Microsoft outage hits the world

On November 12-13, 2026, Microsoft 365 experienced one of its most significant outages of the year, affecting major services like Outlook, Teams, SharePoint Online, Microsoft 365 Copilot and the Defender XDR portal. The incident began around 1:26 PM Eastern time on Thursday, Nov 12, with initial reports of Exchange Online mailbox issues in the Americas, later confirmed globally.

Microsoft identified a core process responsible for establishing secure connections as becoming overwhelmed, leading to affected servers failing automated health checks. Despite no increase in overall traffic and no evidence of a cyberattack, Microsoft implemented various recovery actions including pausing deployments, redistributing traffic, restarting servers and rolling back a recent network configuration change that occurred simultaneously with the disruption.

By late evening US time, Microsoft reported limited and gradual recovery, but the root cause was not confirmed at the time of publication.

For security teams, losing access to the Defender XDR portal doesn't mean losing protection, as the Defender for Endpoint sensor operates on devices, maintaining local policy enforcement and blocking capabilities even without cloud portal access. However, the outage does result in a loss of visibility and response capabilities through dashboards, advanced hunting, and alert triage.

Outage days often coincide with increased phishing attempts, with IT support calls, misleading emails, and fake status pages exploiting users' stress and expectation of system malfunctions. Users should be reminded that no legitimate outage requires password input or MFA code.

To mitigate issues during future outages, it's advised not to mass-reset passwords or revoke sessions, as this only adds load and help desk complications without addressing the underlying problem. Instead, thorough investigation should occur post-recovery using sign-in and audit logs. Security teams must also review processes that assumed continuous Microsoft 365 availability and develop contingency plans for multi-day outages, which is more cost-effective than handling such incidents in real-time.

Ultimately, while the cloud offers numerous conveniences, relying solely on such services without building additional resilience measures can lead to significant operational risks.