The global Microsoft outage that disabled Outlook and Exchange Online was still causing intermittent access and delayed email delivery on Friday, more than 18 hours after problems began. Microsoft said it had found no evidence of a cyberattack, but the disruption showed how quickly ordinary work can stall when email, calendars and authentication all depend on the same cloud platform.
Microsoft later narrowed the technical problem to a process responsible for establishing secure connections. That process became overwhelmed, leaving servers unable to handle requests. The company tested configuration changes, restarted servers and rolled back a recent change that correlated with the start of the outage.
What caused Outlook and Exchange to fail?
The disruption began at about 12:30 p.m. ET on Thursday and affected both individual users and business customers. By 6:11 a.m. ET on Friday, Microsoft said it had no evidence of malicious activity connected to the incident.
The company promised a full post-incident report covering the root cause and additional safeguards after service had been restored. That report will matter because the early explanation points to an internal systems failure rather than an outside attack. In other words, no sophisticated intruder was required. A strained connection process and a poorly timed change were quite sufficient.
Microsoft said it was adding capacity, stabilising infrastructure and reducing email queues. It also extended the email timeout window to 48 hours so delayed messages would have more time to reach their destinations rather than simply failing.
Recovery was uneven. Asia-Pacific showed encouraging progress, Japan remained comparatively stable and much of Europe recorded sustained improvement. Microsoft later reported broader gains in North America, although some users continued to face intermittent access and delayed delivery.
How many people were affected?
The exact number remains unknown. The original estimate that millions of users were affected has not been confirmed by Microsoft, and the Associated Press reported no verified total.
Downdetector received about 130,000 complaints from dozens of countries on Thursday. That figure measures reports submitted to the tracking service, not every affected account. Microsoft has more than 450 million paid commercial Microsoft 365 subscriptions, but that is the potential customer base, not an outage count. The distinction is less exciting than a very large number, but considerably more accurate.
The disruption reached several Microsoft 365 products and features tied to Exchange Online, including:
- Outlook mailbox access and email delivery
- The Microsoft 365 admin centre
- Recently used file lists in Microsoft 365 apps
- Microsoft 365 Copilot functions
- Some SharePoint Online features
- Microsoft Teams calendars, invitations, scheduling and event creation
Teams chat and meetings remained largely functional, according to the Associated Press. The main failures involved functions that relied on Exchange, particularly calendars and scheduling. This was not a complete Teams shutdown, though anyone unable to organise a meeting may have found that distinction rather theoretical.
Which public services were disrupted?
The failure spread well beyond delayed office correspondence. A trial in Manchester was halted, while British police temporarily could not receive online crime reports. Email problems affecting National Health Service-related systems also raised concerns about prescription delays.
Australian Medical Association president Dr Michael Bonning said some medical facilities returned to paper prescriptions because email-dependent multifactor authentication prevented staff from accessing prescribing systems. The outage therefore blocked not only messages but also entry to separate services that used those messages to verify identities.
Government email systems in Singapore went down. The Philippine Supreme Court, Norwegian ministries and Japanese government infrastructure also reported disruption. Japan’s Deputy Chief Cabinet Secretary Masanao Ozaki said officials were “keeping a close eye on the developments” and using alternatives including telephones, a technology that briefly regained its former dignity.
Air India rerouted email while continuing flights. IndiGo said its flight operations were unaffected. The distinction was important: the communications systems were struggling, but aircraft were not grounded as a direct result.
Why officials did not suspect a cyberattack
Australian Home Affairs Minister Tony Burke said Microsoft believed the incident resembled the 2024 CrowdStrike disruption, “where there is an update that has gone awry,” rather than a cyberattack.
That comparison reflects the apparent sequence reported by Microsoft. A recent change correlated with the start of the outage, secure connection systems became overloaded and servers stopped processing requests. Engineers then rolled back the change, restarted infrastructure and adjusted configurations while traffic was gradually restored.
Microsoft continued to treat the incident as urgent even after ruling out malicious activity as the likely cause. Recovery required more than switching a system off and on again, though restarting servers was indeed part of the work. The company also had to process the backlog of messages accumulated while its infrastructure was unavailable.
Delayed delivery can persist after access returns because queued emails must still move through the system. That explains why some customers could open their inboxes again while messages remained late or Exchange-dependent features continued to behave unpredictably.
What the failure says about cloud dependence
The wider issue is not simply that Outlook stopped working. Courts, police forces, hospitals and governments had built daily operations around a single cloud email provider, often linking that provider to calendars, identity checks and access controls.
When those systems share the same dependency, one technical failure can disable several layers at once. Staff may lose email, then discover they cannot sign in to another platform because its authentication code is being sent through the unavailable email service. Efficiency has a habit of looking excellent until every shortcut fails together.
The disruption underlined the need for backup arrangements that do not rely on the affected platform. Those can include telephone contact lists, paper workflows, alternative messaging channels and authentication methods independent of the primary email provider.
Microsoft’s eventual post-incident report should explain why the connection process became overwhelmed, how the recent change passed internal checks and what safeguards will prevent a repeat. Service restoration will clear the queues. The more difficult task is reducing the risk created when so much essential infrastructure depends on one company’s servers remaining available.
