Microsoft blames network capacity upgrade for 24-hour Outlook and Microsoft 365 outage — says it was not a cyberattack or AI

Status, as of 12:30 am IST on 14 November 2026: Microsoft says the underlying fault has been fixed, and services are broadly stable, with restoration still in progress for the remaining customers and regions. The company has not yet declared the incident fully closed.

Microsoft has blamed a fault introduced during an earlier network capacity upgrade for the outage that knocked Outlook, Exchange Online and a long list of Microsoft 365 services offline for more than 24 hours from Thursday, 12 November 2026.

In a statement posted on X on Friday, 13 November, the company apologised to customers and said the incident was a “technical issue not related to cyber or AI / agents”, shutting down a day of speculation about a DDoS attack and AI-written code.

According to the statement, the defect lay dormant after the capacity upgrade and only surfaced when a more recent network change was applied. Microsoft said it has addressed the underlying issue and that recovery was slow by design: given the volume of demand to reconnect, engineers brought services back in stages and checked stability at each step. A full post-incident report will follow once its review is complete.

How the Microsoft 365 outage unfolded

The Microsoft 365 outage began as an Exchange Online mailbox problem in the Americas and became global within two hours. The log below is drawn from Microsoft’s service health advisories as compiled by SOCRadar. All times are UTC; add 5 hours 30 minutes to convert to IST.

• 12 Nov, 16:17 — Microsoft opens incident EX1550543 as users in the Americas lose access to Exchange Online mailboxes through Outlook on the web, desktop and mobile.
• 12 Nov, 18:15 — Downdetector reports peak above 130,000 in the US and near 140,000 worldwide, from at least 74 countries.
• 12 Nov, 18:26 — A second incident, MO1550821, is opened for dependent services. Microsoft warns any region may be affected.
• 12 Nov, 19:06 — Microsoft freezes all deployments and configuration changes. It says load rose because servers dropped out, not because traffic increased.
• 12 Nov, 19:43 — Affected servers are failing automated health checks. Engineers find no recent change that correlates with the failure.
• 13 Nov, 00:00 — Servers that had been restored become unresponsive again as soon as traffic returns.
• 13 Nov, 01:06 — Microsoft starts rolling back a recent network configuration change that lines up with the start of the outage.
• 13 Nov, 07:45 — A patch to an authentication and routing component produces the first stability gains.
• 13 Nov, 09:10 — The email retry window has been extended to 48 hours to prevent queued messages from being bounced.
• 13 Nov, 11:04 — Recovery work completes on Asia-Pacific infrastructure first, with other regions following.
• 13 Nov, evening — Microsoft reports broad recovery and names the network capacity upgrade as the origin.

Email was the core casualty, but anything that leans on Exchange Online went with it. Microsoft’s advisory listed Teams calendars and scheduling, SharePoint Online, Microsoft 365 Copilot, Defender XDR, Purview, Intune, Planner and the Microsoft 365 admin center, the same console administrators use to read outage notices. Teams chat and meetings largely kept working.

Was it a DDoS attack, or AI-generated code?

Neither claim is supported by evidence, and Microsoft has now denied both categories outright. The DDoS theory traces to the hacktivist group Dark Storm Team, which posted availability checks for Outlook web addresses on 12 November. Threat-intelligence account VECERT, which flagged the posts, labelled them alleged and unconfirmed. Microsoft’s own telemetry pointed the other way from the first evening: a DDoS (distributed denial-of-service) attack works by flooding a service with traffic, and Microsoft said overall traffic had not risen.

The AI theory grew on X, where replies to a Microsoft Learn post about AI habits accused the company of pushing AI-generated or “vibe coded” changes to production, Windows Latest reported. Others tied the failure to the voluntary buyout Microsoft offered about 60,000 employees on 26 October. No Microsoft statement links the outage to either, and the cause the company has named is a network change, not application code. Unverified claims of insider sabotage also circulated; nothing published so far backs them.

Charles Lamanna, Microsoft’s executive vice president for Copilot, Agents and Platform, was the first executive to publicly say early Friday that there was no sign of malicious or cyber activity. Separately, the outage landed two days after a Patch Tuesday that fixed an actively exploited Outlook spoofing flaw, CVE-2026-124194. Microsoft’s advisories have not connected that vulnerability to the disruption.

One detail in Microsoft’s own log sits awkwardly beside its explanation. Three and a half hours into the outage, engineers reported finding no recent change that correlated with the failure, and the rollback of the network change did not begin until almost nine hours in.

Did the Microsoft Outage Ground Flights Today?

The Microsoft outage disrupted airline email and customer support, but it did not cause the nationwide US ground stop that the Federal Aviation Administration (FAA) ordered on Friday, 13 November 2026, according to both Microsoft and US officials.

The FAA halted departures around noon Eastern time, citing safety, and a spokesperson told Northeastern Global News that technicians were investigating a communication issue. The agency told PEOPLE the fault affected multiple Air Route Traffic Control Centers, the facilities that handle aircraft in cruise. The ground stop has since been lifted, NBC News reported.

Microsoft answered the speculation within hours. Its public affairs account said on X that the company had “no indication that the FAA’s nationwide ground stop is related to any Microsoft services.”

Homeland Security Secretary Markwayne Mullin described the FAA problem as a telecommunications outage and told reporters he saw no reason to connect it to Microsoft, TechRadar reported. The FAA has not published a root cause.

The direct impact on airlines was narrower and hit hardest in India. IndiGo and Akasa Air warned passengers that customer emails might not reach their support teams, while Air India said flights were unaffected after it rerouted incoming email, ThePrint reported. SpiceJet canceled three Delhi departures to Pune, Leh and Mumbai, and delayed two more, according to an NDTV report carried by several outlets; the airline has not publicly tied those flights to Microsoft. In the US, Delta’s internal email was disrupted, but no widespread cancellations were linked to the outage.

The cost, and who was hit

Lost productivity from the outage could approach $7 billion, according to an estimate by Michigan consultancy Anderson Economic Group reported by CNN, which said the figure is likely to rise as customers seek refunds. Japan’s government fell back on paper processes after ministries struggled to send email, and Australia’s federal police and intelligence agency were among the organisations affected, The Next Web reported. Australian Home Affairs Minister Tony Burke told reporters that Microsoft had likened the event to the 2024 CrowdStrike incident, an update gone wrong rather than an attack.

In India, the first incident opened at 9:47 pm IST on Thursday and problems carried into the Friday workday. Downdetector reports in the country climbed to 1,817 by 8:36 am on 13 November, Forbes India reported.

Users do not need to resend mail from the outage window; Microsoft’s 48-hour retry extension means queued messages should still arrive. They should, however, ignore password reset emails and texts citing the outage. SOCRadar said phishing lures using that theme appeared on the evening of 12 November.

Microsoft has not said when the capacity upgrade took place, which recent network change exposed the fault, why the rollback alone did not restore service, or whether customers will receive service credits. It has also given no date for the post-incident report.

Updates

2026-11-14 (07:30 IST): Added airline impact and the FAA ground stop. Microsoft and US officials say the ground stop was unrelated to the Microsoft outage; the FAA has lifted it.