Microsoft 365 outage hits Outlook, Teams, and Copilot as servers fail health checks

Documented: On November 12, 2026, Microsoft confirmed a multi-region Microsoft 365 connectivity failure that blocked access to Exchange Online mailboxes and spread to other cloud services. The company tracked the mailbox problem as EX1550543 and the broader incident as MO1550821 in the Microsoft 365 admin center. Microsoft 365 Status first described issues accessing Exchange Online mailboxes through multiple connection methods in the Americas, then said the problem might affect Microsoft 365 connectivity for users in any region.

Documented: Microsoft’s own updates said a portion of infrastructure was under elevated load across multiple regions, and that engineers had begun redistributing connection traffic across worldwide infrastructure to balance that load. Later the same day the company revised that account: the elevated load was not driven by an increase in traffic, but by servers that became unexpectedly unavailable and failed automated health checks, shifting load onto the systems that remained. Microsoft said it paused deployments and configuration changes, restarted affected servers, and tested an alternative health-check method that returned a subset of servers to service and was being applied more broadly. As of mid-afternoon Eastern time, Microsoft had not named a root cause and had not said the outage was fully resolved. SecurityWeek reported that Microsoft disclosed no evidence of a cyberattack.

Documented impact: Microsoft’s service notices listed potential effects on Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, and Microsoft Defender XDR. Reporting by The Guardian, Al Jazeera, and WebProNews, citing Downdetector, put user reports near 130,000 around the peak, concentrated on Outlook and other 365 apps. WIRED and Forbes described the disruption as ongoing hours after the first public acknowledgment, with users unable to send or receive mail or open inboxes. Caltech’s IT office republished Microsoft’s status language the same day, including the pause on deployments while recent changes were reviewed for any correlation.

Claimed versus not established: User-report counts on Downdetector are crowd-sourced signals of trouble, not a census of affected accounts. Microsoft’s statement that the issue “may affect” users in any region is a scope warning, not a measurement of how many organizations lost service. No public Microsoft post in the day’s updates identified a specific code change, capacity miscalculation, or external event as the origin of the failed health checks. Speculation that the outage proves a single point of failure for “billions” of users, or that it was an attack, goes beyond what Microsoft and the cited reporting established on November 12.

The operational detail that matters is narrower than a slogan about cloud fragility. Microsoft described a feedback loop inside its own control plane: servers dropped out of automated health checks, remaining capacity absorbed their traffic, and connectivity errors followed. Mitigations were traffic redistribution, restarts, and a bypass of the health-check component—not a claim that demand suddenly spiked. That is a documented infrastructure failure with a partial public timeline, not an unexplained anomaly and not, on the evidence published that day, a confirmed security incident.