Microsoft 365 Outage: Exchange Online Disruption, No Sign of a Cyberattack, and a SaaS Concentration Lesson

Status (13 November 2026, 19:57 Asia/Jerusalem, UTC+2): Rescana status: Monitoring. Microsoft's public status page lists Microsoft 365 as "Service degradation" and says: "We are seeing broad recovery and stability across our services." It also says: "We have addressed the underlying issue and continue to restore service to remaining customers and regions." Microsoft says: "This was a technical issue not related to cyber or AI / agents." Microsoft says: "The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change." Microsoft says it will publish a full post-incident report once its review is complete. There is no CVE for this incident.

TL;DR: From the evening of 12 November 2026 (Asia/Jerusalem time), Microsoft 365 users in any region could lose access to Exchange Online mailboxes. Features that depend on Exchange Online also failed in other services, including Teams calendars, Copilot, and parts of Microsoft Defender and Purview. Microsoft says a number of servers became "unexpectedly unavailable" after failing automated health checks, straining the rest. Microsoft now says the incident "was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change." Microsoft says this "was a technical issue not related to cyber or AI / agents", and that Teams calls, meetings and chats, and files stored directly in SharePoint Online, have largely kept working. What to do now (Rescana guidance): follow Microsoft's service health updates, keep security controls switched on while services recover, and check how much of your business, and your suppliers', runs through one productivity platform.

Technical Information

Problems began on the evening of 12 November (Asia/Jerusalem time), according to The Register, and were first flagged in the US and the Americas before spreading around the world (TechCrunch). Microsoft posts updates on its public status page at status.cloud.microsoft.

What Microsoft says caused it

Microsoft says: "The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change." Its earlier updates, as reported by the press, described the investigation:

• It reported "elevated load across multiple regions", caused by a "number of servers being unexpectedly unavailable; straining the remaining infrastructure" (CNBC).
• It blamed "a problem that's causing servers to fail automated health checks and become unavailable", and said the failed checks "may originate from a specific component that's responsible for processing server health" (The Register).
• Its status page said it was "assessing whether reverting the small number of recent configuration updates we identified could help accelerate recovery" (The Register).
• It said restored servers "can become unresponsive again once they begin receiving traffic", and that "a core process on the affected servers is becoming overwhelmed" (The Register).

Some press describes a configuration or "settings" problem (The Guardian).

No indication of a cyberattack

Microsoft's status page says: "This was a technical issue not related to cyber or AI / agents." The BBC and The Guardian also report no indication of a cyberattack. This is an availability incident; no data theft or unauthorized access has been reported.

Timeline

Times are Asia/Jerusalem (UTC+2), converted from press reports by The Register, TechCrunch, CNBC and The Guardian; the last line is from Microsoft's status page.

• 12 November, about 20:00: Problems begin, first flagged in the Americas, then spread to other regions.
• 23:00: Microsoft says an alternative health-check method has returned some affected servers to service.
• 13 November, by 01:06: Microsoft's status page says its actions so far "have not provided the anticipated relief".
• Shortly before 14:00: Services start to recover; Microsoft says email queues are "approaching normal levels", though intermittent issues are expected as recovery continues.
• 19:57: Status page still shows "Service degradation"; next update due by 22:00.

At Microsoft's 19:57 update, the incident had been open for nearly 24 hours; services began recovering after roughly 18 hours. Not yet known: when full service will return. Microsoft says email delivery "may be delayed"; it has not said mail was lost.

Affected Product Versions

This is a cloud service incident; there are no versions to patch. Microsoft says the impact is on features "that interact with Exchange Online and email services", and that elements that do not depend on Exchange Online "remain functional."

TechCrunch also reported that the outage hit consumer as well as business email, files and documents (TechCrunch). The Guardian reports that Microsoft 365 connectors used by OpenAI and Anthropic were also affected.

Workaround and Mitigation

Microsoft's guidance

Microsoft has not published a general workaround. Its Fabric workaround, removing a sensitivity label, applies only "if their organization's data protection policies allow it".

Rescana guidance

• Keep security controls on. If email security or data protection features are failing, do not switch off protection policies as a shortcut. Wait for recovery, and route urgent exceptions through your normal approval process.
• Use official channels. Tell staff to get outage updates from your IT team and Microsoft's own status channels.
• Check what queued up. After service returns, review delayed email, failed Graph or connector jobs, and anything automated that depends on mail or calendar, such as approvals, ticketing and alerting.

Concentration risk and continuity (Rescana guidance)

For a Microsoft 365 customer, one platform can carry email, calendars, chat, files, AI assistants and part of the security stack. When the email layer degraded, dependent features failed elsewhere too, including parts of the security tooling used to triage email threats. That is the same lesson as our Bullhorn outage advisory: when one SaaS supplier runs a whole workflow, an outage at that supplier stops all of it at once. (Background: concentration risk.)

• Map which critical processes depend on Microsoft 365 end to end, including customer communications, approvals and security alerting.
• Agree and test a fallback channel for urgent communication, and check whether your security alerting relies on email through the same platform.
• Put the same questions to suppliers that run on Microsoft 365, so you can see where one outage reaches you both directly and through your supply chain.

Indicators of Compromise

Not applicable. Microsoft says this "was a technical issue not related to cyber or AI / agents", and no indicators of compromise have been published. We have none to list and have not inferred any.

What to Ask Your Suppliers Today

Ask suppliers that handle your orders, support, payments or data:

1. Were you affected by the 12–13 November Microsoft 365 outage, and which of your services to us were affected? Ask for the time window and any customer-facing impact.
2. Did any email to or from us get delayed or fail? Ask them to check invoices, purchase orders and security notifications once service returns.
3. What is your fallback when your productivity or email platform is down? Ask how they reach customers and run support.
4. Did you relax any security controls to keep working? If they did, ask when the controls were restored.

Track incomplete answers to closure.

Need help finding which of your suppliers depend on Microsoft 365 and tracking their answers about the 12–13 November outage? Our team can help you prioritize them. Talk to an expert

Sources

• Microsoft service health status: Microsoft 365 status entry last updated 13 November 2026, 19:57 Asia/Jerusalem time (17:57 UTC).
• BBC: updated 13 November 2026.
• The Guardian: 13 November 2026.
• TechCrunch: 13 November 2026, updated 19:53 Asia/Jerusalem time.
• CNBC: updated 13 November 2026.
• The Register: 13 November 2026, updated 02:41 Asia/Jerusalem time.