Massive Microsoft 365 Outage Impacts Exchange Online, Teams, SharePoint, Copilot, and Defender XDR Users

A major Microsoft 365 outage disrupted cloud service access on November 12 and continued into November 13, 2026, as Microsoft worked to restore failing infrastructure.

Microsoft confirmed that connectivity problems could affect users in any region, expanding the scope beyond its initial investigation into Exchange Online mailbox access in the Americas.

The reported impact spans Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR, although the exact service and feature restrictions remain subject to Microsoft’s updated advisory. Administrators should check incident MO1550821 for that breakdown. Exchange Online mailbox connectivity is also being tracked separately under EX1550543. Microsoft has not confirmed that every customer is affected.

Early findings pointed to heavy load across several regions. Microsoft later clarified that the pressure did not come from increased traffic. Instead, servers had unexpectedly become unavailable, leaving the remaining infrastructure to handle connections. Engineers began moving traffic across Microsoft’s worldwide systems to reduce pressure on the affected environment.

The disruption follows other cloud availability incidents, including a Microsoft 365 outage affecting Teams, SharePoint and Copilot in July. That earlier incident involved a network configuration change. Microsoft has not established the same cause here, making it important to separate historical context from the current investigation.

Failed Health Checks Complicate Recovery

Microsoft identified failed automated health checks as a key part of the current problem. These checks determine whether servers remain available to handle requests. Investigators focused on a component responsible for processing server health, while testing a configuration change and restarting affected servers to bring capacity back online.

According to Microsoft’s official incident updates, an alternative health check method allowed some servers to return to service. Engineers began applying that approach more widely and preparing automated recovery systems to detect and restart unresponsive machines. However, these measures did not immediately deliver the expected improvement.

Microsoft subsequently found that a core process on affected servers was becoming overwhelmed, causing further capacity loss. Some restored servers initially remained stable, but later became unresponsive again when traffic reached them. That pattern complicated recovery because bringing servers online did not necessarily mean they could sustain normal use.

Engineers paused deployments, shifted traffic onto alternate routes and reviewed whether reversing several recent configuration updates could speed recovery. Microsoft initially said it had not identified a recent change matching the start of the disruption. The later rollback assessment therefore remains a recovery option, not proof of the root cause.

Security Visibility and Business Impact

For security teams, reported Defender XDR disruption raises questions about access to alerts and investigations. A previous Microsoft Defender portal access incident showed how dashboard availability can interrupt security workflows. However, portal access problems alone do not establish that endpoint protection or background detection has stopped working.

Administrators should follow EX1550543 and MO1550821 in the Microsoft 365 admin center and use Microsoft’s public service status page when the admin center is unavailable. Microsoft’s public updates describe infrastructure failures and recovery work, rather than presenting evidence of a confirmed cyberattack behind this disruption.

The latest supplied updates did not confirm full restoration or provide a firm completion time. Organizations should distinguish partial recovery from stable service, particularly because restored servers became unresponsive under traffic. Microsoft was still investigating that behavior while limiting selected traffic and working to return remaining capacity safely.

Update 1: Microsoft confirmed that its recent fixes have not worked as expected. Engineers are exploring other ways to increase capacity and address ongoing traffic imbalances. Administrators can track updates under EX1550543 and MO1550821 in the Microsoft 365 admin center.

Update 2: Microsoft says it is continuing efforts to recover affected frontend servers while implementing additional traffic optimization measures to improve service stability and increase capacity amid the ongoing Microsoft 365 outage.

The company is working on multiple recovery efforts simultaneously to reduce the impact, resolve the issues blocking restoration, and return affected infrastructure to a healthy state.

Engineers are also focusing on stabilizing recovered servers to prevent further disruptions as user traffic resumes. Microsoft has not provided an estimated time for full service restoration.

Note: This is a developing story. We will keep you updated as Microsoft shares more information on the outage and service recovery.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Massive Microsoft 365 Outage Impacts Exchange Online, Teams, SharePoint, Copilot, and Defender XDR Users appeared first on Cyber Security News.