{
  "id": 19756066,
  "title": "Microsoft 365 went down (and took the Defender portal with it): the admin checklist for the next outage",
  "url": "https://urgent.news/2026/11/13/microsoft-365-went-down-and-took-the-defender-portal-with-it-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T04:38:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cdsecuritylab/microsoft-365-went-down-and-took-the-defender-portal-with-it-the-admin-checklist-for-the-next-a1h"
  },
  "original_language": "en",
  "account": "On November 12-13, 2026, Microsoft 365 experienced one of its most significant outages of the year, affecting major services like Outlook, Teams, SharePoint Online, Microsoft 365 Copilot and the Defender XDR portal. The incident began around 1:26 PM Eastern time on Thursday, Nov 12, with initial reports of Exchange Online mailbox issues in the Americas, later confirmed globally. Microsoft identified a core process responsible for establishing secure connections as becoming overwhelmed, leading to affected servers failing automated health checks. Despite no increase in overall traffic and no evidence of a cyberattack, Microsoft implemented various recovery actions including pausing deployments, redistributing traffic, restarting servers and rolling back a recent network configuration change that occurred simultaneously with the disruption. By late evening US time, Microsoft reported limited and gradual recovery, but the root cause was not confirmed at the time of publication.\n\nFor security teams, losing access to the Defender XDR portal doesn't mean losing protection, as the Defender for Endpoint sensor operates on devices, maintaining local policy enforcement and blocking capabilities even without cloud portal access. However, the outage does result in a loss of visibility and response capabilities through dashboards, advanced hunting, and alert triage. Outage days often coincide with increased phishing attempts, with IT support calls, misleading emails, and fake status pages exploiting users' stress and expectation of system malfunctions. Users should be reminded that no legitimate outage requires password input or MFA code.\n\nTo mitigate issues during future outages, it's advised not to mass-reset passwords or revoke sessions, as this only adds load and help desk complications without addressing the underlying problem. Instead, thorough investigation should occur post-recovery using sign-in and audit logs. Security teams must also review processes that assumed continuous Microsoft 365 availability and develop contingency plans for multi-day outages, which is more cost-effective than handling such incidents in real-time. Ultimately, while the cloud offers numerous conveniences, relying solely on such services without building additional resilience measures can lead to significant operational risks.",
  "summary": "On November 12–13, 2026, Microsoft 365 had one of its biggest outages of the year. Outlook, Teams, SharePoint Online, Microsoft 365 Copilot — and the Microsoft Defender XDR portal — were degraded or unreachable for many tenants (admin center incidents MO1550821 and EX1550543 ). This post is the calm version of what happened, what it means for security teams, and the checklist I wish every admin…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "CNBC Technology",
        "title": "Widespread Microsoft outage takes down Outlook and other 365 services",
        "url": "https://urgent.news/2026/11/12/widespread-microsoft-outage-takes-down-outlook-and-other-365-services",
        "published": "2026-11-12T22:11:54.000Z"
      },
      {
        "outlet": "Sky News Tech",
        "title": "Microsoft suffers global outage - as fix not going 'as expected'",
        "url": "https://urgent.news/2026/11/13/microsoft-suffers-global-outage-as-fix-not-going-as-expected",
        "published": "2026-11-13T04:33:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}