Our team is fully aware of a global IT issue that is currently impacting a wide range of Microsoft 365 services including Exchange Online, OneDrive, Teams and SharePoint. We are monitoring updates from Microsoft and will update this post as more information become available.
Latest update(14:00)
We’re continuing to see improvements in service availability, with email queues significantly reduced and approaching normal levels. Some users may still experience intermittent access issues or delayed email delivery as recovery continues. We’ve implemented additional mitigation measures and are restoring the remaining affected infrastructure while investigating residual service issues. We’re closely monitoring service health and validating recovery across affected connection methods to ensure sustained service stability.
At this time, we have no evidence of malicious activity associated with this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete.
Previous updates
13/11/26 (13:00) – The team at Readycrest are starting to see Outlook connecting again at multiple customers with emails starting arrive.
————————————————-
13/11/26 (12:00) – We’re seeing encouraging recovery progress in Europe, with service availability and email delivery performance improving across a growing portion of affected Microsoft 365 infrastructure. Japan remains comparatively more stable, while North America is also improving; however, some users may still experience intermittent issues as recovery actions continue. We’re focused on addressing the remaining areas of disruption and improving service consistency across affected regions. Reducing email queues and backlogs remains a priority, and the extended 48-hour email timeout window remains in place to help protect delayed messages as delivery catches up. At this time, we have no evidence of malicious activity associated with this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete.
————————————————-
13/11/26 (11:00) – We’ve made additional progress toward service recovery, with recovery actions completed across portions of the affected infrastructure in the Asia Pacific region. Traffic is being gradually restored, and we’re seeing improvements in key customer scenarios, including mailbox access and delayed email processing. However, some users may continue to experience intermittent issues. Our focus is now on extending these recovery actions across affected infrastructure in other regions, while continuing stabilization efforts and adding supporting capacity to improve service consistency. Reducing email queues and backlogs remains a priority, and the extended 48-hour email timeout window remains in place to help protect delayed messages as delivery catches up. At this time, we have no evidence of malicious activity associated with this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete.
————————————————-
13/11/26 (10:30) Recovery actions are ongoing and have progressed in phases across affected Microsoft 365 infrastructure. Global telemetry and customer reports show incremental improvement in several workloads; however, service health remains variable and capacity has not yet fully returned to baseline. Network and traffic-management actions remain active. To protect email during recovery, we’re continuing to prioritize queue and backlog processing, and the email timeout window has been extended to 48 hours to preserve delayed messages. At this time, we have no evidence of malicious activity associated with this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete.
————————————————-
13/11/26 (09:00) – Recovery efforts are ongoing across impacted infrastructure. We are seeing early signs of stabilization, but service capacity has not yet returned to normal levels and health remains variable as traffic is carefully reintroduced. Our primary mitigation path continues to focus on service stability and controlled recovery. Engineering teams are cycling affected infrastructure through traffic drain, restart, remediation, and staged return-to-service while monitoring closely. We are also evaluating additional mitigation options to improve recovery speed and consistency. Network and traffic-management actions remain in progress, and we continue to prioritize backlog and queue health to preserve delayed mail during recovery. As part of this effort, we are extending the email timeout window to 48 hours to help protect delayed messages while service recovery continues. At this time, we are not aware of any malicious activity causing this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after recovery is complete.
————————————————-
13/11/26 (08:00) – We’re seeing positive results for server stability after applying an upstream authentication/routing configuration component patch to a portion of our infrastructure. We’ll continue to monitor its progress and are working to expand it to servers supporting active regions coming online. As of now, we are not aware of any malicious activity that is causing this incident. We will continue to treat this incident with urgency and priority until full resolution. Once mitigated, we will provide full details of the root cause, defense-in-depth repair items, and more within a Post-Incident Report.
————————————————-
13/11/26 (06:00) – We’re continuing to pursue multiple workstreams to pinpoint the underlying cause of the traffic influx and advance the recoverability of the backend servers. We’re taking a measured approach to identify and repair affected infrastructure to improve the ability to confirm the developed changes were applied. We’re tracking the results of this approach to verify the servers are showing the anticipated recovery and performance intended.
As of now, we are not aware of any malicious activity that is causing this incident. We will continue to treat this incident with urgency and priority until full resolution. Once mitigated, we will provide full details of the root cause, defense-in-depth repair items, and more within a Post-Incident Report.
————————————————-
12/11/26 (23:00) – We’re continuing to pursue all available pathways to restore service, as our actions taken thus far have not provided the anticipated relief. Our investigation has found that a core process on the affected servers is becoming overwhelmed, which causes the servers to stop responding and contributes to the capacity loss. To validate a potential recovery approach, we’re fully isolating a portion of our service infrastructure, restarting the affected components, and gradually reintroducing traffic to confirm our services remain stable before applying this approach more broadly. We’re also analyzing traffic patterns across our entire service infrastructure and evaluating whether isolating traffic within each region may allow affected regions to recover independently.
————————————————-
12/11/26 (21:00) – We’ve validated an alternative health check method on a subset of affected infrastructure, which allowed the servers in that subset to successfully return to service, and we’re now applying this change more broadly. We’re also preparing an automated recovery process to continually detect and restart unresponsive servers, to help keep them in service while this change progresses. Additionally, our review of recent changes has identified a small number of configuration updates that we’re investigating as potential contributors to the issue.