Global Microsoft 365 outage: recovery continues, with extended monitoring. Microsoft says the cause was "a problem in earlier network expansion work"; it was not an attack and had nothing to do with AI

Records it as an outage across Microsoft 365

Acknowledges impact on Teams, SharePoint, Copilot and Defender XDR (incident number MO1550821)

Revises its assessment: "traffic did not increase"

Explains that many servers suddenly became unusable and the load is concentrating on the servers that remained

Changes the recovery approach

Reports that the measures so far did not have the expected effect. It was found that the servers' core processing overflows and responses stop. It will completely isolate part of the infrastructure, restart it, and then return traffic gradually. It is also considering isolating by region

Limited recovery in some regions

Reports that some servers have come back and are now stable. It moved traffic to another route and is trying to adjust the volume flowing through one location. Recovery is expected to proceed gradually as users' devices reconnect. The cause is unconfirmed

Servers that were brought back stop responding again once they receive traffic

While investigating the cause, it is narrowing the types of incoming traffic in some places, to check whether a particular type of request is involved. It is rebuilding some servers with the previous software configuration to test them. The next update is at 10:00 a.m.

Revises its list of what is affected. It narrows to features that exchange data with email

Explains that features that exchange data with email (Exchange Online) are affected and that the rest is working. Teams chat and online meetings are mostly usable, and files placed in SharePoint can be opened. On the other hand, Safe Links, which checks that links are safe, may not be working. The original cause is still under investigation

Learns how the servers stop. The process that sets up encrypted connections was overwhelmed

On the affected servers, the process that sets up encrypted, secure connections was overwhelmed and the servers could not handle requests. It will try a configuration change to fix this on some servers, then extend it together with restarts. It also began rolling back a recent network configuration change whose timing matches the start of the outage. The next updates are at 11:00 a.m. (Outlook) and 11:30 a.m. (Microsoft 365 overall)

Restart shows promise. It will extend the fix while confirming stability

Reports good results from restarting the affected infrastructure. It will extend the fix while watching whether the servers it brought back stay stable. This is not an announcement of full recovery. The next updates are at 11:30 a.m. (Microsoft 365 overall) and 12:00 p.m. (Outlook)

Adds infrastructure capacity to support the regions that are coming back

Reports it is adding infrastructure capacity wherever it can, to support traffic in the regions that are coming back. While watching the results, it is looking for ways to improve all regions. This is not an announcement of full recovery. The next updates are at 12:00 p.m. (Microsoft 365 overall) and 12:30 p.m. (Outlook)

The changes it made are not working as expected

Reports that, on watching how the changes it made to improve the service were behaving, they are not working as expected. While the uneven distribution of traffic continues, it is looking for another way to add capacity. The next updates are at 12:30 p.m. (Microsoft 365 overall) and 1:00 p.m. (Outlook)

"No signs that it was caused by a malicious attack"

Reports that it is re-examining traffic flows and infrastructure to deal with the continuing uneven distribution of traffic, and looking for ways to improve routing. It said it will confirm why servers stopped and make concrete the steps to stabilize them. The next update is at 1:30 p.m.

Part of the service comes back in the region where it intervened, but does not stay back

Reports that it adjusted traffic rules, re-routed traffic, and blocked specific traffic, and that part of the service came back in the region where it intervened. But it did not stay back, and it is considering additional steps to stabilize the infrastructure as a whole. The next updates are at 2:00 p.m. (Microsoft 365 overall) and 2:30 p.m. (Outlook)

Calls to backend servers surge. Fixes cannot be applied to frozen machines

Reports that calls from the load-balancing system to backend servers are surging, and that they have also increased because traffic was re-routed for recovery. It is adding virtual machines to lower the load and trying to force a recent network change onto machines that are not doing well, but the machines are frozen and cannot take it. The next updates are at 3:00 p.m. (Microsoft 365 overall) and 3:30 p.m. (Outlook)

Investigates why the calls surged, and identifies and repairs machines

Reports that it is running several efforts in parallel, to pin down why calls to backend servers surged and to recover the backend servers (Outlook). It is carefully identifying and repairing affected machines, which makes it easier to confirm whether the change has been applied. Its statement that there are no signs of a malicious attack is unchanged. The next update is at 4:00 p.m.

