Microsoft Outage Enters Second Day With No Fix and No Root Cause

Microsoft's worst week in ten weeks is now into its second day. More than seventeen hours after Exchange Online stopped answering, Outlook is still unreliable, governments from Whitehall to Canberra are running on contingency plans, and the company still will not tell its customers what actually broke.

Microsoft Outage Enters Second Day With No Fix and No Root Cause

Atlanta — The outage is not over. That is the first thing you need to know, and it is the thing Microsoft itself keeps saying in different words. At 16:17 UTC on Thursday, 12 November — 11:17 in the morning on the American east coast — Microsoft opened an Exchange Online incident numbered EX1550543. Two hours and nine minutes later, at 18:26 UTC, it opened a second incident, MO1550821, covering every Microsoft 365 service that depends on Exchange Online. Neither has been closed.

Seventeen Hours In, and Still No Root Cause

The official status is still "service degradation," which is corporate for "broken, but we would rather not say how broken." Outlook on the web, desktop Outlook, mobile mail and REST connections are all listed as affected, and the company warns that "email delivery may be delayed." Teams, SharePoint, Copilot, Defender XDR, Planner, To Do and Intune have all appeared on the potentially-impacted list at some point.

What Microsoft has not done is name a root cause, publish a restoration time, or explain why a company with more than 430 million Microsoft 365 users could not bring a mail service back inside a working day. It has promised a preliminary post-incident report within two business days and a final one within five. Down Detector was still logging more than 25,000 Outlook complaints in the United States alone at 02:30 GMT on Friday, which is not what recovery looks like.

What Microsoft Actually Says Went Wrong

The company's own updates trace a chain, even without naming a cause. Its first explanation was load: a portion of infrastructure "experiencing elevated load across multiple regions," which it said was "likely contributing to the connectivity errors." It then corrected itself in the most important sentence of the whole episode: "We've determined the elevated load isn't driven by an increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure."

Those servers, Microsoft said, were failing their own automated health checks, and the failures appeared to originate from "a specific component" on the machines responsible for processing those checks. By Friday morning the language had sharpened again: a process responsible for establishing secure connections was becoming overwhelmed, so servers stopped answering requests altogether. Microsoft has also said it is reversing a recent update that "appears to coincide with the beginning of the disruption."

The Fix That Kept Failing

This is the part that should worry anybody whose business runs on this stack. Microsoft did not have one bad hour. It had a sequence of announced progress followed by fresh setbacks, in public, for most of a day.

By 2:43 p.m. ET on Thursday it said affected servers were failing automated health checks. Around 4 p.m. it deployed a replacement check that brought some machines back, and warned that they might stop responding again once traffic returned. They did. At 02:54 GMT on Friday it admitted its latest changes "had not worked as expected." At 07:00 GMT it reported "positive results for server stability" after applying an upstream authentication and routing configuration patch to part of its infrastructure. By Friday afternoon it was telling customers again that the changes were "not taking as expected."

Microsoft's executive vice-president for Copilot, Charles Lamanna, posted on X: "We regret that today's outages caused disruptions for our customers, and we are working to address the issue." Regret is not a restoration time.

No Evidence of a Cyber Attack

Microsoft says there is no indication that this was a cyber attack, and it has repeated that in update after update. The Australian government minister Tony Burke relayed the same thing after being briefed, telling reporters that Microsoft "do not believe they are dealing with a cyber event," and that the company's working theory looks more like CrowdStrike in 2024 — "an update that has gone awry."

Outside experts are converging on the same shape without claiming certainty. Mark Gregory, an associate professor at RMIT University, said the fault appears to sit in the network layer, and that "part of the server pool that serves the Outlook service appears to have fallen off the network." Once that happens, he said, the survivors take the whole load and fall over too. "You end up with a cascading problem," he said. That is a hypothesis, not a finding, and Microsoft has not confirmed it.

Seventy-Four Countries in an Hour

The scale is the story. Down Detector recorded Outlook reports beginning to climb at 17:25 UTC, less than seventy minutes after Microsoft's incident opened. Within about an hour, the tracker was receiving reports from 74 countries and territories.

The peak is reported differently depending on who is reading the graph, and the difference is worth keeping visible. The Guardian and Deutsche Welle both put the peak at nearly 130,000 Outlook reports. The ABC put the global peak closer to 140,000, and TechRadar logged more than 131,000. Those are three readings of a live dashboard, not three competing facts, but they tell you the order of magnitude: hundreds of thousands of people, at the same time, locked out of their own inboxes.

For context on what is exposed here, more than 430 million people use Microsoft 365 apps, and Microsoft says more than 90 per cent of Fortune 500 companies use Copilot. RSM Australia risk advisory partner Ashwin Pal put the number of businesses using the suite globally at 3.9 million.

