Microsoft 365 experienced a widespread outage on Thursday, disrupting access to business email and other cloud services in several regions. Initially, Microsoft reported that users in the Americas were having difficulty connecting to Exchange Online mailboxes. The company later indicated possible disruptions to Teams, SharePoint Online, Microsoft 365 Copilot, and Defender XDR.
Some Google Workspace (formerly G Suite) users also reported problems accessing their Google-hosted email from Outlook clients, both on desktop and mobile.
Microsoft attributes the increased load on its infrastructure to a high number of servers becoming unavailable, with the remaining systems having to absorb the traffic. The company states that overall traffic had not increased.
In an update posted shortly before 3 p.m. Eastern Time (ET), Microsoft specified that the affected servers were failing automated health checks. The company was testing a workaround that bypasses the component responsible for processing these checks, while investigating high CPU usage on the servers in question.
Is the outage the result of a cyberattack?
At the time of publication, Microsoft is continuing its investigation to determine what triggered the failures and has provided no information indicating a cyberattack. The company has not yet explained why the health checks failed or why CPU consumption increased. Its service bulletins do not report any malicious activity.
The outage occurred two days after the release of November’s Patch Tuesday security updates, which fixed 1,094 vulnerabilities in the company’s products. Among them is CVE-2026-124194, a spoofing vulnerability in Outlook, which Microsoft says has been exploited by attackers. According to the company, this flaw can expose a user’s authentication elements when they open a specially crafted file in an affected Outlook client. However, Microsoft’s service bulletins do not link this vulnerability to the Exchange Online outage.
Microsoft is tracking the Exchange Online disruption under reference EX1550543, and the broader Microsoft 365 incident under reference MO1550821, in the Microsoft 365 admin center. Shortly before 3 p.m. ET, both incidents were classified as service degradations.
