Microsoft apologises for 365 outage, blames botched network upgrade
The incident
The outage began on Thursday 12 November in Exchange Online, the service that underpins Outlook mailboxes. It subsequently spread to Outlook, Microsoft Teams, SharePoint, Microsoft Copilot and Microsoft Defender XDR, among other services in the Microsoft 365 suite. The disruption continued into a second day, with users reporting failures to access email, join meetings and open shared documents. This article is a follow-up to earlier Newzora reporting on the outage as it began and on the first fix attempts, which did not restore service. The new reporting in this article is the apology, the named cause and the promise of a full review.
What Microsoft said
On Friday 13 November, Microsoft issued an apology to customers and partners. In a statement, the company said: "We are deeply sorry for the disruption this incident has caused our customers and partners." The statement is a corporate one, issued in the name of the company rather than attributed to a named executive.
Charles Lamanna, executive vice president for Copilot, Agents and Platform at Microsoft, addressed the question of whether the incident had a malicious cause. According to reporting of his remarks, he said there was "no indication this is the result of malicious or cyber activity." That assessment aligns with the cause Microsoft has now identified, which points to an internal infrastructure change rather than an external attack.
The cause
Microsoft attributed the outage to "an issue during an earlier network capacity upgrade that surfaced following a recent network change." In other words, a fault introduced during work to expand network capacity remained latent until a subsequent change brought it into effect. The company described the incident as not related to cyber activity and not related to artificial intelligence or to autonomous agents. No further technical detail has been published at the time of writing, and the precise network component or configuration involved has not been identified publicly.
The scale of disruption
The scale of the disruption is best measured by the volume of user reports. At the peak of the outage, more than 130,000 problem reports concerning Outlook were recorded on Downdetector, according to Reuters. Downdetector aggregates reports submitted by users, so this figure represents problem reports rather than a count of users affected, and it covers Outlook alone rather than the full set of affected services.
A separate measure of the speed of the spread came from ABP Live, which reported 43,000 users affected across 72 countries within an hour of the outage taking hold. The breadth of that figure, 72 countries in a single hour, indicates that the fault was not confined to one region or one data centre. It affected a global service used by businesses, schools and government organisations for daily communication and document work.
The incident also touched adjacent services. Claude, the artificial intelligence assistant from Anthropic, experienced its own main outage, which was resolved on 13 November, although its Microsoft 365 connector remained affected.
Background
Microsoft 365 is a cloud service suite that combines email, chat, document storage, meetings and security tools into a single platform. Exchange Online provides the mailbox service behind Outlook. Because so many organisations depend on the suite for routine work, an outage in Exchange Online can halt email across a company within minutes, and a fault that spreads to Teams and SharePoint removes the fallback channels that staff would otherwise use.
Outages of this kind are typically traced to one of three causes: a software deployment, a configuration change, or an infrastructure failure. In this case Microsoft has pointed to the second and third categories combined, a network capacity upgrade followed by a network change. The distinction matters because a configuration fault can often be reversed quickly, while a capacity fault may require traffic to be rerouted before service returns. The outage lasting into a second day suggests the recovery was not a simple reversal.
Why it matters
The incident matters for three reasons. First, it demonstrates how a single internal change can cascade across a suite of services that organisations treat as independent. Email, meetings, documents and security monitoring failed together because they share underlying infrastructure. Second, it tests the credibility of Microsoft's incident communication. The company has now given a cause, ruled out the two explanations users most feared, and promised a full report. The completeness of that report will determine whether customers accept the explanation. Third, it highlights the concentration risk of cloud productivity suites. When one provider serves a large share of the world's office workers, a fault in one of its networks becomes a global event measured in tens of thousands of reports within an hour.
What happens next
Microsoft has promised a full post-incident report once its review is complete. No date has been given for that report, and no full-restoration timeline was published at the time of writing. The report is expected to identify the precise fault, explain why it was not detected during the capacity upgrade, and describe the changes Microsoft will make to prevent a recurrence. Until it is published, the account given above remains the fullest public explanation available.
Source: Windows Latest, ABP Live, GeekWire, Reuters via Downdetector. The photograph accompanying this article is a Microsoft campus file photo showing Building 15010 in Redmond, Washington, photographed in 2022. It is not a photograph of the outage itself.
