Waking up to a Microsoft 365 outage? Here's what happened and what to do

What happened

In the early hours of 13 November 2026 (Manila time, UTC+8), Microsoft 365 users around the world had trouble reaching email, Teams and other work apps. Microsoft is tracking it as two related incidents in the Microsoft 365 admin center: EX1550543 for Exchange Online mailbox access, and a wider incident, MO1550821, for multiple Microsoft 365 services.

Microsoft opened the Exchange Online incident at 12:17 AM (PHT), according to the start time on the admin-centre record. Its first public status post, at 1:54 AM, said it was investigating reports of users who could not reach Exchange Online mailboxes "through multiple connection methods in the Americas." Those methods, in Microsoft's own list, include Outlook on the web, MAPI (used by desktop Outlook), Exchange ActiveSync on phones, and the REST API.

Thirteen minutes later, at 2:07 AM, Microsoft said the issue "may affect Microsoft 365 service connectivity for users in any region." A wider incident, MO1550821, has a start time of 2:26 AM, and Microsoft named it publicly at 2:35 AM. The official list of potentially affected services at that point included Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, Microsoft Defender XDR, Planner, To Do, Intune, Microsoft Defender for Office 365, several Microsoft Purview services, some Power BI label exports, the Microsoft 365 Apps admin center, Universal Print, and, for a subset of tenants, Windows 365 Cloud PCs that use Purview Customer Key.

Public outage trackers recorded a sharp rise in reports around 2:00 AM (PHT), shortly after 1 p.m. in the eastern United States. ABC News said more than 120,000 Outlook reports were logged on Downdetector US, plus more than 45,000 reports for Microsoft 365. The Guardian put the peak at nearly 130,000 reports of trouble accessing the 365 suite, including Outlook and Teams. CNBC reported about 130,000 Outlook reports.

On the cause, Microsoft has been careful, and so are we. It first described "elevated load across multiple regions," then clarified that the load was "not driven by an increase in traffic, but by a number of servers being unexpectedly unavailable," which strained the machines that were still up. Some of those servers were failing automated health checks. Microsoft paused deployments, moved traffic, restarted servers, tried an alternative health-check method, and considered reverting a small number of recent configuration updates. At 6:09 AM it said the actions taken so far had "not provided the anticipated relief," and that a core process on the affected servers was becoming overwhelmed.

A partial recovery followed at 7:04 AM, with a portion of servers back and "limited recovery". At 8:06 AM, Microsoft said some of those returned servers were becoming unresponsive again once they received traffic. It began limiting certain types of traffic in specific locations and rebuilding a subset of servers on a previous configuration.

At 9:01 AM, Microsoft said it had "reviewed known impact scenarios and revised the list of impacted services and features," pointing to MO1550821 and the public status page.

Later in the morning, Microsoft reported some progress, then setbacks. At 9:59 AM, it said it was "seeing positive results" with restarting affected infrastructure "in an isolated manner," and was monitoring those systems to verify stability. At 10:29 AM, it said it was applying "infrastructure capacity improvement where possible to help support traffic in regions coming online." At 11:13 AM, Microsoft said the changes applied "to improve serviceability" were "not taking as expected," and that it was identifying other ways to increase capacity "in the face of sustained traffic management imbalances." At 11:48 AM, it said it was reviewing traffic flows "to identify opportunities to optimize routing" and "verifying the reasons for service failures" so it could "develop specific actions to improve stability."

The public status feed, dated 12:22 PM (PHT) in Microsoft's RSS, still described service degradation. Microsoft said it is "continuing our efforts to improve server stability to improve traffic flow," including "adjusting traffic protocols, redistributing traffic, and applying strategic traffic blocking measures." It reported "partial recovery across regions in which we've applied these adjustments," but added that "these actions aren't resulting in sustained recovery." A further official update was due by 1:00 PM (PHT). As of 12:40 PM (PHT), that was still the official picture, and the status page still showed service degradation.

