On 12 November 2026, a major Microsoft 365 outage disrupted access to Outlook, Exchange Online and other connected services, with problems reported across at least 74 countries and territories. Downdetector logged nearly 140,000 reports of Outlook issues at around 18:00 GMT, more than 2,000 times the normal level. Those are user-submitted reports rather than a confirmed count of affected people, and the real number was almost certainly higher.
Business continuity during IT outages is decided before the outage starts. The lesson of this incident is not that cloud services fail. It is that many organisations found their emergency communication, their escalation path and their incident coordination all lived inside the system that had just stopped working. More than half a day later, Microsoft was still working the problem, and the page it had pointed customers to for updates would not load for some of them either.
A global Microsoft 365 outage disrupted Exchange Online, Outlook, Copilot and parts of Teams across at least 74 countries from 12 November 2026. Microsoft reported no indication of malicious activity. The incident shows why organisations need communication and incident coordination that does not depend on a single platform.
What follows reflects Microsoft's own service updates and international reporting as at 08:50 UTC on 13 November 2026, while the incident was still open. Treat it as a case study in dependency rather than a verdict on any one provider.
What Happened During The Microsoft 365 Outage?
A fault in Microsoft 365 infrastructure degraded Exchange Online from the afternoon of 12 November 2026, disrupting Outlook, calendars, Copilot and Outlook-dependent features in Teams. Microsoft said it had no indication of malicious or cyber activity, attributing the problem to servers becoming unexpectedly unavailable and placing elevated load on the infrastructure that remained.
Reports to Downdetector peaked at nearly 140,000 for Outlook at around 18:00 GMT on 12 November, and were still running at more than 43,000 an hour across 72 countries by 07:00 GMT the following morning, according to BBC live coverage. These figures record people who chose to report a problem to a monitoring site. They are not a measure of how many users were affected. For scale, Microsoft has around 430 million Microsoft 365 users worldwide.
Microsoft first described the issue as affecting users in the Americas, then confirmed it could affect Microsoft 365 connectivity in any region.
Why Experiences Differed So Widely
Jake Moore of the security firm ESET described the mechanism to BBC Radio 4 in terms of a blocked motorway lane, where traffic forced into the remaining lanes backs up and slows down. He also explained why two organisations saw completely different symptoms: different customers sit on different sets of servers, which is why some found Teams working normally while their email would not update.
Recovery was uneven rather than simply unsuccessful. Microsoft reported "marginal success", then "positive results" for service stability and increased capacity, after earlier attempts had not been "taking as expected". Charles Lamanna, Microsoft's executive vice-president of Copilot, said there was "no indication this is the result of malicious or cyber activity", and the company said it would publish the root cause in a post-incident report once the problem was mitigated.
Which Services Were Affected
What mattered operationally was the split between services that depend on Exchange Online and services that do not. In its update at 05:46 UTC on 13 November, Microsoft confirmed that anything relying on Exchange Online was degraded while independent tools kept working.
| Microsoft service | Reported disruption | Potential business impact |
|---|---|---|
| Exchange Online and Outlook | Inboxes failing to load and delayed mail across web, desktop and mobile | Internal and external email unreliable; correspondence and approvals stall |
| Microsoft Teams | Core chat, channels and meetings largely working; calendar invites, scheduling and channel creation failing | Ad hoc collaboration survives, but convening a scheduled incident bridge becomes difficult |
| Microsoft 365 Copilot | Chat failing to load or respond, unable to draw on work mail, calendars or files | Any process that had come to rely on AI assistance pauses |
| SharePoint Online and OneDrive | Files largely reachable; recently used file lists unavailable | Documents retrievable if staff know the location, slower if they do not |
| Microsoft 365 admin centre and Defender | Administrators may be unable to load the admin centre or security portal | IT cannot see service health or work the security console during the incident |
Two details deserve the attention of anyone writing a continuity plan. Microsoft published incident information on its public service health page precisely because administrators might be unable to reach the admin centre. And RTÉ reported that users complained the update page itself would not load. The channels you would normally use to find out what is broken were themselves affected.
Why Did The Disruption Matter To Organisations?
A Microsoft 365 outage affects businesses well beyond email. It slows internal and external communication, delays decisions and escalation, complicates coordination of distributed teams, restricts access to business information and disrupts customer service. Severity depends less on the technical fault than on how much of an organisation's operating rhythm runs through one suite.
The spread on 13 November made the point without much need for interpretation. Japan's government reported disruption to its shared IT platform, Singapore government systems were affected, Australian federal police and intelligence agencies reported problems they described as very much email-related, and communications at the Philippine Supreme Court were hit. Several UK police forces, including the Metropolitan Police, Greater Manchester and North Yorkshire, told the public that online form submissions might not work and asked people to telephone instead.
