The Microsoft 365 Outage of November 2026: What Happened and What to Do Next
Advisory from the F1 Cybersecurity Team. Status as at Friday 13 November 2026, 18:15 SAST: Microsoft reports continued recovery across the affected regions and is clearing a backlog of delayed email. It has not yet closed the incident, so the odd slow mailbox or late message is still possible.
On Thursday evening, 12 November 2026, Microsoft 365 email stopped working for a large number of people around the world. By Friday, users in 74 countries and territories had reported problems. In South Africa, SARS, the City of Cape Town, the University of Cape Town, SAA and FlySafair all put out notices. Our own email at F1 went down with everyone else's.
Service is returning, and Microsoft says it sees no sign of an attack.
What to do while email catches up
- Expect late email. Microsoft is working through a backlog and is holding delayed mail for up to 48 hours, so messages sent since Thursday evening may still arrive.
- Leave unsent email in your Outbox. It should send on its own once your mailbox reconnects. Sending it again creates duplicates.
- Phone to confirm anything time-critical. A call or a WhatsApp settles whether an important email arrived. One-time codes and some automated emails may need to be requested again.
- Do not reset passwords or reinstall Outlook. The fault was on Microsoft's servers. Your accounts and devices reconnect on their own as service returns.
- Ignore any call or message offering to restore your mailbox. Scammers use outages as an opening. No genuine fix needs your password or a code from your phone.
What happened
Microsoft's own notice puts the start at 18:17 South African time on Thursday, and most people here noticed from about 8pm. A large number of the servers that run Exchange Online, the email service behind Outlook, began failing their automated health checks and dropped out of service. The servers that were left had to carry all the traffic, and they could not. Servers that Microsoft brought back became unresponsive again once they began receiving traffic.
Early on Friday Microsoft rolled back a recent network configuration change that had coincided with the start of the trouble. On Friday morning it applied a fix to an upstream component that handles authentication and routing. That fix held, and service has been returning since.
Microsoft has not yet confirmed the root cause. It has promised a full post-incident report once the work is complete.
For most people the disruption was to email and the features that depend on it, such as Teams calendars and meeting invitations, Copilot, Planner and To Do. Teams chat and calls, and files in SharePoint and OneDrive, largely kept working, although some organisations, the City of Cape Town among them, reported intermittent trouble there too.
No sign of an attack
Microsoft has said several times since early Friday that it sees no malicious activity. Its wording on Friday afternoon: "At this time, we have no evidence of malicious activity associated with this incident." No group has claimed responsibility. Australia's cyber security minister, Tony Burke, said Microsoft had told him it did not believe it was dealing with a cyberattack.
Microsoft also says the overload came from servers dropping out, and that overall traffic had not increased. A denial-of-service attack works by flooding a service with traffic from outside.
Microsoft has not reported any loss or exposure of customer data. People could not reach their mailboxes for a while, and nothing has been reported taken from them. The final word will come in the post-incident report.
What else was affected
By Friday lunchtime we had heard the claim that Cloudflare, AWS and ChatGPT had been taken down as well. We checked each provider's own status records.
| Service | What we found | Linked to Microsoft's outage |
|---|---|---|
| Cloudflare | Two minor incidents on Thursday, both closed more than four hours before Microsoft's outage began. | No |
| AWS and Google Cloud | No widespread incident on 12 or 13 November. | No |
| Zoom | Zoom kept running. Its features that connect to Microsoft were degraded for about 14 hours. | Yes |
| ChatGPT and Claude | Their connectors into Microsoft 365 had errors. The outage did not take either service down. | Yes |
| GitHub | Two incidents on Thursday evening, one of which disrupted its outgoing email. | Not confirmed |
Outage trackers did show bumps for Cloudflare, Amazon and Gmail on Thursday evening. Those sites count complaints from users, and the providers' own records show nothing to match.
None of the big providers we checked was brought down by Microsoft's outage. Zoom, ChatGPT and Claude lost only the parts that connect to Microsoft 365. Tools you use every day can depend on your email provider without your ever having chosen that.