On the revised list, Microsoft said features of the listed Microsoft 365 services "that interact with Exchange Online and email services are impacted," and that "elements of those services that do not depend on interaction with Exchange Online remain functional." For Microsoft Teams, its latest public status note says most core functions, "including joining calls, meetings, group chats, and channel messages are not impacted," while Exchange-dependent scenarios such as calendar and meeting scheduling may fail. For SharePoint Online, "accessing files stored directly in SharePoint Online remains functional." Microsoft also said email delivery may be delayed, and that admins may be unable to load some Microsoft 365 admin center pages. The revised list also names Microsoft 365 apps (recently used files), Microsoft 365 Education, Microsoft Fabric, and Microsoft Graph requests that access Exchange Online data.

Overnight and morning timeline (PHT, 13 November 2026)

Time (PHT)	What Microsoft said
12:17 AM	Exchange Online incident EX1550543 starts in the Microsoft 365 admin center. Users may be unable to connect via Outlook on the web, MAPI, Exchange ActiveSync or the REST API.
1:54 AM	First public post: investigating mailbox access issues "in the Americas," under EX1550543.
2:07 AM	The issue "may affect Microsoft 365 service connectivity for users in any region."
2:26 AM	Wider incident MO1550821 starts, covering multiple Microsoft 365 services. Named on the public feed at 2:35 AM, with "elevated load across multiple regions."
2:48 AM	Microsoft begins redistributing traffic worldwide, and points people to the public status page if the admin center is not available.
3:12 AM	Deployments paused; more traffic moved off the affected infrastructure; servers being restarted.
3:31 AM	The load "isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable."
3:50 AM	Servers are failing automated health checks; Microsoft tests a configuration change and continues restarts.
4:19 AM	No recent change has been correlated with the start of the impact. Investigation points to a component that processes server health.
5:00 AM	An alternative health-check method returns a subset of servers. Automated recovery is being prepared.
5:40 AM	Restarts continue. Microsoft assesses whether reverting a small number of recent configuration updates could speed recovery.
6:09 AM	Actions so far "have not provided the anticipated relief." A core process on affected servers is becoming overwhelmed.
7:04 AM	A portion of servers are back and "remain stable so far," with limited recovery.
8:06 AM	Some returned servers become unresponsive again under traffic. Microsoft limits some traffic types in specific locations and starts rebuilding a subset of servers on a previous configuration.
8:56 AM	Status page updated: Microsoft has reviewed known impact scenarios and revised the list of impacted services and features. Work continues to isolate the issue affecting server availability.
9:01 AM	Public post confirming the revised list, pointing to MO1550821 and the public status page.
9:59 AM	"Positive results" from restarting affected infrastructure in isolation; Microsoft is monitoring those systems to verify stability.
10:29 AM	Applying infrastructure capacity improvements to help support traffic in regions coming online.
11:13 AM	Changes to improve serviceability "not taking as expected." Identifying other ways to increase capacity amid "sustained traffic management imbalances."
11:48 AM	Reviewing traffic flows to optimize routing and to verify the reasons for service failures.
12:22 PM	Public status feed updated: adjusting traffic protocols, redistributing traffic, and applying traffic blocking. Partial recovery in some regions, but not sustained. Next official update due by 1:00 PM (PHT).
12:40 PM	Our last check: the public status page still shows service degradation.

Times from 1:54 AM onwards are from Microsoft's @MSFT365Status posts, which we fetched and timestamped, and from Microsoft's public status RSS feed for the 12:22 PM entry. The 12:17 AM and 2:26 AM start times come from the incident records in the Microsoft 365 admin center (a public extract of those records lists the UTC start times).

A separate Teams incident in North America, TM1550488, ran from 11:40 PM on 12 November to 1:09 AM on 13 November (PHT) and was marked resolved before this outage was made public. Microsoft has not linked the two, and we are treating them as separate.

