Worldwide Microsoft 365 outage since 12 November: timeline, cause and what to do

Since Thursday 12 November 2026 at 17:17 Paris time (16:17 UTC), Microsoft 365 has been affected by a worldwide outage. Outlook mail and calendar are hit hardest: refused connections, mailboxes that do not load, delayed outgoing mail. Teams calls and chats, SharePoint and OneDrive are working. Microsoft states that this is not an attack. This page gathers what Microsoft has published, dated and summarised, and what we have observed with our clients.

At a glance

• Affected: Outlook (desktop, web and mobile), calendar, part of the admin consoles, Copilot, Planner, the recent files list, and intermittently enrolment and compliance of managed devices. Microsoft states that only features relying on mail are affected.
• Working: Teams calls and chats, SharePoint, OneDrive.
• Cause: on Microsoft's side, not yours. The process that establishes secure connections on Microsoft's mail servers is overwhelmed, and the servers stop responding.
• Your mail: Microsoft has extended the retention of queued messages to 48 hours. A delayed message is not lost.
• What to do: nothing on your computers. Do not reinstall Outlook, do not recreate profiles, do not change passwords because of the outage.
• Expected end: Microsoft has not announced a recovery time.

Timeline

Paris time (CET, UTC+1). Microsoft publishes two notices in parallel, visible to administrators in the Microsoft 365 admin center under Service health: EX1550543 for mail and MO1550821 for other Microsoft 365 services.

Thursday 12 November

• 17:17: first mailbox connection errors. Microsoft opens the mail incident EX1550543.
• 18:45: Microsoft identifies connection errors on the part of its infrastructure that receives user access requests.
• 19:19: the apparent cause is server overload across several regions. Microsoft restarts and repairs the affected servers.
• 19:26: the incident spreads to other services. Microsoft opens notice MO1550821.
• 19:29 to 19:57: Microsoft moves part of the traffic away from the affected servers, first in the United States, then redistributes Outlook connections across its worldwide infrastructure.
• 20:06: as a precaution, Microsoft pauses all deployments and configuration changes while it checks whether one of them is involved.
• 20:18: the overload is not caused by more traffic. A large number of servers becomes unavailable and shifts its load onto the remaining ones.
• 20:43 to 21:56: servers fail the automated health checks that keep them in service. Microsoft tests, then rolls out, an alternative check method, which brings a first group of servers back.
• 23:00: Microsoft acknowledges that its actions have not brought the expected relief. A core process on the servers is overwhelmed.
• 23:57: some servers are back in service and remain stable. Limited recovery in some regions.

Friday 13 November

• 00:59: servers returned to service go down again as soon as they receive traffic. Microsoft's networking and platform teams analyse diagnostics.
• 02:06: technical cause identified. On the affected servers, the process that establishes secure connections is overwhelmed and the server stops processing requests. Microsoft prepares a configuration change.
• 02:45: first positive results from the restarts.
• 03:54: the change applied does not have the expected effect. Microsoft looks for other ways to increase capacity.
• 05:10: partial recovery in several regions, thanks to throttling, rerouting and targeted blocking of part of the traffic.
• 05:59: Microsoft observes a surge of calls from its routing services to its mail servers and investigates its origin.
• 07:16: Microsoft evaluates further traffic controls to relieve its servers.
• 08:25: a fix to the authentication and routing component stabilises the servers where it is applied.
• 09:06: stability is confirmed. Microsoft extends the fix first to regions entering business hours, including Europe.
• 10:03: early signs of stabilisation, but capacity has not returned to normal and service remains variable while traffic is gradually reintroduced. Servers are drained, restarted, repaired and returned to service one by one. Microsoft extends the retention of queued messages to 48 hours.
• 10:57: Microsoft reports gradual improvement across several services, based on its telemetry and customer reports. Service remains variable and capacity is not yet back to normal. Queued mail is processed as a priority.

Why it seems worse in the morning

The outage affects the servers that receive connections. When Europe gets to the office, millions of users reconnect at the same time, onto an infrastructure part of which has not yet received the fix. The service can therefore feel slower or less stable at 9:00 than at 7:00, even though the overall situation is improving. Microsoft reintroduces traffic gradually, region by region, so that repaired servers do not fall over again.

What we checked for our clients

From the first report on Thursday evening, we checked office Internet access, security monitoring and endpoint protection. None of these checks showed anything abnormal: the outage does not come from computers, networks or a security incident. The same symptoms appeared at the same time in Spain and in the United States, at unrelated companies, which pointed to a Microsoft issue even before Microsoft confirmed it.

One isolated observation: a user abroad was able to send mail again after connecting to the private network of their Paris office. Their traffic then reached Microsoft through a different entry point. This workaround worked in that case, with no guarantee elsewhere.

Do and don’t

• Do not reinstall anything: not Outlook, not Office, not the mail profile. The computer is not the problem and a reinstall wastes time without fixing anything.
• Do not keep resending a stuck message: it is queued and will be delivered on recovery. Resending creates duplicates for the recipient.
• Use Teams for anything urgent: calls and chats are working.
• Share files with a SharePoint or OneDrive link rather than as attachments.
• Beware of fake "Microsoft" messages that use the outage to ask you to sign in again or to approve a code. Microsoft does not ask for your credentials by email to restore service.
• If a symptom does not look like the outage, call support rather than wait.

For firms subject to DORA

An outage at a critical ICT third-party provider that affects email falls within ICT-related incident management. Three steps:

• record the incident in your register, with start and end times, affected services and the impact on your business;
• assess its classification against the regulatory criteria (duration, number of clients affected, critical services involved);
• keep Microsoft's notices (EX1550543, MO1550821) and the post-incident report Microsoft has committed to publish after recovery.

For our clients, we provide the timeline and the evidence to attach to the register.

Next step

Microsoft has not announced an end time. Its next update is expected at 12:00 Paris time. We update this page with every new notice, and will then publish a summary of Microsoft’s post-incident report, with the root cause and the measures announced to prevent a repeat.

Affected clients are kept informed directly through their support ticket.