From the afternoon of 12 November until the morning of 14 November, organisations around the world worked without reliable access to Microsoft 365. Microsoft says the cause was technical, not hostile, but the effect on operations was the same as a major incident.
What happened
Microsoft’s service advisory (MO1550821) listed Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR as affected. Problems were first acknowledged for mailboxes in the Americas and widened to a global incident within the hour. Reports came in from more than 70 countries.
According to Microsoft’s updates, a number of servers became unavailable and the remaining capacity could not carry the load. The company later tied this to settings applied during a network capacity change, which overwhelmed a process responsible for setting up secure connections. It paused all deployments, moved traffic away from the affected systems, restarted servers and extended the email retry window to 48 hours so delayed messages were not lost. Microsoft has said it found no sign of malicious activity. A full post-incident report is still to come.
Who felt it
Early reporting describes cancelled procedures and paper records in parts of the UK health service, operational difficulties at Toronto hospital networks, disrupted court systems in the Philippines and Singapore, and a lost legislative day in the US House. One economic consultancy put the productivity cost at around 7 billion dollars. These figures are preliminary.
Why it matters for OT and critical infrastructure
- Security monitoring went with it. Defender XDR was on the affected list. If detection and response depend on the same cloud as email, an outage blinds you at the moment you are least able to coordinate.
- Plants run on office tools more than they admit. Permits to work, shift handovers, vendor remote-support requests and incident bridges often live in Teams and SharePoint.
- Out-of-band communication needs to exist before the outage. A phone tree, a second messaging channel and printed copies of emergency procedures cost little.
The practical test: could your site declare and manage an incident if email, chat and the document library were all unreachable for 48 hours?