Microsoft was working to recover a broad set of cloud services after a server-side problem disrupted availability beginning around 18:00 UTC on November 12. The company said affected servers were failing automated health checks and becoming unavailable, while an overwhelmed core process was contributing to server unresponsiveness and lost capacity.
Services reported as affected included Exchange Online, Teams, Microsoft 365 Copilot and Defender for Office 365. Microsoft 365 administrators also lost access to management tools, including Intune and the Microsoft 365 Apps Admin Center, complicating efforts to diagnose and manage the incident.
Recovery efforts yield only limited relief
Microsoft’s initial investigation found no system changes that appeared to have triggered the outage. The company said early findings pointed instead to a component responsible for processing server health information, though it had not identified the underlying cause of the failures.
By about 22:00 UTC on November 12, Microsoft said it had found and validated an alternative method for checking service health. That approach allowed a subset of affected servers to return to service. The company said it was restarting and validating other affected servers before bringing them back online, and was looking for ways to speed up the process safely.
However, Microsoft cautioned that the actions taken had not delivered the expected improvement. Its status updates said the core process on affected servers was becoming overwhelmed, causing servers to stop responding and contributing to capacity loss. Microsoft was also assessing whether reverting a small number of recent configuration updates could help recovery, while its investigation had not established that those changes caused the incident.
Traffic testing remained a concern
In a later update on November 12, Microsoft described a recovery approach involving isolating part of the infrastructure, restarting affected components and gradually reintroducing traffic. The company said it would check whether services remained stable before applying the change more broadly. It did not provide a target time for full restoration.
An update at 00:35 UTC on November 13 said some servers had returned online and were initially healthy. Microsoft also warned that they could become unresponsive again once they began receiving traffic. The company said networking and platform specialists were analyzing diagnostic data to determine what was triggering the behavior.
The distinction between servers passing checks while idle and remaining stable under load was central to the recovery challenge described in the updates. Bringing machines back into service did not by itself demonstrate that they could handle customer traffic reliably. Microsoft’s plan to reintroduce traffic in stages was intended to test that stability before extending the recovery to more infrastructure.
Customer and administrator impact
The disruption affected both end-user services and some of the tools administrators would ordinarily use to manage Microsoft 365 environments. Email delivery was disrupted for many customers, and the reported outages across collaboration, productivity and security services widened the operational impact beyond a single application.
At the time of the November 13 update, Microsoft had reported partial server recovery but had not announced full service restoration or identified a definitive root cause. Its published details pointed to server health-check failures and an overwhelmed process, with further analysis underway to explain why the affected systems became unresponsive under traffic.
