Almost 24 hours without Outlook: what the Microsoft outage of 12 November teaches you

Thursday 12 November, a quarter past five in the evening in Belgium. Outlook no longer opens, scheduling a meeting in Teams fails and Copilot does not answer. Not at one company, but worldwide. Only on Friday, around the same hour, does Microsoft report that the disruption is over. In this article I set out what happened, what was not the problem and what a business can learn from it.

What happened

The times below are Belgian time (CET) and come from Microsoft's own incident updates.

• Thursday 17:17: Exchange Online, the mail service behind Outlook, runs into trouble. Microsoft opens incident EX1550543.
• Thursday 19:26: the problem turns out to be wider. A second incident follows for the whole of Microsoft 365, MO1550821. Microsoft says users in any region may be affected.
• Friday during the day: Asia recovers first. Europe and North America take longer. For us, the outage fell right in the middle of the working day.
• Friday 17:10: the end of the impact according to Microsoft, almost 24 hours after it began.
• The night from Friday to Saturday: Microsoft marks the incidents as restored.

At the peak, Downdetector counted around 130,000 reports for Outlook alone. Those are reports from users, not a count of affected accounts, but they give an idea of the scale.

What stopped working, and what did not

The fault was in Exchange Online. Everything that relies on it went down with it.

• Outlook: on the desktop, on the web and on mobile. Mailboxes would not open and mail arrived late.
• Teams: scheduling meetings, invitations and calendars.
• Copilot: no answer, or no access to mail, calendar and files.
• Management and security: Microsoft also listed Defender, Purview, Intune and parts of the admin centre, among others.

Chat, calls and meetings in Teams mostly kept working. Files in SharePoint stayed available. Anyone who knew their appointments and kept their documents in SharePoint could carry on.

What was not the problem

With an outage this size, everyone thinks of an attack straight away. It was not one. Microsoft said there was no indication of malicious activity, and later stated explicitly that this was a technical issue unrelated to a cyberattack or to AI.

According to Microsoft, the cause lay in an earlier upgrade of network capacity. An issue from that upgrade surfaced after a recent network change. As a result, some servers were unexpectedly unavailable and the rest became overloaded. Microsoft first suspected extra traffic, but later withdrew that. The full report with the root cause and the measures taken is still to come.

No mail was lost either, as far as Microsoft reports. The period during which delayed mail is retried was extended to 48 hours. What was sent on Thursday evening arrived later.

What to learn from it

You cannot prevent an outage like this. You can make sure your business suffers less from it. This is what I would arrange.

1. Agree on a second channel

If mail and calendar disappear, how do you reach your staff and your clients? Keep a list of mobile numbers that does not live only in Outlook, and agree which channel you will use. It sounds trivial, until you need it.

2. Know where to look

The status of Microsoft 365 is on status.cloud.microsoft, even when your own admin centre will not load. As an admin you can have service health notifications sent by email. Have at least one delivered to an address outside Microsoft 365. Otherwise you will not get them exactly when you need them.

3. Leave the settings alone

During an outage at Microsoft it does not help to rebuild Outlook profiles, reinstall Office, reset passwords or change DNS settings. The problem is not on your side. Anyone who starts tinkering ends up with a second problem once the outage is over.

4. Be extra alert to phishing

Fraudsters use moments like these. Someone calls, supposedly from Microsoft, to help, or a colleague suddenly emails from a private address. Agree that nobody passes on codes or approves access at a caller's request. How these attacks work is explained in my article on the fake IT helpdesk.

5. Do not send confidential documents through private email

When company mail is down, it is tempting to send that contract through a private address or WhatsApp. That is how you lose control of your data. Wait, or use the channel you agreed on in advance.

6. Know what comes to a halt

Which of your processes depend on email? Orders, invoices, alerts from your systems? If you know that in advance, you can decide what can wait a day and what cannot. If NIS2 applies to you, you have to be able to show this anyway. More on that in my article on NIS2.

7. Check your contract

In its agreement, Microsoft promises a certain availability per month. After an interruption of almost a day, you may be entitled to a service credit. It does not come automatically: you have to claim it yourself, and there is a deadline. Ask your licensing partner to look into it.

So is the cloud a bad idea?

No. Your own mail server fails too, and then you are on your own. But this outage does show that "it is in the cloud" is not a plan. A backup of Microsoft 365 would not have helped here, by the way: your data was not gone, you just could not reach it. What does help is knowing what you do when it drops out.

Conclusion

Microsoft fixed the problem and nothing was lost. The question is what your business did during those 24 hours. Could everyone carry on, or was everyone waiting? If it was the latter, now is the time to sort it out, while it is still fresh in everyone's mind. Would you like to look at it together? Send me a message.