Not everything broke, and saying so matters. Heathrow, Manchester and Stansted airports all confirmed their operations were running normally, with the impact confined to corporate systems and minor processes. UK intelligence operations were unaffected because anything secret runs on a separate system. Partial degradation, not collapse, is the usual shape of these events.
Uncertainty Is Harder To Manage Than Failure
Communication degrades first, and least visibly. Conor Flynn of Waystone Digital Assurance told RTÉ's Morning Ireland that intermittent service is the hardest kind to work with, because people "won't know until they try to send or expect to receive a message whether it's working or not". One communications consultant told the BBC he had resorted to emailing contacts at other firms via their personal Gmail accounts, adding that he "simply wouldn't know" if he missed an important message. An organisation in that state is not offline. It is unsure, which is worse for decision-making.
Escalation suffers next. Most escalation procedures assume a working mailbox and calendar: email the duty manager, raise it at the next stand-up, put a bridge call in the diary. With Exchange Online degraded, calendar invites and scheduled meetings were among the first casualties, so the mechanics of convening people stopped working even where chat still functioned.
Then the second-order effects. Multi-site teams lose the shared thread holding their picture of events together, customer service loses correspondence history, and security teams may lose console access at the moment they most want visibility, as administrators found with Defender and the admin centre.
What The Incident Reveals About Technology Dependency
Concentration is the real exposure. When email, calendars, chat, file storage, identity and security tooling all come from one ecosystem, a single fault can remove several supposedly separate capabilities at once. The issue is not the reliability of any one provider, which is generally high, but the absence of an independent route when that provider has a bad day.
Consolidation is a rational commercial choice. It lowers cost, simplifies administration and often improves security posture. It also converts what look like separate systems into one dependency. November showed this precisely: Teams chat largely worked, yet Teams features reaching into Exchange did not, because they shared an upstream component.
The point was made repeatedly by people watching the incident. Nicky Choo of Mimecast told the BBC that the outage highlighted the risk of relying on a single technology provider for critical operations, and that businesses "should review that dependence and build in alternatives, with clear contingency plans to keep essential operations running during an outage". The UK Defence Minister, Luke Pollard, said that in an environment where organisations are so dependent on technology, systems need to be more resilient and to recover faster when problems occur. The UK government said it had robust contingency plans in place to minimise disruption to its own services.
Communication redundancy means having alternative ways to reach people when a primary communication platform becomes unavailable. These channels should be designed to minimise shared dependencies, tested regularly and supported by clear procedures that employees understand. Operational resilience, the broader obligation many regulated firms now carry, asks a harder version of the same question: can you keep delivering important services through disruption, and can you show how.
Why A Business Continuity Plan Is Not Enough On Its Own
Most organisations have a business continuity plan. Far fewer have communication arrangements that work when the plan is actually needed. A document that names a crisis team, but assumes that team can be convened by calendar invite, fails at the first step of a Microsoft 365 outage.
When primary communication fails during an incident, the response does not stop. It fragments. People improvise on personal phones and consumer messaging apps, teams work from different versions of events, decisions go unrecorded, and nobody holds a reliable picture of who was told or what was done. The incident becomes harder to manage and much harder to evidence afterwards.
What that looks like varies by sector, and this outage caught most of them in the same working day.
- Financial services. A payments or claims disruption needs operations, risk, compliance and communications aligned within the hour. Lose the bridge and the mailboxes, and the coordination layer goes while the regulatory clock runs.
- Healthcare. A hospital coordinating bed capacity, theatre lists or a major incident cannot wait for email to recover, and clinical staff are rarely at a desk.
- Manufacturing. A plant with a systems outage needs shift supervisors, maintenance and safety reached directly, across sites and time zones where email was never the right channel.
- Energy and utilities. Field engineers work away from corporate networks. Reaching them, and confirming they got the instruction, is the whole task.
- Transport and logistics. Disruption spreads fast across a network, and recovery depends on crews, depots and control rooms acting on one version of the plan.
- Government and public sector. Multi-site workforces and statutory duties mean the duty to inform people does not pause because a supplier is degraded.
The police forces that redirected the public to the telephone had, in effect, a contingency channel ready and a procedure for announcing it. That is the whole discipline in miniature.
What Should Organisations Do To Prepare For IT Outages?
Every organisation should have an IT outage response plan that identifies alternative communication channels, escalation responsibilities and the procedures required to maintain critical operations. Preparation has to be in place beforehand: business continuity during IT outages cannot be assembled while the incident is running.