Where the delayed email has been
Email was designed to survive a failure like this. When a receiving server cannot accept a message, it replies with a temporary error, and the sending server holds the message and tries again later. That is what happened to mail addressed to Microsoft 365 mailboxes during the outage. It was held for another attempt and was not bounced.
How long a sender keeps trying depends on its system. DMARCguard's review of common sending systems found retry windows from 8 hours to 5 days. Microsoft 365 normally keeps trying for 24 hours before it returns a message to the sender, and for this incident Microsoft says it has extended its email timeout window to 48 hours.
So most ordinary email sent to you during the outage should arrive, late. Automated email is the weak spot. Some bulk-sending services stop retrying after 8 to 12 hours, so a statement or password reset sent on Thursday night may never arrive, and you will need to ask for it again. One-time codes will usually have expired by the time they land. Calendar invitations travel by email too, so confirm any meeting arranged since Thursday evening.
It also explains the advice about your Outbox. The original message is usually still queued, so a second copy means both arrive.
Three sensible precautions
Be wary of anyone offering to restore your mailbox. Scammers use outages as an opening, and warnings are out from ING Australia among others. No genuine fix needs your password or a code from your phone. If you are an F1 client and unsure about a message, send us a screenshot before you click. F1 will never ask for your password.
Install this month's Office update. On Tuesday 10 November, two days before the outage, Microsoft released a security fix for an Outlook flaw that attackers were already using. Microsoft has not linked it to the outage. Install the update on every computer.
Only approve sign-ins you started. Attempts to guess Microsoft 365 passwords are routine worldwide, outage or no outage. If your phone asks you to approve a sign-in you did not start, decline it.
Three things to settle before the next outage
Large outages keep happening. In July 2024 a faulty CrowdStrike update disrupted airlines, banks and retailers around the world, and on 12 November it was email. Changing provider does not remove the risk, so the useful work is deciding in advance how your business carries on.
A second way to reach people. FlySafair told customers it could not send or receive email and pointed them to its call centre and WhatsApp line. Our own client advisory went out by WhatsApp while email was unreliable. Decide now which channel your staff and your clients will use when email is down, and keep those phone numbers somewhere other than Outlook.
A list of what depends on email. Typical examples are one-time codes, calendar invitations, the office scanner, invoices from your accounting system, alerts from your backup software and the contact form on your website. Our post on scanners and apps that send email through Microsoft 365 has a checklist for finding them.
A number. Put a figure on how many hours your business can run without email before it costs you money or a client. That figure is your recovery time objective. It is the owner's decision, in plain language, for each system the business depends on. Our guide to RTO and RPO shows how to set it.
An outage is also a good moment to check the other half of the picture. Microsoft's job is to keep the service available. A recoverable copy of your data is your responsibility, as we explain in Does Microsoft 365 Back Up Your Data? Not Quite.
The takeaway
Thursday's outage was a fault on Microsoft's servers. Service is returning, Microsoft sees no sign of an attack, and it has not reported any loss of customer data. Let the delayed email arrive, confirm what matters by phone, and be careful of anyone offering to fix your mailbox.
Then set aside an hour to settle the three things above while Thursday night is still fresh.
If you are an F1 client and anything still looks wrong, WhatsApp us on +27 60 333 3999 or phone +27 21 975 3345. If you would like help working through those three decisions, talk to the F1 team.
How this was checked: Microsoft's service health notices MO1550821 and EX1550543 and its public status updates, as reported by Reuters, AP, ABC News Australia, TechRadar and Tom's Guide. South African notices: TechCentral and ITWeb. Delayed mail: DMARCguard's review of how sending systems retry, and Microsoft's documentation. Outlook fix: Microsoft's security advisory for CVE-2026-124194. Other providers: their own status pages or independent trackers, checked on 13 November 2026. This post reflects what was known at the time shown at the top.
Want this handled for you?
Talk to the F1 team about cybersecurity, AI and managed IT for your business.