Considers traffic controls to rebuild the front-end servers

Reports that, to raise the capacity and stability of the front-end servers, it is considering traffic controls such as throttling the volume, adjusting traffic rules, and switching to other regions (Microsoft 365 overall). It is also expanding testing in a closed environment and improving traffic monitoring and ways of detecting problems. Its statement that there are no signs of an attack is unchanged. This is not an announcement of full recovery. The next update is at 4:00 p.m.

After restarts, it checks whether the fix is working. A slight improvement

Reports that it is watching servers region by region and deciding how to raise capacity. After restarting infrastructure, it is checking whether the fix it built was applied and is working as intended, and so far has seen a slight improvement. In parallel, it is adding capacity with virtual machines. At 3:16 p.m., it added to its impact description that email running on in-house servers may be affected if it exchanges mail with Exchange Online. Its statement that there are no signs of an attack is unchanged. This is not an announcement of full recovery. The next update is at 4:30 p.m.

The fix shows promise on some infrastructure. It will extend it to other servers

Reports that after applying a fix to upstream components involved in authentication and routing settings, there are good results for server stability on part of that infrastructure. While watching, it is extending the fix to the servers that support regions currently in operation. Its statement that there are no signs of an attack is unchanged. This is not an announcement of full recovery. The next update is at 5:30 p.m.

Confirms stability with the fix, and extends it starting with regions in business hours

Reports that server stability was confirmed on the infrastructure where the fix to components involved in authentication and routing settings was applied. It has begun extending the fix to other infrastructure in turn, giving priority to infrastructure supporting regions now in business hours and those about to enter them. It is also building additional changes to further improve stability and capacity. Its statement that there are no signs of an attack is unchanged. This is not an announcement of full recovery. The next update is at 6:00 p.m.

Signs of stability. The period for delivering delayed email is extended to 48 hours

Reports that signs of stability have begun to appear on the affected infrastructure (Microsoft 365 overall). But capacity has not yet returned to normal levels, and because traffic is being returned carefully, conditions vary. It is cycling through infrastructure one unit at a time: draining traffic, restarting, repairing, and returning traffic in stages. To avoid losing delayed email, it extended the period during which it keeps trying to deliver to 48 hours. Its statement that there are no signs of an attack is unchanged. This is not an announcement of full recovery. The next update is at 7:00 p.m.

Recovery proceeds in stages, with gradual improvement in some functions

Reports that it is carrying out recovery in stages on the affected infrastructure (Microsoft 365 overall). According to overall measurements and reports from users, some functions are improving gradually. But conditions vary, and capacity has not yet returned to normal levels. To protect delayed email, the 48-hour period for trying to deliver it continues. It says there is no evidence of malicious activity. This is not an announcement of full recovery. The next update is at 8:00 p.m.

Consumer Outlook.com and OneDrive are also affected

Announces on the Microsoft 365 consumer status page that Outlook.com, OneDrive, OneNote, Microsoft To Do, Teams and the web version of Microsoft 365 may be unavailable, or that some operations may not work. It says other services may also have problems. It is working in parallel to identify the cause and to recover. The page does not say how this relates to the business outage (MO1550821). The next update is at 9:30 p.m.

Recovery work finishes in part of Asia-Pacific. Mailbox connections improve

Reports that recovery work has finished on part of the infrastructure in Asia-Pacific regions (Outlook and Microsoft 365 overall). It is returning traffic gradually, and mailbox connections and the processing of delayed email are improving. But some people still have intermittent problems. It will now extend the same work to infrastructure in other regions. The 48-hour period for delivering delayed email continues. It says there is no evidence of malicious activity. This is not an announcement of full recovery. The next update is at 9:00 p.m.

"Japan is relatively stable." Europe and North America improve too

Reports that recovery is progressing in Europe, and that service availability and email delivery speed are improving across a wide range of the affected infrastructure (Outlook 9:00 p.m., Microsoft 365 overall 9:18 p.m.). It says Japan is relatively stable and North America is also improving. But while recovery work continues, some people still have intermittent problems. The 48-hour period for delivering delayed email continues. It says there is no evidence of malicious activity. This is not an announcement of full recovery. The next update is at 10:00 p.m.

