Early on November 14, Microsoft confirmed that Microsoft 365 services had fully recovered, with Outlook, Teams, Copilot and other apps back online, ending a global outage that lasted more than 36 hours. The official Microsoft 365 Status account posted the same day that it had completed work on the underlying issue and restored service for the remaining affected customers and regions. It was Microsoft's longest service outage in recent years, reaching more than 70 countries, with email, meetings and AI assistants failing at the same time.
What happened during those 36 hours
The outage began on November 12. At around 11:17 a.m. Eastern Time, Exchange Online ran into trouble first, and by 1:26 p.m. it had widened into a Microsoft 365-wide incident. Outlook, Teams calendars and meeting scheduling, SharePoint, Microsoft 365 Copilot and Defender XDR were all affected; Copilot chats would not load and could not reach email, calendars or files. Just days earlier, Claude Fable 5.2 had arrived in Microsoft Copilot, deepening workplaces' reliance on it. At the peak, third-party monitoring service Downdetector logged as many as 138,000 outage reports for Outlook alone. Microsoft restored service in stages: deploying a patch, gradually bringing traffic back, and clearing the email backlog, while extending the email timeout window to 48 hours. Consumer services fully recovered first, at 4:10 p.m. UTC on November 13, with enterprise services following.
Not hackers, and not AI agents either
Microsoft traced the cause to a flaw left behind by an earlier network capacity upgrade: the upgrade planted the fault, and a later network change exposed it, taking several backend servers unexpectedly offline and leaving the remaining ones unable to handle the traffic. Engineers then deployed a patch targeting the authentication and routing components. Microsoft has been adjusting its cloud capacity lately, having decided not to renew its Oracle AI capacity, partly because older chips could not keep up with demand. Microsoft also ruled out two theories at once: there was no evidence of malicious activity and the incident was unrelated to a cyberattack, and it was not linked to AI agents either. A full post-incident report is still being written, and Microsoft has given no publication date.
For administrators, the next step is to watch incident IDs EX1550543 and MO1550821 in the Service health center, where Microsoft says the promised post-incident report will appear. Ordinary users still seeing delayed mail should check spam and inbox sorting first — backlogged messages are being delivered in send order, so they may arrive later than their original send time.