Ten practical steps, in the order most organisations should tackle them.
- Establish at least one communication channel independent of your primary platform, usually SMS or voice, and confirm who is authorised to trigger it.
- Keep employee and response team contact data current, including mobile numbers, synced automatically rather than maintained by spreadsheet.
- Write predefined incident message templates and have them approved in advance, so nobody drafts from scratch under pressure.
- Use SMS and voice for time-critical instructions to people away from a desk or whose corporate mail is affected.
- Set escalation rules for unanswered alerts, so an unacknowledged message moves to another channel or another person automatically.
- Identify critical decision-makers and response teams in advance, with deputies named for each role.
- Tell employees in advance how the contingency channel reaches them and what a genuine alert looks like, so it is not mistaken for spam.
- Test continuity procedures on a schedule, including at least one exercise that assumes email and collaboration tools are unavailable.
- Maintain visibility of acknowledgements, tasks and incident progress, so the response has a live status rather than a set of assumptions.
- Review the response afterwards against a recorded timeline, and feed what you find back into the plan.
Step 8 is the one most often skipped. A contingency channel nobody has exercised is a plan rather than a capability, and an outage is a poor moment to discover that half the mobile numbers are three years old.
How Can Organisations Maintain Communication When Microsoft 365 Is Unavailable?
The practical answer is to use channels that do not depend on the affected service, and to know in advance which ones those are. During a Microsoft 365 disruption the distinction is not simply email against everything else. It depends on which service each channel relies on.
Crises Control has confirmed how its own notification channels behave when Microsoft 365 is unavailable.
| Channel | Availability without Microsoft 365 |
|---|---|
| SMS | Available |
| Voice calls and IVR | Available |
| Mobile push notifications | Available |
| Web alerts | Available |
| Email to non-Microsoft accounts, such as Gmail | Available |
| Email to Microsoft accounts | May be unavailable |
| Microsoft Teams notifications | Unavailable if Teams is down |
Two qualifications follow from that table and both matter. Microsoft Teams notifications and email to affected Microsoft mailboxes are not alternatives during a Microsoft 365 outage, because they rely on the service that is degraded. And sending to an alternative email provider does not resolve every email disruption: it helps where the recipient has a usable non-Microsoft address, which is not the general case inside most organisations.
The more reliable approach is to configure several channels in advance, understand which of them share a dependency, and treat SMS, voice and push as the routes most likely to remain available when corporate mail is the thing that has failed.
How Crises Control Supports Business Continuity During IT Outages
Crises Control is an operational incident coordination platform. It provides configured communication channels separate from everyday workplace collaboration tools, together with incident activation, task tracking, operational visibility and a complete record of the response, so an organisation can keep coordinating when its usual tools are degraded.
What Happened During This Outage
During the Microsoft 365 outage discussed in this article, the Crises Control team confirms that the web portal and mobile app remained accessible, customers were able to continue launching incidents, and notifications continued to be sent by phone, SMS and the mobile app. No loss of functionality or degraded performance was reported.
That is a statement about this particular incident. It is not a guarantee that Crises Control cannot be affected by any future Microsoft infrastructure, cloud hosting or third-party service disruption.
The Azure Qualification, Which Matters Here
Crises Control is hosted on Microsoft Azure. Microsoft Azure and Microsoft 365 are separate services, which is why an incident degrading Exchange Online does not automatically affect a platform hosted on Azure, as this outage demonstrated. That separation is not the same as independence. Azure can experience incidents of its own, and no claim is made here that Crises Control is insulated from every Microsoft infrastructure failure, or that any communication channel is free of third-party dependencies.
Alternative Communication
Ping, the mass notification module, sends alerts through mass notification software across SMS, voice calls and IVR, mobile push notifications, web alerts, email and Microsoft Teams. Notifications can be sent through multiple configured channels as part of a cascading process, so a message that does not land on one route continues on another. During a Microsoft 365 disruption, SMS, voice, push and web alerts remain available, subject to their own providers and the underlying infrastructure.
Incident Coordination
Launching an incident does more than send a message. Teams activate predefined response plans, notify predefined groups without selecting recipients by hand, reuse approved communication templates, and build a chronological record of communications, updates and decisions from activation through to resolution. Incident management software gives the response a home that is not a mailbox, and incident task management software assigns response actions to named owners, tracks progress to completion in real time and escalates overdue or unclaimed work.
Acknowledgement And Escalation
The platform records who received notifications and who acknowledged them, and tracks responses so incident managers can see who has responded and who still needs to act. Where a recipient does not acknowledge an alert, it can escalate automatically to other recipients. This is the part that converts a send into a response: an unacknowledged message is not yet communication.
