Field Notes / Outage
Microsoft 365 went down for more than eleven hours. Your email security went down with it.
On 12 November Outlook, Teams, SharePoint and Copilot failed for users in 74 countries. Fewer people noticed that Defender, Purview and Intune stumbled too. Here is what Microsoft has confirmed, what an outage does to your defences, why the phishing comes next, and six things to set up before the next one.
01 What Microsoft has confirmed
he trouble started in the Americas. Microsoft first saw Exchange Online mailbox problems there, then widened its warning to users in any region BleepingComputer . Here is the sequence the public reporting supports so far.
| When (12 Nov, US Eastern) | What happened |
|---|---|
| 9:45 to 10:53 AM | An earlier Teams incident (TM1550488) disrupts chat. Microsoft resolves it. |
| Around 1 PM | Outlook reports on Downdetector surge to about 130,000. Microsoft opens Exchange Online incident EX1550543. |
| 1:26 PM | Start time Microsoft gives for advisory MO1550821: Exchange Online, Teams, SharePoint Online, Copilot, Defender XDR. |
| Evening | Microsoft blames “elevated load”, then servers “unexpectedly unavailable”. It pauses deployments, moves traffic and restarts servers. |
| Overnight | Microsoft rolls back a recent configuration change that coincided with the start. Early Friday it says fixes are not working as expected. |
Microsoft has not published a root cause. It says it is not aware of any malicious activity behind the incident IT-Connect , and SecurityWeek notes the advisories report no evidence of an attack SecurityWeek . Treat the configuration rollback as a working theory until the post-incident report lands.
The damage reached beyond Microsoft customers. SecurityWeek reports that some Google Workspace users could not reach their own mail through the Outlook desktop and mobile apps SecurityWeek . If your staff read any mailbox through Outlook, they felt it.
02 The security tools went down too
Most coverage counted the lost meetings. The security list matters more. IT-Connect’s reading of Microsoft’s status updates names four controls that slowed or failed IT-Connect :
- Defender for Office 365. Safe Links, quarantine release and message trace were delayed. Safe Links is the check that stops a staff member opening a malicious link from an email.
- Purview. Data loss prevention, sensitivity labels and eDiscovery were affected. Those are the rules that stop a confidential file leaving the company.
- Intune. Device enrolment and compliance checks failed on and off. Conditional access decisions lean on those checks.
- Defender XDR. Listed in the main advisory alongside Exchange and Teams BleepingComputer .
03 The phishing comes after the outage
Criminals read the same headlines you do. When the CrowdStrike update crashed millions of Windows machines in July 2024, the UK National Cyber Security Centre judged it was not a cyber attack, and in the same statement warned of an increase in phishing that referred to the outage NCSC, 19 Jul 2024 . Within days, criminals were registering look-alike domains and offering fake fixes Computer Weekly .
A Microsoft 365 outage hands an attacker an even better script. Every member of staff just spent a day unable to sign in. An email that says “Service restored. Sign in again to resync your mailbox” matches what they expect to see. The link leads to a copy of the Microsoft login page that captures the password and the MFA code in real time. One reused session gives the attacker the mailbox, the files and the Teams chats.
The phone version works too. A caller who says they are from IT, and knows there was an outage, can ask a tired employee to read out the code that just arrived. Our pretexting field note shows how little an attacker needs to make that call convincing.
04 One supplier, every channel
Look at what failed together: email, chat, file sharing, the AI assistant, device management and part of the security stack. In many companies that is also the channel the incident plan relies on. If the plan says “email the team” and “start a Teams call”, the plan went down with the outage.
Regulators have started to treat this as a security question. In the EU, DORA requires financial firms to manage concentration risk in their ICT suppliers, and NIS2 asks essential and important entities to cover supply chain security and business continuity. You do not need to be regulated to borrow the logic. One supplier holding every channel is a single point of failure, whether the cause is a bad configuration change or an attacker.
A red team exercise tests this directly. We can play an attacker who waits for an outage, or who causes confusion that looks like one, and measure whether your team can still talk, decide and spot the fake “service restored” email. You get a timestamped record of what worked and what broke. See how a red teaming engagement runs.
