this table, as our AI gateway explainer and AI Gateway for Agentic AI describe. A gateway cannot bring Exchange back, and it only sees the traffic routed through it.
Security and Governance: Running Agents Through a Cloud Outage
An outage is a security event even without an attacker, because controls fail and people improvise. According to OWASP (2026), Cascading Failures is ASI08 in the agentic list, and Unbounded Consumption is LLM06 in the 2026 LLM list (OWASP Agentic Top 10 2026).
Cascading failures and retry storms
OWASP describes a cascading failure as one fault spreading across agents, tools and workflows. Microsoft's own recovery showed the pattern: restarted servers failed again when traffic returned, so it limited which traffic types could reach them. Customer agents that retry hard add to that load, which is why retry budgets matter (OWASP LLM Top 10 2026).
Failed controls, phishing and improvisation
Microsoft listed Safe Links, Purview DLP and auto-labelling and the Defender XDR portal among the affected features, so check your logs for whether your policies failed open or closed in those hours. We found no report of data exposed. Microsoft sees no attack behind the outage, which is separate from attackers using it: TechRadar warned about password-reset lures, and teams under pressure share break-glass credentials or paste content into other tools.
| Risk | How it can show up in an outage | OWASP reference |
|---|---|---|
| Retry storms | Clients retry while capacity is short, and Microsoft limited traffic types to stabilize | LLM06 Unbounded Consumption |
| One dependency failing many agents | Copilot, Graph jobs and connectors failed together | ASI08 Cascading Failures |
| Work content in unapproved tools | People improvise when mail and Copilot are down | LLM02 Sensitive Information Disclosure |
| Emergency or shared credentials | Break-glass access used under pressure | ASI03 Identity and Privilege Abuse |
Source: OWASP LLM Top 10 2026 and Top 10 for Agentic Applications 2026. The mapping is our analysis.
Controls that hold in practice
Map every agent to its Microsoft 365 and model-provider dependencies, set retry budgets per dependency, block writes while policy or identity checks are unreachable, and log every agent call with a correlation ID. Keep a human in the loop for any action that sends, deletes or pays, as our human-in-the-loop guide explains, and vet connected servers with our MCP security best practices.
NeuralTrust is not part of Microsoft's infrastructure, and no gateway could have prevented a failure inside it. For the traffic you route through it, the Agent Gateway (TrustGate) provides AI API failover across model providers, per-tool access and logs for every call, which helps you answer what your agents did during an incident. For agents that act on mailbox or document content, Agent Runtime Security (TrustGuard) inspects inputs and tool calls and can allow, block or transform them. Our OWASP agentic guide covers the wider threat model.
Conclusion
The Microsoft outage of November 12 and 13, 2026 was an infrastructure failure, not an AI failure, yet it took Copilot, Graph-based agents and third-party connectors down with Exchange. Wait for Microsoft's post-incident report before judging the cause, and use the time to map agent dependencies, add backoff and decide what each agent does when Microsoft is unavailable.
Keep AI Agents Running Through the Next Outage with NeuralTrust
Route model traffic with failover, control tool access and audit every agent call.
)
Related Comparisons
- Is Claude Down? Status, Fixes & Fallback
- Claude Connectors: Setup and Security
- AI Gateway vs MCP Gateway: Key Differences Explained
- MCP Security Best Practices Checklist
FAQs about the Microsoft Outage
1. What caused the Microsoft outage?
Microsoft has not published a root cause. It says servers became unexpectedly unavailable and failed health checks, a process for secure connections was overwhelmed, and it began reverting a recent network configuration change. A post-incident report is promised after recovery.
2. Is the Microsoft outage over?
At the last update we read, 10:01 UTC on November 13, Microsoft still listed the incident as service degradation and said capacity had not returned to baseline. Check Service health or status.cloud.microsoft for your tenant.
3. Was the Microsoft outage a cyberattack?
Microsoft says it has no evidence of malicious activity, and executive vice-president Charles Lamanna said there was no indication of malicious or cyber activity. The final word waits for the post-incident report, so treat this as the current position.
4. Which Microsoft services were affected?
Microsoft listed Exchange Online, Exchange-dependent features in Teams and SharePoint, Microsoft 365 Copilot, Graph mail and calendar requests, Defender and Purview features, and Power Apps sign-in. Core Teams calls and chats mostly kept working.
5. Was Copilot down in the Microsoft outage?
Microsoft 365 Copilot was named in the incident. Copilot Chat might not load or reach email, calendar or files. The sources we read did not say whether consumer Copilot was affected.
6. Did the Microsoft outage affect ChatGPT and Claude?
Not the models themselves, as far as reports say. OpenAI said new connections for Microsoft connectors could fail, and Anthropic traced Microsoft 365 connector problems to an upstream provider, per Reuters via Benzinga.
7. How do I protect AI agents from a cloud outage?
Map each agent's dependencies, add backoff and circuit breakers, and give agents a degraded mode that says when data is unavailable. Block writes when policy checks are unreachable, and route model calls across providers.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
Accessed on November 13, 2026.
- Azure Blog UK, "Microsoft 365 outage, 12 November 2026: what happened and what admins can do", November 12 to 13, 2026 (relays Microsoft's service-health posts).
- BleepingComputer, "Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide", November 12, 2026.
- CNBC, "Widespread Microsoft outage takes down Outlook and other 365 services", November 12 to 13, 2026.
- Benzinga, "Microsoft Outage Triggers Chaos Across Outlook, Teams and Copilot, Spills Over to OpenAI and Anthropic", November 2026.
- LADbible, "Microsoft issues update as major global outage affecting Outlook and Teams continues", November 13, 2026.
- TechRadar, "Microsoft outage live", November 13, 2026.
- OWASP GenAI Security Project, "OWASP Top 10 for Agentic Applications for 2026", December 9, 2025.
- OWASP GenAI Security Project, "OWASP Top 10 for LLM Applications 2026", August 2026.
)
)
)
)