Access And Availability
If an organisation signs in through Microsoft Entra ID, formerly Azure Active Directory, and that service is unavailable, customers can use alternative Crises Control username and password credentials. Access therefore does not have to depend entirely on the customer's own Microsoft single sign-on service. Authentication configurations differ between organisations, so it is worth confirming yours and making sure the relevant people hold working alternative credentials before they need them.
Crises Control operates a multi-region hosting footprint across the United Kingdom, Europe, the Middle East, the Kingdom of Saudi Arabia and North America, and carries a contractual uptime commitment of 99.95%. That is a contractual service availability commitment rather than a promise of uninterrupted service in all circumstances.
From Notification To Coordination
The distinction matters. Sending an SMS or making a voice call can help an organisation reach employees when Microsoft 365 is unavailable. However, reaching people is only the first step. Incident managers also need to know who has acknowledged the alert, which actions have been assigned, what remains outstanding and how the situation is progressing. Crises Control brings these activities together, helping organisations move from initial notification to coordinated incident management.
The platform is not a replacement for Microsoft 365. It is a dedicated incident coordination and communication system for the periods when primary workplace technology is disrupted. The same pattern runs through Crises Control's material on out-of-band crisis communication, on alerting field engineers during a control room outage and on business continuity software, which puts the underlying point plainly: business continuity plans do not fail on paper, they fail during execution.
What To Do Next
No organisation can stop a provider having an outage, and November is a reminder that scale and engineering quality do not remove the possibility. Business continuity during IT outages is therefore not about prevention. What you control is narrower and more useful: whether people can be reached when the usual route is gone, whether someone owns each action, and whether the response can be reconstructed afterwards without relying on memory.
The test worth running is simple. Take your current incident plan and assume email, calendars and your collaboration suite are degraded for a full working day. If the plan still works, you have continuity. If it quietly assumed a working mailbox, you have a document. The gap is almost always preparation rather than technology.
Discover how Crises Control helps organisations communicate, coordinate and manage critical incidents from one connected platform. Book a demonstration to see how your organisation can strengthen its incident response and operational resilience.
Frequently Asked Questions
What is business continuity during an IT outage?
Business continuity during an IT outage is an organisation's ability to keep delivering important services when the technology it depends on becomes unavailable. In practice it means reaching people through channels that do not share the failed dependency, coordinating the response, and recording what was decided. A documented plan alone is not continuity until it has been tested against a realistic failure.
How can businesses communicate during a Microsoft 365 outage?
Through channels that do not rely on the degraded service, arranged beforehand. SMS, voice calls, mobile push notifications and web alerts remain usable when Exchange Online is affected, provided contact data is current and someone is authorised to send. Email to Microsoft mailboxes and Microsoft Teams notifications are not reliable alternatives during a Microsoft 365 disruption.
Can Crises Control help businesses communicate during a Microsoft 365 outage?
Yes. Crises Control supports multi-channel incident communication through configured channels such as SMS, voice calls, push notifications and email, which can provide alternative routes when Microsoft 365 is disrupted. Its Incident Manager and Task Manager modules also help organisations coordinate activities, assign responsibilities and track progress. Platform availability remains subject to its underlying infrastructure and connectivity.
Can Crises Control still be accessed if Microsoft Entra ID is unavailable?
Yes. Where an organisation uses Microsoft Entra ID single sign-on and that service is unavailable, customers can sign in with alternative Crises Control username and password credentials instead. Authentication configurations vary between organisations, so confirm your own arrangement and make sure the relevant people hold working alternative credentials before an incident.
Which Crises Control notification channels work without Microsoft 365?
SMS, voice calls and IVR, mobile push notifications and web alerts are available without Microsoft 365, as is email to non-Microsoft accounts such as Gmail. Email to Microsoft accounts may be unavailable, and Microsoft Teams notifications will not work if Teams is down. Configuring several channels in advance is what makes the difference.
What is the difference between mass notification software and incident management software?
Mass notification software sends alerts across multiple channels and records delivery and acknowledgement. Incident management software keeps the incident open after the alert, assigning actions to named owners, tracking completion, logging decisions and producing an exportable record. Notification tells people something has happened; incident management coordinates what the organisation does next.
Why should organisations have an IT outage response plan?
Because the decisions are too slow to make during the outage itself. An IT outage response plan identifies alternative communication channels, escalation responsibilities and the procedures needed to keep critical operations running, and names who is authorised to act. Without one, the response fragments across personal phones and consumer apps, leaving no reliable record afterwards.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
