Nearly 130,000 reports of Microsoft 365 problems flooded outage-tracking platform Downdetector across 74 countries at the height of a global outage that began on Thursday, 12 November, and continued into Friday. The disruption affected users in multiple regions, including South Africa, and struck core business tools from Outlook to Microsoft Copilot.

Microsoft initially attributed the disruption to elevated infrastructure loads. The company later clarified that increased user traffic was not the cause. Instead, a number of servers had become unexpectedly unavailable.

What caused the outage?

Microsoft subsequently identified the failing component: a process on affected servers responsible for establishing secure connections (encrypted links between a client and a server). That process was becoming overwhelmed, causing servers to stop processing requests entirely.

The timing pointed to a recent change. Microsoft said a recent network configuration change correlated with the start of the disruption, and it moved to reverse it while preparing a separate configuration change to address the underlying problem. The company also restarted affected infrastructure.

Which services went down?

The outage primarily hit Exchange Online, Microsoft's cloud-based email service that underpins Outlook. The dependency cascade spread across the wider suite:

• Exchange Online and Outlook (primary impact)
• Microsoft Teams (partial)
• SharePoint Online
• Microsoft Copilot
• Planner
• To Do
• Elements of Microsoft Defender

Some functions survived. Microsoft said features of its services that did not depend on Exchange Online continued to operate. Teams messaging and online meetings remained largely functional, sparing real-time communication for many businesses.

Why did recovery prove difficult?

The first recovery attempts failed. Servers that Microsoft brought back online became unresponsive again when traffic was redirected to them, according to the company's service updates.

Microsoft responded with traffic management measures, redirecting connections to alternative infrastructure and restoring affected servers gradually rather than in a single wave. The approach aimed to prevent recovered servers from being overwhelmed a second time by returning demand.

Was it a cyberattack?

Microsoft said it had found no indication that the incident was caused by malicious or cyber activity. The failure traced back to internal infrastructure and configuration, not an external attack.

That distinction matters for corporate customers. The incident nonetheless adds to pressure on Microsoft over the resilience of its cloud infrastructure, on which a large share of global enterprise communication and email depends. Exchange Online sits at the centre of that dependency, as this outage demonstrated: when it faltered, at least seven other services lost functionality in whole or in part.

What happens next?

Microsoft has apologised for the disruption. The company said it would provide further information once its investigation had progressed, and it has indicated that a fuller post-incident report will detail the root cause and the measures taken to prevent a recurrence.

The Downdetector figures — nearly 130,000 reports spanning 74 countries at the peak — quantify the scale of the event. For enterprise customers, the post-incident report will carry particular weight: it must explain why a single overwhelmed connection process on a set of servers could take down email and collaboration tools for businesses across three continents, and why recovered servers could not immediately absorb redirected traffic.

Microsoft has not yet given a date for that report.