Microsoft 365 suffered a widespread outage Thursday, disrupting access to business email and other cloud services across multiple regions. Microsoft initially reported that users in the Americas were having trouble connecting to Exchange Online mailboxes. It later identified potential disruption to Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR.
Some users of Google Workspace (formerly G Suite) also reported trouble accessing their Google-hosted email through Outlook desktop and mobile email clients. Microsoft traced the increased load on its infrastructure to a large number of servers becoming unavailable, leaving the remaining systems to handle the traffic. The company said overall traffic had not increased.
In an update just before 3 p.m. ET, Microsoft said affected servers were failing automated health checks and that it was testing a workaround that bypasses the component responsible for processing those checks. The company said it was also investigating elevated processor usage on affected servers.
Was the Microsoft outage caused by a cyberattack?
At the time of publishing, Microsoft is still investigating what triggered the failures and has disclosed no evidence of a cyberattack. The company has yet to explain why the health checks failed or why processor usage rose on affected servers. Its service advisories did not report evidence of malicious activity.
The disruption came two days after Microsoft released its November Patch Tuesday updates, which addressed 1,094 vulnerabilities across its products. They included CVE-2026-124194, an Outlook spoofing flaw Microsoft says attackers have exploited. The flaw can expose a user’s authentication material if the user opens a specially crafted file in an affected Outlook client.
Microsoft’s service advisories have not linked the vulnerability to the Exchange Online outage. Microsoft is tracking the Exchange Online disruption under EX1550543 and the broader Microsoft 365 incident under MO1550821 in the Microsoft 365 admin center. As of just before 3 p.m. ET, both incidents were listed as service degradations.