Recovery continues in North America, Europe and Asia-Pacific

Reports that recovery is continuing in the affected regions (Microsoft 365 overall 9:59 p.m., Outlook 10:00 p.m.). It says improvement has spread in North America, continues in much of Europe, and there are signs of recovery in Asia-Pacific. But while repairs to the remaining infrastructure proceed, some people still cannot connect intermittently, and some people's email is delayed. It is concentrating on stabilizing the infrastructure that has come back, finishing repairs on the rest, and reducing the pile of delayed email, and is confirming recovery by connection method. This is not an announcement of full recovery. The next update is at 11:00 p.m.

The backlog of email shrinks greatly and nears normal levels

Reports that service availability continues to improve, and that the backlog of email has shrunk greatly and is nearing normal levels (Outlook and Microsoft 365 overall). But some people still cannot connect intermittently, and some people's email is delayed. It is investigating the remaining problems while applying additional measures and bringing the remaining infrastructure back. It says there is no evidence of malicious activity. This is not an announcement of full recovery. The next update is at 12:00 a.m. on the 14th

Improvement continues. Focus shifts to the remaining problems

Reports that service availability continues to improve across the affected Microsoft 365 services (Microsoft 365 overall 11:55 p.m., Outlook 11:57 p.m.). But some people still cannot connect intermittently, and some people's email is delayed. It is shifting its focus to resolving the remaining problems and restoring stable service for all users, and is confirming recovery by connection method. It says there is no evidence of malicious activity. This is not an announcement of full recovery. The next update is at 1:00 a.m. on the 14th

Clearing the "remaining impact." The next update is two hours away

Reports it is concentrating on clearing the remaining impact and restoring service reliably (Microsoft 365 overall 12:52 a.m., Outlook 12:53 a.m.). It is confirming recovery by connection method and watching whether stability holds. The next update is at 3:00 a.m., two hours later, instead of the hourly updates so far. It says there is no evidence of malicious activity. This is not an announcement of full recovery

Microsoft apologizes and explains the cause. Not an attack, and nothing to do with AI

Expresses deep apology for the impact of the outage on users and businesses (Outlook and Microsoft 365 overall). Says the service as a whole has broadly recovered and stabilized. Explains the cause as a problem in earlier network capacity expansion work that came to the surface after a recent network change, a technical problem unrelated to cyberattacks or to AI and agents. It has dealt with the underlying problem and is restoring service to the remaining users and regions. It said that because of the size of demand, it restored service little by little, confirming stability at each stage, which is why it took time. It will issue a post-incident report once its review is complete. This is not an announcement of full recovery. The next update is at 5:00 a.m.

Access returns first, and email delivery catches up later

Reports on the consumer status page that, as the infrastructure stabilizes, it is flushing backed-up email and re-routing traffic. As a result, even when sign-in and access improve, email delivery and processing may catch up later. There is still no outlook for full recovery. The next consumer update is at 9:00 a.m.

For businesses too, no timeline yet for full recovery

For businesses (Microsoft 365 overall 5:01 a.m., Outlook 5:02 a.m.), it issued the same explanation as for consumers. As the infrastructure stabilizes, it is flushing backed-up email and re-routing traffic. Sign-in and access return first, and email delivery and processing may catch up later. There is still no outlook for full recovery. The next update is at 9:00 a.m.

Recovery continues. Because of the size of the impact, extended monitoring

Reports that recovery is continuing in the affected environment (Outlook and Microsoft 365 overall). Because the impact was large, it is watching longer to see whether additional measures are needed. It will also call the incident resolved only after confirming that all email that piled up during the outage has been processed. For Microsoft 365 overall, it says it has taken action on most of the impact to related products. This is not an announcement of full recovery (resolution). The next update is at 11:30 a.m.

Confirms recovery is continuing. No announcement of resolution yet11:20 a.m. update

Reports that it has confirmed recovery is continuing in the affected environment (Outlook). It will keep watching whether the measures it took keep working and the processing of backed-up email. It has taken action on most of the impact to related products and continues work on the rest. This is not an announcement of full recovery (resolution). The next update is at 1:30 p.m.