Microsoft 365 and Outlook global outage: everything we know so far

If you can’t open Outlook, send an email, or pull up a Teams calendar this morning, you’re not alone. A Microsoft 365 outage that started Thursday at 16:17 UTC is still dragging on more than 18 hours later. Microsoft says recovery is moving in phases and some services look a little healthier, but capacity is not back to normal.

The public status page still lists Microsoft 365 as degraded. Azure, for what it’s worth, is not part of this one.

What’s actually broken?

The buzz online is mostly surrounding Outlook, and that’s understandable. People can’t reach their mailboxes through Outlook on the web, the desktop app, or mobile, and messages that were already sent may be sitting in a queue.

Microsoft has stretched the email timeout window to 48 hours so those delayed messages have a better chance of arriving once service returns. That said, this problem isn’t limited to Microsoft’s email service.

Anything that leans on Exchange Online has been wobbly: Teams calendars and meeting scheduling, Copilot Chat, some SharePoint sharing, Microsoft 365 admin center pages, Intune device enrollment, and Purview and Defender tools, including Safe Links, which may not be checking URLs clicked in Outlook and Teams.

Core Teams calls, group chats, and channel messages have mostly kept working, and files stored directly in SharePoint have stayed reachable. Given that over 430 million people use Microsoft 365, this is a major disruption.

When did this start, and how did it spread?

Microsoft’s Exchange Online incident, EX1550543, is timestamped at 16:17 UTC Thursday. The first public post from Microsoft 365 Status went up at 17:54 UTC and described mailbox problems “in the Americas.” Thirteen minutes later, the company said users in any region could be affected. A broader Microsoft 365 incident, MO1550821, opened at 18:26 UTC.

Downdetector shows reports reached 74 countries and territories in about an hour, and Outlook complaints in the United States peaked around 130,000.

So what actually broke?

This was not a cyberattack, at least according to Microsoft. Charles Lamanna, executive vice president of Copilot, Agents and Platform, replied to the status account Thursday night:

We regret that today’s outages caused disruptions for our customers, and we are working to address the issue. We will continue to share more information as soon as we have it, and for now I can confirm that there is no indication this is the result of malicious or cyber activity.

Satya Nadella has not posted about the outage, and neither have other high-profile Microsoft executives.

Microsoft’s own investigation, shared through a series of service-health updates, points to an internal infrastructure issue. Many servers failed automated health checks and went offline. As a result, the remaining machines had to handle more of the load and began experiencing connectivity errors. The issue wasn’t caused by a surge in user traffic.

Engineers later explained that a process on the affected servers that helps establish secure connections was becoming overwhelmed, causing the servers to stop handling requests. They also began rolling back a recent network configuration change that coincided with the start of the outage. Australia’s Home Affairs Minister Tony Burke reportedly said Microsoft told him it looked “similar to what we saw with respect to CrowdStrike where there is an update that has gone awry.”

Why is this taking so long to fix?

Microsoft has restarted servers, shifted traffic, isolated parts of the network, rolled back configuration changes, and applied a patch to an “upstream authentication/routing configuration component.” Some of those steps looked promising at first. Then the servers that came back went unresponsive again once live traffic hit them.

Here’s what Microsoft 365 Status had to say about it:

The servers we returned to service can become unresponsive again once they receive traffic; we’re analyzing diagnostic data to determine what’s triggering the behavior.

That update, and the later admission that earlier changes were “not taking as expected,” is what set off a lot of the frustration online. Artem Russakovskii wrote, “This is the most insane outage I’ve seen in a while. Microsoft’s thousands of engineers can’t figure out why the servers are becoming unresponsive after coming back online for half a day now and counting.”

As of 10:28 UTC Friday, Microsoft said recovery is “progressing in phases” with “incremental improvement in several workloads,” but “service health remains variable and capacity has not yet fully returned to baseline.” A post-incident report is promised after the incident is fully mitigated. There is still no estimated time for a complete recovery.

Who is impacted by the outage the most?

After scanning and reviewing multiple reports, it looks like there’s a long list of affected parties. In the United States, city governments in places like Miami Beach, Austin, Jacksonville, Baltimore County, and several California cities told residents to call instead of email. Workhorse Group, an electric-vehicle maker, postponed its earnings call to Monday.

In the UK, the outage has hit NHS email, which the National Pharmacy Association says may delay some more complex prescriptions. Some hospitals have gone back to paper. The GMB union said NHS 111 and 999 referrals were backing up, though emergency call-outs appeared unaffected. Schools asked parents to phone in absences. Parliament said alternative arrangements were in place. Rail passengers were told they might not get ticket emails.

Airlines including IndiGo, Akasa Air and CemAir reported email-support problems, but not flight cancellations. Japan’s government shifted some work to paper. Courts in the Philippines were delayed. Australia’s federal police and security services were among the agencies affected.

Banks have also been warning customers about phishing. If someone calls offering to “fix” your Microsoft account, hang up.

If you’re waiting on an important email, give it time. Microsoft is holding messages in queue for up to 48 hours. For meetings, a phone call or a non-Microsoft chat tool is the safer bet until Outlook and Teams calendars come back cleanly. And keep an eye on status.cloud.microsoft and the @MSFT365Status account, since the Microsoft 365 admin center itself has been unreliable during the incident.