Microsoft 365 Outage Hits Outlook, Teams and Defender XDR

Microsoft spent Friday restoring services after a failure inside Exchange Online cascaded through more than twenty connected products.The Microsoft 365 outage began late on Thursday in the Americas and passed the 18-hour mark by Friday morning. Users in 74 countries lost reliable access to email, chat and collaboration tools. Microsoft has not yet named a root cause for the failure.

For security teams, the damage reached further than blocked inboxes and failed logins. Microsoft Defender XDR appeared on the company’s ownlist of affected services. Safe Links stopped resolving rewritten URLs, and administrators lost the ability to release messages from quarantine while the suite they protect stayed unreachable. The Microsoft 365 outage stripped visibility and control from defenders at the same moment their communication channels turned unreliable.

How the Microsoft 365 outage unfolded

A separate Teams incident hit North and South America on Thursday afternoon and cleared within about an hour. Microsoft then opened EX1550543 at 16:17 UTC, after users across the Americas lost access to Exchange Online mailboxes through several connection methods. Two hours later came MO1550821, a suite-wide advisory naming Exchange Online, Teams, Share Point Online, Copilot and Defender XDR. By Friday morning that advisory listed twenty services, nearly double the first evening’s count.

Complaint volumes climbed fast once the problem crossed into Europe and Asia. Outage tracker Downdetector logged close to 130,000 Outlook reports at the peak, from 74 countries inside roughly an hour. Teams complaints in the United Kingdom spiked from around 6:15 p.m. local time. Microsoft has published no impact figure, so tracker data remains the only public measure ofthe Microsoft 365 outage.

Consumer accounts suffered under a separate incident covering Outlook.com, OneDrive, OneNote and Teams. The company paused all deployments and configuration changes at roughly 19:06 UTC, freezing the environment while engineers worked. Restarts then fell short, because restored servers went unresponsive again as soon as load returned. Recovery from the Microsoft 365 outage stretched through the night with no firm restoration estimate.

What Microsoft has said about the cause

Servers inside the Exchange Online infrastructure went offline unexpectedly, and a process on the remaining servers that sets up secure connections became overwhelmed. Those servers then stopped handling requests too. Microsoft stated early on that the elevated load did not come from extra user traffic, which points the investigation toward internal behavior rather than demand. Engineers spent Friday analyzing diagnostic data to work out what triggers the pattern.

Overnight the company began reverting a recent network configuration change whose timing lines up with the start of the disruption. That marked a shift, because earlier updates on the Microsoft 365 outage found no matching change. Correlation is not causation here, and Microsoft has stopped short of naming the change as the trigger. A post-incident report covering root cause and defense-in-depth repair items will follow once mitigation completes.

Microsoft has repeated in successive updates that no evidence of malicious activity sits behind the Microsoft 365 outage. An executive vice president confirmed publicly that no security breach caused the failure. That distinction matters for incident responders, who otherwise face pressure to treat a large availability event as a possible attack. The company also extended its email timeout window to 48 hours so delayed messages would survive the backlog.

Security controls went down with the mailboxes

Defender XDR sat on the affected service list, so detection and response tooling degraded alongside the platform it protects. Safe Links, the Defender for Office 365 feature that checks URLs at click time, stopped working. Users who clicked a rewritten link in Outlook or Teams found that the page would not open. Releasing items from quarantine could fail as well.

Administrators faced a harder problem than blocked mail, because the failure reached the admin center itself. The console they use to investigate and remediate turned unreliable at the point it mattered most, and Microsoft pointed them to its public status page instead. Advice circulating at the time told teams to avoid changes on their own infrastructure, since local troubleshooting risked adding fresh faults.

Phishing operators treat events of this kind as free pretext, and the Microsoft 365 outage gave them ideal conditions. A workforce expecting mail delays and login failures will accept a message about restoring access with less scrutiny than normal. Admin guidance during the incident told teams to warn users about scams, and the controls that would catch such a message sat among the degraded ones. Windows 365 customers using Customer Key also lost access to their Cloud PCs.

The Microsoft 365 outage spread well past Microsoft

Exchange Online holds the mail, calendars and contacts that a long list of other services read from, which explains how one component took twenty products down with it. The spread from mail to Teams to SharePoint to Copilot points toward a shared connection layer rather than a fault sealed inside Exchange. Organizations treating Microsoft 365 as a set of separate tools learned they had bought one dependency rather than several.

Third-party products broke along the same chain, reaching vendors with no direct stake in Microsoft’s infrastructure. OpenAI and Anthropic both reported problems with their Microsoft 365 connectors, the integrations that let their assistants read workplace email, calendars, Teams conversations and SharePoint files. Anthropic traced its fault to an upstream provider before confirming the Microsoft incident as the source. Dynamics 365 Contact Center agents lost access for close to eight hours and fell back to phones and paper.

Public bodies and large enterprises reported knock-on effects from the Microsoft 365 outage across several continents. Japan’s National Disaster Management Agency said it could not send or receive email, and Australia’s domestic intelligence agency and federal police were among the organizations hit as Friday began locally. Indian carriers IndiGo and Akasa Air reported disruption to email support, while Air India rerouted its email and kept flights running normally.

What the failure means for resilience planning

Microsoft 365 apps serve 430 million users, and a January outage already ran close to ten hours. An Outlook failure in July 2025 lasted around nineteen. A pattern of multi-hour disruption in a platform carrying mail, collaboration and security tooling changes the calculation for continuity planning. The practical question concerns what an organization can still do during the hours its provider is down.

Out-of-band communication deserves attention first, because teams with an alternative channel ready moved to it within minutes. The rest spent the day improvising. The same logic applies to security operations, where cloud-hosted detection tooling becomes a visibility gap the moment it degrades. Documented fallbacks for quarantine review, link inspection and alert triage cost little to prepare.

Microsoft has promised its post-incident report once mitigation completes, and that document should settle what actually failed. Until it lands, the correlated network configuration change stays a lead rather than an answer. Teams reviewing their own exposure after the Microsoft 365 outage have plenty to work with already, because the shape of this failure is clear without the mechanism behind it.