Whitehall, the NHS and the Police Switchboard

In Britain, the disruption landed at the start of the working day and went straight into public services. A UK government spokesman said: "We are aware of the ongoing global technical issues affecting Microsoft services. We are working closely with Microsoft to assess any impact on government services, with robust contingency plans in place to minimise disruption." Luke Pollard, the minister for defence readiness and industry, said government engineers were working with Microsoft.

The health service felt it immediately. Central and North West London NHS Foundation Trust told patients: "Please call your usual CNWL service rather than emailing until further notice. Emails may not be received." NHS Grampian said the outage was affecting some GP practices' access to hosted systems, while stressing that telephone lines were working. Pennine Care said appointments should go ahead as normal and that the main impact was on staff email.

Several police forces, including Hertfordshire, urged the public not to file crime reports through online forms and to ring instead. Schools across the country told parents to phone rather than email, and at least one primary school in Salisbury reassured families that lessons would run as normal.

Canberra, Tokyo and a Bill Nobody Has Added Up

Australia took the hardest early hit because the failure arrived in its morning. Service NSW told customers to delay visits to its service centres and set up priority callbacks for urgent transactions. The domestic spy agency, ASIO, was affected on one level, according to its director-general, Mike Burgess, who said its systems "operate on multiple levels" and had not gone down completely. Courts, councils, state and federal agencies and schools all warned they could not be reached by email.

The Australian Medical Association said some hospitals and clinics had reported clerical problems, including facilities returning to paper for prescriptions, but that patient care was unaffected. Victoria's government warned about opportunistic scammers moving into the gap. In Japan, the economy, trade and industry minister described a "major impact," the courier Sagawa Express could not take online reservations at airports and train stations, and the pharmaceutical giant Taisho took orders by telephone.

ABC News reported that some Australian workers had resorted to fax machines, and that RSM's Ashwin Pal expects the cost to run into billions, with professional services firms losing hundreds of thousands of dollars an hour. That figure is an expert estimate, not a measured loss.

Even the AI Companies Went Quiet

The outage did not stop at email. OpenAI said it was investigating an issue with Microsoft connectors in which new connections may be broken and tools were not working as expected. Anthropic said it had identified an issue with an upstream provider affecting its Microsoft 365 connector. Two of the loudest AI companies on earth, both dependent on a mail and identity layer they do not control.

In India, IndiGo and Akasa Air said email support services were affected. In Taiwan, securities firms, life insurers and investment trust companies reported disruption to fund management. Portfolio managers in several markets could not check their inboxes, which made some trading platforms harder to reach than usual. Organisations in New Zealand reported problems too.

There is one loose thread worth flagging honestly. CNBC noted that Amazon Web Services and Google users also filed outage reports on Down Detector at the same time, and some Google Workspace users reported trouble reaching their mail through Outlook clients. Nobody has established that those reports share a cause with Microsoft's failure.

The Second Time in Ten Weeks

Here is the part Microsoft would rather you did not add up. The company's last major Microsoft 365 incident ran from 31 August to 3 September — 66 hours and 52 minutes — and was traced to "a core authentication configuration" shared across multiple services. Roughly 5 per cent of Exchange Online was affected, and a post-incident review followed.

On 9 September, Outlook mobile and Outlook for Mac users began failing to connect because an update intended to improve mail flow was driving high processor usage on mailbox database infrastructure. Microsoft reverted the update. Last month there was an Azure outage that hit productivity software and industries worldwide. This latest failure began two days after Microsoft's November Patch Tuesday release.

Three serious incidents in seventy-three days, two of them Microsoft 365, and both of those began with a change on Microsoft's side. That is not bad luck. That is a change-management problem at the layer where hundreds of millions of people keep their working lives.

What to Do While It Is Down

First, do not make it worse. Do not reset your password, reinstall Outlook or clear your browser data while a service-side incident is live; none of that will fix it and some of it will cost you time later. Check status.cloud.microsoft, and if you are on a work or school account, ask your administrator for the tenant view in the admin centre.

Second, your mail is probably not gone. Messages are most likely queuing on Microsoft's servers and delivery is delayed; senders' systems retry, and a rejected message tells the sender it failed. What you should expect is a backlog, not a void.

Third, phone people. That sounds trivial until a police force, a hospital trust and a school district all say it on the same morning.

And fourth: a plan you have never tested is not a plan. Ashwin Pal's point is that companies forget between incidents. Mark Gregory's is that "it then becomes important to have an alternative." Build one, test it on a quiet Tuesday, then hold Microsoft to the post-incident report it has promised. Ask what changed, who approved it, and why the rollback took seventeen hours. That is not a technical question. That is accountability, and you are entitled to the answer.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: The Guardian, Deutsche Welle, ABC News (Australia), TechCrunch, CNBC, SecurityWeek, Microsoft 365 Status and service health updates, ProtoThema, Chris Lynch Media, and Microsoft incident records republished by Old Dominion University. Photographs: Reuters via ABC News; The Guardian. Cover: Global 1 News editorial image.