Microsoft says its Microsoft 365 services are fully working again. The outage disrupted governments, hospitals, courts and businesses in more than 70 countries. The affected services included Outlook email, the Teams chat and meetings app, and the Copilot AI assistant. The company gave the all-clear early on Saturday 14 November. Problems had begun on the evening of Thursday 12 November, UK time.
Microsoft has blamed the failure on a fault from an earlier network upgrade. It says the outage was not a cyber-attack and was not caused by AI agents. It has not yet published a full technical account. NHS staff went back to paper records and Japanese officials texted each other. The scale of the disruption has raised fresh questions about how far public services depend on a single supplier.
What failed and for how long
Microsoft 365 is a subscription bundle of office software. It runs on Microsoft's own servers, not on customers' machines. Much of the trouble centred on Exchange Online. This cloud service holds and delivers 365 users' email, calendars and contacts. Microsoft says about 430 million people use 365 apps.
Ookla, a network testing company, told DW the outage began at about 17:25 GMT on Thursday. According to the BBC, Microsoft first acknowledged at 17:54 GMT that users in the Americas could not reach their Exchange Online mailboxes. Soon afterwards it warned that the problem might be global. The outage tracker Downdetector recorded a peak of nearly 200,000 user reports shortly after 1pm New York time, The Hindu reported. DW said Downdetector logged more than 7.4 million reports during the outage.
Microsoft's early status updates, reported by CNBC, described a "number of servers being unexpectedly unavailable; straining the remaining infrastructure". Some servers were failing automated health checks. These are routine tests that decide whether a machine is fit to take traffic. A server that fails is taken out of rotation. The servers still running then take on more of the load. On Thursday evening Microsoft said it had "validated an alternative service health check method" and was rolling it out more widely.
Recovery came in stages. At 04:36 GMT on Friday, Microsoft reported only a "partial recovery", according to the BBC. The Hindu reported that consumer services had fully recovered by 16:10 GMT on Friday. Business and enterprise customers had to wait until Saturday morning.
What Microsoft has confirmed
On Friday a Microsoft spokesperson said: "We are deeply sorry for the disruption this incident has caused our customers and partners. We know the trust they place in our services and take that responsibility extremely seriously."
The company said the incident "was introduced by an issue during an earlier network capacity upgrade that surfaced" after a recent network change. It described the cause as "not related to cyber". It also said it had not detected any malicious activity. Early on Saturday it posted on its status page: "We have completed our efforts to address the underlying issue of the incident and restored service to the remaining impacted customers and regions." Microsoft says it will publish a full report when its review is finished.
So far Microsoft has given two partial explanations: servers failing health checks, and a faulty network upgrade. It has not said publicly how the upgrade led to the server failures. That link is the main question the report will need to answer.
Separately, The Hindu reported that top US officials said a Federal Aviation Administration outage was not caused by a Microsoft outage.
File photo of a server room at the BalticServers data centre, 2013; it is not related to Microsoft or the outage. Photo: BalticServers.com / Wikimedia Commons, CC BY-SA 3.0.
Who was affected
In the UK, NHS England uses Microsoft 365 under a five-year deal. Some hospital staff turned to paper records. One union said ambulance services had suffered a "serious impact", The Guardian reported. Some courts sent juries home early. At Minshull Street crown court in Manchester, staff went looking for a fax machine. The UK cyber minister, Liz Lloyd, said the effect on critical frontline services such as 999 calls had been "limited", according to the BBC.
Elsewhere, Japanese government email went down and staff fell back on text messages. The Australian Federal Police and Asio, Australia's domestic intelligence agency, were also affected. Staff at the US House of Representatives told Politico they had lost a day of work. A jail in Colorado could not take bond payments online. Canada's national rail operator warned that passengers might not receive trip emails. The Indian airlines IndiGo and Akasa Air reported problems with their email support services.
Companies felt it too. The Swiss luxury group Richemont published its earnings slightly late. The US electric truck maker Workhorse Group moved its quarterly results to 16 November because of the disruption.
The cost and the dependence question
In Australia, experts warned that the bill would be large, although no firm figure exists. "It's billions of dollars," Ashwin Pal, a risk advisory partner at RSM Australia, told ABC News. He said catching up on the backlog would add to the cost. He also warned that smaller firms on thin margins could be pushed over the edge.
The Australian Information Security Association warned that some staff had used personal email accounts and USB drives to keep working. Rajiv Shah, a board director of the association, said: "We need to understand how much additional cyber risk has been created." Prins Ralston, chief executive of the Australian Computer Society, asked: "who will answer for the lost productivity and the cost to the economy?" The society has renewed its call for a national review of sovereign risk in Australia's IT. Sovereign risk here means the exposure that comes from depending on foreign-owned technology.
Similar arguments are being made in Britain. Matt Saunders, field chief technology officer at the consultancy Adaptavist, told the BBC that running a second provider was rarely practical. "In the wake of this outage, organisations must have a plan in place for how to work without such tools, for when incidents like this occur," he said.
Microsoft shares traded largely flat on Friday, CNBC reported. According to DW, this was Microsoft's second major outage of the year.
What users should do, and what comes next
During the recovery, Microsoft extended the window in which delayed emails keep trying to deliver to 48 hours. That means most messages sent during the outage should eventually arrive. If an email was time-sensitive, it is worth checking with the recipient. It is also worth resending anything that bounced. IT administrators can follow the incident under reference MO1550821 in the Microsoft 365 admin centre.
Organisations whose staff used personal accounts or removable drives as workarounds should check where that data ended up. Australian security specialists made that point during the outage.
The next milestone is Microsoft's post-incident report. It should explain how a routine capacity upgrade could take out a service for more than a day. Hundreds of millions of people use that service. In the US, Representative Josh Gottheimer has asked for a briefing. In the UK and Australia, the outage has given new weight to calls for governments to review their dependence on a single supplier.
Featured image: Building92microsoft by Coolcaesar, via Wikimedia Commons, CC BY-SA 4.0.