05 Six things to set up before the next one
Microsoft will publish a root cause, and the next outage will have a different one. These six steps work whatever the cause.
- Send staff one rule now: IT will never ask you to sign in again through a link in an email, chat or text. Status lives at the official Microsoft status page, typed by hand
- Agree a second channel for incidents that does not run on Microsoft 365: a phone tree, an SMS group or a messaging group on another provider. Test it once
- Keep an offline copy of your incident plan and key contacts, printed or on a device that does not sync through OneDrive
- List which security controls depend on Microsoft 365: mail filtering, link checking, DLP, device compliance, alerting. Write down what you watch manually when they are down
- Check your two break-glass admin accounts: excluded from conditional access that depends on Intune, protected by phishing-resistant MFA, and tested in the last 90 days
- After service returns, review sign-ins for the following 72 hours: new devices, new countries, new inbox rules. That is where an outage phish shows up
If you only do one, do the first. It costs one email and it takes the best lure of the week away from every attacker who read the same headline.
Want to know whether your staff would fall for the “service restored” email, and how far one captured login would reach? Start with our free external exposure audit, or book a penetration test that includes a phishing scenario. You get the names of the controls that held, the ones that failed, and the fix for each.
Questions readers ask
What happened in the Microsoft 365 outage on 12 November 2026?
Microsoft 365 services failed for users worldwide from the afternoon of 12 November 2026 (US Eastern time). Microsoft says incident MO1550821 began at 1:26 PM ET. Exchange Online, Outlook, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR were affected. Downdetector logged about 130,000 Outlook reports shortly after 1 PM ET, and reports came from 74 countries and territories. More than 11 hours after it began, Microsoft had not confirmed full recovery.
What caused the Microsoft 365 outage?
Microsoft has not published a root cause yet. It first described “elevated load” on its infrastructure, then said a number of servers had become unexpectedly unavailable. It paused deployments, redistributed traffic, restarted servers and began rolling back a recent configuration change that coincided with the start of the incident. A post-incident report is expected.
Was the Microsoft outage a cyberattack?
Microsoft has reported no evidence of malicious activity. It said it was not aware of any malicious activity causing the incident. That is not a formal ruling-out, so wait for the post-incident report before drawing conclusions either way.
Which security features were affected by the Microsoft 365 outage?
Microsoft Defender XDR was listed in the advisory. IT-Connect reported delays in Defender for Office 365 features such as Safe Links, quarantine release and message trace, disruption to Purview data loss prevention, sensitivity labels and eDiscovery, and intermittent problems with Intune device enrolment and compliance.
How do I protect my business against phishing after an outage?
Tell staff before the next outage that IT will never ask them to sign in again through a link in an email or chat. Check service status only in the Microsoft 365 admin centre or the official status page, typed by hand. Keep MFA that resists phishing on admin accounts, and agree a second channel, such as a phone tree or a messaging group outside Microsoft, for incident updates.
References
Sources
- BleepingComputer. “Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide.” 12 November 2026. bleepingcomputer.com
- SecurityWeek. “Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams.” 12 November 2026. securityweek.com
- De Michele, S. “Microsoft outage hits Outlook, Teams and Copilot, disrupting thousands.” Euronews, 12 November 2026. euronews.com
- IT-Connect. “Microsoft 365 outage hits Outlook, Teams and Copilot for 11 hours.” 13 November 2026. it-connect.tech
- National Cyber Security Centre (UK). “Major IT outage.” Statement, 19 July 2024. ncsc.gov.uk
- Computer Weekly. “NCSC: Beware of criminal CrowdStrike opportunists.” July 2024. computerweekly.com
Close the gap this note describes
- Penetration testing You see the way in an attacker would use today, how far it reaches and what to close first.
- Free audit We map what you expose to the internet and send back the routes in, ranked by what each one reaches.
- Dark web check for partners For IT providers: name one client and we sweep breach dumps and forums for their leaked credentials.