What our support team saw overnight

Our support team was monitoring this from 2 AM (PHT) and confirmed tenants from the US through to Australia were affected.

That matches what Microsoft said at 2:07 AM, and what was being reported as the night went on: CNBC in the United States, The Guardian in the United Kingdom and globally, and ABC News in Australia.

There is not much an individual organisation can change on its own tenant to clear a fault like this. Even Microsoft's admin centre can be hard to reach during a wide incident, which is why Microsoft also publishes a public status page. The useful work, overnight and today, is to confirm it is a provider issue, tell people what is going on, and keep a simple way to reach staff if email or Teams is slow.

What to do now

1. Confirm it on the official status page. Use status.cloud.microsoft/m365, or Service health in the Microsoft 365 admin center if it loads, before you raise tickets or start changing settings. Look for EX1550543 and MO1550821.
2. Tell staff it is a provider issue, not their laptop. Switching to Outlook on the web may not help, because Microsoft listed it among the affected connection methods. Changing passwords or tenant settings will not bring the service back, and it can add confusion while Microsoft is still recovering.
3. Watch for copycat phishing. During an outage, unexpected "fix your mailbox," "re-authenticate now" or "your email will be deleted" messages often appear. Tell staff not to click those, and not to reset passwords because of an unexpected email or pop-up. If you need to share an update, send it on a channel you already use, such as a team chat group or an SMS list.
4. Expect mail to be delayed, not lost. In an Exchange Online degradation, messages typically queue and arrive once capacity returns. Microsoft has not published a specific statement on message loss for this incident, so treat that as an expectation. After service recovers, check Sent Items and wait before resending.
5. Keep an out-of-band channel handy. If email is delayed, or if Teams calendar and scheduling fail, you still need a way to reach people that does not run on Microsoft 365: a chat group, a phone tree or an SMS list, plus a one-page note that says who confirms a provider outage, who talks to staff, and where official status is checked. Microsoft said most core Teams functions, including joining calls, meetings, group chats and channel messages, are not impacted.

How ARA Industries can help

ARA Industries is Manila-based and works worldwide, and we welcome businesses from any country.

Our support team watches provider status when something like this starts, including overnight, so we can tell you whether what you are seeing is local or global. We can help you read the official status posts, draft a short staff message, and put a simple continuity note in place for the next time a cloud service stumbles.

If you would like a calm review of how your organisation would cope with a provider outage — backups, admin access, and how you would reach people if email is down — start with our fixed-scope cyber health check. Or Usap Tayo: book a short call and we will talk through it.

Sources

1. Microsoft, Service health status. status.cloud.microsoft/m365 (checked 13 November 2026, 12:40 PM PHT; still showing service degradation). Public RSS: status.cloud.microsoft/api/feed/mac (item dated 12:22 PM PHT; current status still describes service degradation, with a further official update due by 1:00 PM PHT).
2. Microsoft 365 Status (@MSFT365Status) on X, posts from 1:54 AM to 11:48 AM (PHT) on 13 November 2026, including the first public post, the 6:09 AM "anticipated relief" update, the 7:04 AM partial recovery, the 8:06 AM update, the 9:01 AM revised impact list, the 9:59 AM isolated restart, the 10:29 AM capacity update, the 11:13 AM "not taking as expected" update and the 11:48 AM routing review.
3. University of Pennsylvania, public extract of Microsoft 365 admin-centre incident messages for EX1550543 and MO1550821 (start times and connection methods). mailservices.isc.upenn.edu
4. The Guardian, "Microsoft begins restoring services amid global outage affecting Outlook and Teams," 12–13 November 2026. theguardian.com
5. ABC News (Australia), "Microsoft platforms including Outlook suffer widespread outages," 13 November 2026. abc.net.au
6. CNBC, "Widespread Microsoft outage takes down Outlook and other 365 services," 12 November 2026. cnbc.com

Sources checked 13 November 2026, 12:40 PM (PHT). Official status may change; prefer Microsoft's page over this article for the live picture.