● Scale: 74 countries and territories in about an hour. Five Microsoft services combined peaked at 19,650 Downdetector reports a minute, against under 15 on a normal Thursday.
● Started: Microsoft puts the Exchange Online incident at 16:17 UTC on 12 November. Public reports began climbing about an hour later.
● Cause: Servers failing automated health checks. Microsoft has not confirmed a root cause and found no evidence of a cyberattack.
● The AI part: Microsoft 365 Copilot reports rose more than a hundredfold. GitHub, also Microsoft, barely moved.
Microsoft logged two incidents on 12 November: EX1550543 for the Exchange Online disruption and MO1550821 for the broader Microsoft 365 connectivity failure. What started as mailbox access problems for users in the Americas was, within thirteen minutes, acknowledged as potentially affecting any region.
How fast it spread
Downdetector reports about Outlook began climbing at roughly 17:25 UTC — 12:25 in New York. One hour later, reports across five Microsoft services combined hit 19,650 a minute. The baseline for an average Thursday is under 15 a minute. Outlook alone peaked at more than two thousand times its normal level.
It did not stay in the Americas. Reports jumped tenfold in the UK at 17:43 UTC, in India at 23:21 local time, and in New Zealand at 06:55 local time. Between 17:00 and 18:55 UTC, close to three in ten reports came from outside the United States. Downdetector counts a country once its reports reach ten times normal and at least 20 in a five-minute window.
Which Microsoft services actually fell — and which did not
| Service |
Report increase |
| Microsoft 365 |
More than 100x |
| Microsoft 365 Copilot |
More than 100x |
| Teams |
More than 100x |
| OneDrive |
More than 100x |
| Azure |
About 100x |
| Outlook |
More than 2,000x at peak |
| Xbox, GitHub, LinkedIn |
Far less |
That last row is the most informative thing in the data. Xbox, GitHub and LinkedIn are all Microsoft properties and all stayed broadly up. The failure was not Microsoft-wide — it was confined to the Microsoft 365 service layer, and the blast radius maps the dependency graph almost exactly.
What it means for anyone buying an AI assistant
Microsoft 365 Copilot went down with Exchange Online. GitHub did not. Same company, same brand family, entirely different outcome — because Copilot inside Microsoft 365 is not a standalone product. It rides on the same identity and service infrastructure as Outlook and Teams, so it inherits their failure modes.
That is the trade-off nobody prices when they buy a bundled assistant. Deep integration is the feature: Copilot is useful precisely because it reaches into your mail, your files and your calendar. The cost of that reach is that when the mail platform fails, the assistant fails with it. A standalone AI tool would have kept working through this outage; a bundled one could not.
If your team lost a working day here, the practical lesson is not to switch vendors. It is to know which of your tools share a single point of failure, and to have one that does not.
What Microsoft did, hour by hour
| Time (ET) |
What Microsoft said |
| 12:54 PM |
Investigation opened into Exchange Online mailbox access in the Americas. |
| 1:07 PM |
Said the issue may affect connectivity for users in any region. |
| 2:50 PM |
Tested a configuration change for the health-check failures and restarted affected servers. |
| 3:19 PM |
Said no recent change correlated with the start of impact. Took steps to stop further servers failing checks. |
| 4:00 PM |
Validated an alternative health check, returned a subset of servers, began applying it more widely. |
| Later |
Paused deployments, moved traffic off affected infrastructure, continued restarts. |
Microsoft described partial recovery by late afternoon Eastern time. The alternative health check was explicitly a mitigation rather than a fix: it bypassed the component processing the checks rather than repairing it.
What is still unexplained
Microsoft has not confirmed a root cause. Its account is that a large number of servers became unavailable after failing automated health checks, which pushed the remaining systems to carry the load. It was separately investigating elevated processor usage on those servers.
Two things it has not explained: why the health checks began failing, and why processor usage rose. It also stated at 3:19 PM that no recent change correlated with the start of impact — which rules out the most common explanation for an outage of this shape.
Microsoft has reported no evidence of a cyberattack, and its advisories have not linked the incident to CVE-2026-124194, a separate Outlook vulnerability patched two days earlier. Worth stating plainly, because the proximity of those two dates has been drawing connections that Microsoft itself has not made.
Affected beyond email: Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR. Some Google Workspace users also reported trouble reaching their mail through Outlook desktop and mobile clients — a reminder that the client and the mail platform are separate things.
Related: Microsoft 365 Copilot listing · Copilot Personal vs Enterprise.
Sources