A Microsoft outage that began on November 12 with Outlook email and Teams calls spread worldwide into Copilot, Defender security scanning and Intune device management before recovery started roughly 18 hours later. Microsoft said there is no evidence of malicious activity.
What happened
The disruption surfaced first in Outlook email and Microsoft Teams calls, initially affecting users in the United States and the wider Americas region before spreading globally. From there it reached Microsoft’s Copilot AI tools, its Defender security screening, the Intune dashboards administrators use to manage company devices, and in some cases cloud-hosted Windows PCs.
Network analyst Doug Madory of Kentik said traffic was returning to Microsoft’s services after about 18 hours of downtime, with Outlook showing signs of recovery by Friday morning on the U.S. East Coast and some emails beginning to arrive again, according to TechCrunch.
What Microsoft has confirmed, and what it has not
Microsoft described the underlying problem only as “a large number of servers being unexpectedly unavailable,” according to its own cloud status page. In a Friday update, the company said there was no evidence of malicious activity tied to the incident and that it was not related to cyber activity or AI agents.
Charles Lamanna, Microsoft’s executive vice president for Copilot, agents and platform, said in a statement reported by TechCrunch: “We’re seeing encouraging recovery progress, with service availability and email delivery performance improving.” He added that “our teams are reviewing what happened and how we can prevent similar issues going forward.”
A root cause had not been identified as of the latest update, and a Microsoft spokesperson did not respond to TechCrunch’s questions about whether the company can detect malicious activity with certainty rather than simply not having found evidence of it yet.
Why this outage was bigger than a typical email glitch
Most Microsoft service disruptions stay contained to one product. This one crossed into security and device management at the same time it took down communication tools, which matters because Defender and Intune are the systems organizations rely on to catch threats and manage company laptops and phones. A multi-hour gap in both, alongside Outlook and Teams being down, left some businesses without email, calls, security screening or device oversight simultaneously.
Copilot’s inclusion also meant the outage reached into AI features Microsoft has pushed into Word, Excel and Teams over the past two years, features many organizations now build workflows around rather than treat as optional add-ons. TechCrunch, which experienced the outage firsthand through its own email, said the disruption touched “a broad range of industries” rather than a single sector.
The second major Microsoft cloud failure in two months
This is not Microsoft’s first large-scale cloud disruption this quarter. In September, the company suffered a multi-day outage across its cloud services that it attributed to an issue with a “core authentication configuration” that stopped users from signing in. That earlier incident and this one both point to the same underlying risk for a company whose email, security and AI tools now sit on a shared cloud backbone: a single infrastructure fault can cascade across products that organizations treat as independent.
What happens next
Microsoft has not published a post-incident report or named a root cause. The company’s own framing, ruling out malicious activity while leaving the actual trigger unexplained, is likely to draw scrutiny from enterprise customers who depend on Microsoft 365 for day-to-day operations. Watch for a formal root-cause disclosure and whether Microsoft offers service-level credits to affected business customers.
Two major outages inside three months also raises the question of whether Microsoft’s post-September fixes actually held. The September incident was traced to an authentication configuration problem; this one has been described only as servers going unexpectedly unavailable, with no indication yet of whether the two are related.
FAQ
Was this a cyberattack? Microsoft said there is no evidence of malicious activity and that the incident was not related to cyber activity or AI agents, though the company has not ruled out every possibility and has not named a cause.
Which services were affected? Outlook email, Microsoft Teams, Copilot AI tools, Defender security screening, Intune admin dashboards, and some cloud-hosted Windows PCs.
How long did it last? About 18 hours from the first reports to traffic returning to normal, per Kentik’s tracking.
Has this happened before? Yes. Microsoft had a separate multi-day cloud outage in September 2026, which the company attributed to a core authentication configuration issue. Microsoft has not said whether that incident and this one share a cause.
Leave a Reply