For millions of people who rely on Microsoft for work, Thursday’s disruption meant more than an application failing to load. Emails became difficult to access, workplace conversations were interrupted, and documents stored online were suddenly out of reach.

Microsoft’s widespread service outage, which began on November 12, continued into Friday, November 13, as the company struggled to restore normal operations across its Microsoft 365 ecosystem. Outlook, Teams, Word, Excel and PowerPoint were among the services affected, alongside business platforms such as SharePoint and OneDrive.

The disruption lasted for more than five hours during its initial phase, but the problems did not end when the first signs of recovery emerged. Thousands of users were still reporting difficulties nearly 24 hours later, suggesting that the company was dealing with a more complicated infrastructure problem than a temporary application failure.

Microsoft said the incident stemmed from unexpected server failures that put additional pressure on the systems still operating. It ruled out a sudden surge in user traffic and said there was no indication that a cyberattack was responsible.

From email problems to disrupted workplaces: What stopped working?

The outage spread across several services that individuals and organisations use to manage their daily work.

Outlook was among the most affected platforms, with users reporting trouble opening inboxes, sending and receiving messages, and connecting to Exchange Online mailboxes. Teams users also encountered connection problems, affecting access to the communication and video-conferencing platform.

The disruption extended beyond email and meetings. Users also reported problems with Word, Excel and PowerPoint, while SharePoint Online and OneDrive were affected, making it harder to reach shared documents and cloud-stored files.

The list of potentially affected services included Microsoft’s AI assistant, 365 Copilot, as well as Microsoft Defender XDR, Planner, To Do, Intune and Defender for Office 365.

Some Microsoft Purview capabilities were also disrupted. These included functions linked to authorisation, data classification, automatic labelling, data loss prevention and communication compliance.

The impact was not restricted to one part of the world. Microsoft warned that customers in different regions could experience problems, turning the incident into a wider disruption for businesses and individual users.

Why did the Microsoft outage happen?

The scale of the disruption raised an obvious question: why were so many services affected at the same time?

Microsoft’s explanation pointed to a failure within its server infrastructure. Although the company initially referred to elevated loads, it later clarified that an increase in user traffic was not behind the problem.

Instead, several servers had unexpectedly become unavailable. That left the remaining infrastructure carrying additional workloads, increasing pressure on systems that were still functioning.

The company also identified failures involving automated server health checks. These checks are designed to monitor server performance and determine whether individual systems are operating properly. Problems with the monitoring process contributed to affected servers being marked as unavailable.

Microsoft began investigating whether a particular component involved in processing these checks was contributing to the failures. Engineers tested a configuration change on a portion of the affected infrastructure to see whether it could help restore server availability.

The company also paused deployments and took steps to prevent additional servers from being removed from service.

Importantly, Microsoft said its investigation had found no indication of a cyberattack. The explanation it provided centred on server availability and the systems responsible for monitoring infrastructure health.

Microsoft’s recovery effort: Moving traffic and restarting servers

With services affected across its network, Microsoft’s immediate priority was to reduce pressure on the infrastructure that remained operational.

The company began redirecting additional connection traffic away from affected systems and distributing it across other parts of its global network. It also started restarting affected servers in an effort to bring them back online.

In a further step, Microsoft tested an alternative method for carrying out server health checks. The company said this approach helped return some affected servers to service and that it planned to apply the change more widely.

It was also preparing automated recovery systems to identify unresponsive servers and restart them, with the aim of making the restoration process more effective.

There were signs of improvement on Thursday evening. By around 6pm ET on November 12, Microsoft reported limited recovery, with some users gradually reconnecting to its services.

Figures cited by Reuters showed that complaints on Downdetector had also begun to fall. Outlook-related reports dropped from a peak of 138,058 around 1pm ET to approximately 34,490 by the evening. Reports concerning Microsoft 365 had declined to nearly 13,000 by 5:47pm ET.

But falling complaint numbers did not mean the disruption was over. Microsoft cautioned that users would experience a gradual return to normal as server capacity came back and applications reconnected.

When will Outlook and Microsoft 365 be fully restored?

By Friday, November 13, the recovery was still a work in progress. Users continued to report difficulties logging in, opening Outlook inboxes and connecting to Microsoft 365 applications.

Microsoft had not provided a definitive timeline for the complete restoration of every affected service in the updates covered here.

For businesses that depend on Microsoft’s cloud-based tools, the prolonged disruption highlighted how closely everyday operations are tied to access to email, shared files and online collaboration platforms.

The company was continuing to bring affected servers back into service and reduce the pressure on its remaining infrastructure. Until that process was complete, some users could continue to experience intermittent access problems.

(With inputs from agencies)