Microsoft outage disrupts Outlook, Teams, and other services globally on November 12

The outage began on Thursday, 12 November, and continued into Friday, affecting users across multiple regions, including South Africa.

Microsoft initially attributed the disruption to elevated infrastructure loads, later clarifying that the problem was not caused by increased user traffic but by a number of servers becoming unexpectedly unavailable.

The company subsequently identified an issue involving a process on affected servers responsible for establishing secure connections. The process was becoming overwhelmed, causing servers to stop processing requests.

In its service updates, Microsoft said it was preparing a configuration change to address the problem, while also restarting affected infrastructure and reversing a recent network configuration change that correlated with the start of the disruption.

The outage primarily affected Exchange Online, Microsoft's cloud-based email service that underpins Outlook. Other affected services included Microsoft Teams, SharePoint Online, Microsoft Copilot, Planner, To Do and elements of Microsoft Defender.

Some functions remained available. Microsoft said features of its services that did not depend on Exchange Online continued to operate, while Teams messaging and online meetings were largely functional.

Microsoft's recovery efforts initially proved difficult, with servers that had been brought back online becoming unresponsive again when traffic was redirected to them.

The company said it was applying traffic management measures, redirecting connections to alternative infrastructure and gradually restoring affected servers.

Microsoft also said it had found no indication that the incident was caused by malicious or cyber activity.

The scale of the disruption was reflected in reports to outage-tracking platform Downdetector, which recorded nearly 130,000 reports of Microsoft 365-related problems across 74 countries at the height of the incident.

Microsoft has apologised for the disruption and said it would provide further information once its investigation had progressed. It has also indicated that a fuller post-incident report will detail the root cause and measures to prevent a recurrence.