By Amara Osei

More than 130,000 Outlook users reported problems accessing the online portal at one point Thursday, as a global Microsoft disruption affected Outlook and other Office 365 applications (email, collaboration and storage software). Downdetector, a service-status tracking platform, said the incident reached at least 74 countries, from Asia to North America, within one hour on Thursday.

The affected user base included companies, governments, schools and millions of users of tools such as Teams and OneDrive. Across at least 74 countries, that reach produced severe disruption across Microsoft’s software portfolio, although the technical trigger remained unclear.

Was the outage malicious?

Microsoft said at 6:11 a.m. Friday: “At this time, we have no evidence of malicious activity associated with this incident.” The company said it would continue working with urgency until full mitigation (service-restoration work) and publish a full Post-Incident Report (a formal review) after mitigation.

Microsoft’s promised report will set out the root cause (the underlying technical trigger) and defense-in-depth actions (layered safeguards). Its release will carry weight because the company’s initial infrastructure-restoration efforts (work on the underlying computing systems) had not produced sustained recovery. The technical cause remained unresolved even as Microsoft described recovery progress.

Charles Lamanna, executive vice president of Copilot, Agents, and Platform at Microsoft, reinforced that assessment overnight. In a comment under a Microsoft 365 Status service-update post on X, Lamanna said there was no indication the outage was the “result of malicious or cyber activity.”

Microsoft’s and Lamanna’s statements address whether malicious actors caused the incident, not what failed technically. The distinction leaves an unresolved infrastructure fault rather than a confirmed security breach.

How long did restoration take?

Microsoft began mitigation at midday Thursday. It did not begin to see improvements until early Friday morning, extending the restoration effort through much of Thursday and overnight.

Earlier updates said infrastructure-restoration efforts were not taking as expected. Microsoft subsequently said its corrective actions were not resulting in sustained recovery, as troubleshooting continued across the affected systems.

Microsoft’s disclosures trace three operational stages: mitigation began Thursday afternoon; early actions failed to produce stable gains; and recovery progress emerged only early Friday. The Thursday-to-Friday sequence shows why a software interruption became an extended cross-border service failure.

How much had the service improved?

Downdetector recorded around 15,000 Outlook problems at approximately 6 a.m. Friday, a significant decline from the Thursday afternoon peak. Compared with more than 130,000 reports at one point Thursday, the figure showed substantial contraction in reported disruption.

Microsoft’s latest update described recovery as encouraging, while warning that users could still experience intermittent issues (temporary disruptions) as recovery actions continued. Service continued to improve, although Microsoft’s guidance indicated that some temporary disruption could persist during the remaining work.

Which institutions reported operational disruption?

The fallout extended beyond individual email accounts:

• Arapahoe County Sheriff’s Office: The Colorado agency said it could not process online bond payments while Outlook was down.
• Supreme Court of the Philippines: The court said the outage delayed legal work.

The two institutional disclosures identify immediate stakes in public payments and judicial administration. They also show that the outage reached payment and court-processing systems rather than remaining confined to email access.

What remains unresolved?

The immediate security position is narrow: as of 6:11 a.m. Friday, Microsoft had found no evidence of malicious activity, and Lamanna reported no indication of malicious or cyber activity overnight. The technical position remains open because Microsoft has not yet published the promised root-cause review.

The strategic distinction is between early evidence of recovery and completed mitigation. Downdetector’s decline from the Thursday afternoon peak to around 15,000 reports by about 6 a.m. Friday supports the first; Microsoft’s warning about continuing intermittent issues means the second remains outstanding.