On Thursday, at 18:26 UTC, Outlook stopped receiving email. Then Teams, Copilot and SharePoint went down. Within an hour Downdetector was getting reports from 74 countries. By Friday morning Japan’s Finance Ministry was taping paper notices to office walls to keep reporters informed, and New Zealand’s immigration office had stopped processing all visa applications.
As I write, more than fourteen hours later, Microsoft talks about a partial recovery and a fix it is rolling out a bit at a time. It wasn’t a cyberattack: it was a problem with Microsoft’s own servers, and all night the attempts to fix it didn’t work.
What happened in the Microsoft 365 outage
In order, in UTC:
- Thursday, 14:45: a first Teams incident, with messages delayed or lost mostly in the Americas. It clears within an hour; Microsoft hasn’t said whether it’s related to the rest;
- Thursday, 18:26: incident MO1550821 opens. Exchange Online, meaning email, Teams, SharePoint, Copilot and Defender stop responding (BleepingComputer). Intune and the admin center go down too, the very tools admins would need to understand what’s going on (The Register);
- Thursday evening: Microsoft first blames “elevated load” on part of its infrastructure, then corrects itself: traffic hadn’t increased, some servers had suddenly become unavailable and their work spilled onto the others, which couldn’t cope;
- Friday, 00:35: some servers come back, but according to Microsoft they may stop responding again as soon as they get traffic. The steps taken so far haven’t brought the expected relief;
- Friday, 07:25: a patch improves stability on part of the servers and Microsoft extends it to the regions still down. Outlook and Teams start coming back, patchily (Quotidiano Nazionale).
Downdetector reports reached about 200,000. Microsoft hasn’t given a date for full recovery.
Who was hit
The list says more than any number:
- Japan: the Finance Ministry without email for most of the day, with paper notices for times and appointments (MilanoFinanza);
- Australia: several departments of the central bank blocked, although critical operations carried on;
- New Zealand: visas suspended, and the Foreign Ministry without email at embassies and consulates (Sky TG24);
- Singapore: government email affected;
- United States: the House of Representatives confirmed it was hit, and schools, universities and hospitals warned that communications might fail;
- companies: Workhorse and Richemont postponed their earnings releases, and PVH, the group behind Calvin Klein and Tommy Hilfiger, couldn’t hold some of the meetings in which it was due to tell staff in Asia about layoffs;
- artificial intelligence: OpenAI and Anthropic reported errors in the Microsoft 365 connectors of ChatGPT and Claude. With Claude’s connector, most email, calendar and search requests failed (Cointelegraph).
It wasn’t a cyberattack
I’ll say it right away because it’s the first question that comes to mind: no, as far as we know there was no attack. Microsoft says it has nothing linking the outage to malicious activity, and Charles Lamanna, one of its executives, repeated it on X. It’s the same distinction I made a few days ago about the bomb threats against schools: not everything that breaks online is the work of a hacker.
What really happened we’ll learn from the report Microsoft has promised once the incident is closed. So far it has said this:
- the servers fail their automated health checks and are taken out of service;
- the problem seems to come from a component whose job is precisely to process server health, and from a core process that gets overwhelmed;
- it found no recent deployments that line up with the start of the outage, but it considered rolling back some configuration changes, froze all deployments and in the end fixed a configuration component for upstream authentication and routing.
Several experts talk about a cascade probably set off by a configuration error. It’s a reasonable guess, but it stays a guess until the report is out.
The check meant to protect the servers took them down
This is the part that, as a developer, strikes me most.
A health check has one job: notice that a server is sick and take it out of rotation before it does damage. Here the opposite happened. If the first analyses are right, it was the checking mechanism that declared healthy servers sick. The load moved onto the remaining servers, which in turn buckled, and when engineers brought them back they went down again as soon as traffic arrived. It wasn’t a broken server, it was a system shooting itself in the foot.
I saw the same thing a year ago, almost to the day, with the Cloudflare outage: a configuration file that grew too large and an automated system that pushed it everywhere in minutes. Big platforms are so automated that the most dangerous failure is no longer a broken disk, but the rule that decides on its own to switch off half the infrastructure. And the faster the automation, the faster the disaster.
There’s also a detail anyone who runs systems knows well: the tools to diagnose the problem ran on the same infrastructure that had broken. Customers’ admins couldn’t even get into the console to see what was happening.
Everyone in the same inbox
The second thing is concentration. A Japanese ministry, a central bank, the US Congress and the school down the road use the same email service, on the same servers, and when it stops they all stop together. That’s not a criticism of those who chose it: Microsoft 365 almost always works, costs less than an in-house system and everyone knows how to use it. But “almost always” at world scale means that every now and then a whole slice of the world is left without email at the same moment.
And now we’re putting AI agents on top of that email too. Last night anyone who had asked ChatGPT or Claude to summarize their inbox or set up a meeting found an assistant that couldn’t see anything anymore. Every layer we add depends on the one below, and if that one falls it takes everything with it.
What you can do
Not much, honestly, but something:
- it’s not your computer: if Outlook isn’t working, before reinstalling or changing your password check the status page or the Microsoft 365 Status account on X;
- watch out for emails “from Microsoft” in the coming hours asking you to sign in again or “reactivate” your mailbox: big outages are a great opportunity for phishing;
- a backup channel: for a company it means knowing how people reach each other when email and the company chat are down, whether it’s a phone group or a number to call;
- a copy of what matters: contacts, calendar and important documents shouldn’t live in just one place.
Were you left without Outlook or Teams? Did it block your work, or did you only notice this morning from the news? Let me know.
Sources: BleepingComputer, The Register, Sky TG24, MilanoFinanza, Quotidiano Nazionale, Cointelegraph, SecurityWeek.