Microsoft rolls back network change after 365 outage disrupts Outlook, Exchange Online and Teams

Microsoft reported a widespread Microsoft 365 outage on Thursday that disrupted Outlook, Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and the security service Defender XDR. The company first said users in the Americas had trouble connecting to Exchange Online mailboxes, then expanded the advisory as dependent services failed. Microsoft tracked the event under incident EX1550543 for Exchange Online and MO1550821 for the broader Microsoft 365 platform.

Microsoft said increased load came from a large number of servers becoming unavailable, leaving remaining systems to handle traffic, while overall traffic had not increased. It said a process that establishes secure connections was overwhelmed, causing affected servers to stop handling requests. The company began rolling back a recent network configuration change that coincided with the disruption and was testing a workaround for failed automated health checks.

The evidence trail points to infrastructure behavior rather than confirmed malicious activity. Microsoft said affected servers were failing health checks, had elevated processor usage and that no cyberattack had been confirmed. No independent technical evidence of attack was cited. The outage came two days after Microsoft's regular November Patch Tuesday updates addressed 1,094 vulnerabilities, including a publicly tracked security flaw, CVE-2026-124194, an Outlook flaw it says attackers exploited to expose authentication material. Advisories did not link that flaw to the outage.

Microsoft said restarting affected servers showed signs of improvement, though it was still monitoring stability and had not confirmed full recovery. Some Google Workspace users also reported trouble accessing Google-hosted email through Outlook desktop and mobile clients, showing how third-party email clients inherit Exchange Online failures. The outage exposed how tightly business communication, document collaboration and security workflows depend on a single set of cloud services.