Updated 6:20 a.m. ET Friday: Microsoft reported more progress as the business day got underway on the East Coast. In a post on X at 6:11 a.m. ET, the company said recovery actions are now “completed across portions of affected infrastructure” and traffic is “being gradually restored.” It said it is “seeing improvements in key scenarios, including mailbox access and delayed email processing,” though “some intermittent issues may continue.” Engineers are extending those recovery steps to the rest of the affected infrastructure and adding capacity to improve consistency. An earlier post at 5:28 a.m. ET said recovery was “progressing in phases” while queue and backlog processing continued. The ripple effects reach other vendors: Anthropic’s status page says failures in Claude’s Microsoft 365 connector are “caused by a Microsoft 365 service incident,” with Claude for Outlook also affected. Microsoft’s service health notes still list the incident as degraded, about 19 hours after it began.
Updated 5:20 a.m. ET Friday: Microsoft said early Friday that recovery is gaining ground but is not complete. In notes posted at 4:03 a.m. ET, it reported “early signs of stabilization,” while cautioning that “service capacity has not yet returned to normal levels and health remains variable as traffic is carefully reintroduced.” Engineers are cycling affected infrastructure “through traffic drain, restart, remediation, and staged return-to-service,” the company said. To keep delayed messages from being dropped, Microsoft has extended the email timeout window to 48 hours, a step it repeated in a post on X at 4:24 a.m. ET. Its 4:57 a.m. ET update said global telemetry and customer reports “show incremental improvement in several workloads,” though capacity has not fully returned to baseline. The service remains formally degraded, about 18 hours after the incident began. Microsoft said it has no evidence of malicious activity and will publish a full post-incident report with the root cause after mitigation. Its next update is due by 6 a.m. ET.
Updated 3:25 a.m. ET Friday: Microsoft reported its first sustained sign of progress overnight. In notes posted at 2:25 a.m. ET, the company said it was “seeing positive results for server stability after applying an upstream authentication/routing configuration component patch to a portion of our infrastructure.” By 3:06 a.m. ET it said it was “continuing to see increased server capacity stability” and had begun rolling the patch out systematically, starting with “infrastructure supporting regions currently within or entering peak business hours.” In a post on X at 2:44 a.m. ET, Microsoft said it was applying its latest traffic optimization actions “more broadly across affected regions as we seek to attain persistent recovery.” The service remains formally degraded, about 16 hours after the incident began, and Microsoft again said it is not aware of malicious activity. Its next update is due by 4 a.m. ET.
Updated 2:20 a.m. ET Friday: Microsoft said its latest round of repairs has produced only “marginal success.” In notes posted at 1:56 a.m. ET, the company said it is reviewing server performance and “confirming that developed patches have been applied and working as intended after infrastructure reboots are completed,” while it expands capacity by bringing more virtual machines online. An earlier note, at 1:16 a.m. ET, said engineers were weighing traffic controls such as throttling, protocol adjustments and failover routing to steady service in active regions, and were testing in a contained environment to better track the problem. Microsoft again said it is not aware of malicious activity. The incident has now been open for about 15 hours, and the company has given no estimate for full recovery. Its next update is due by 2:30 a.m. ET.
Updated 1:20 a.m. ET Friday: Microsoft said it is still hunting for what is driving the flood of traffic to its backend servers and is now repairing affected machines more deliberately. In notes posted at 12:43 a.m. ET, the company said it is pursuing “multiple workstreams to pinpoint the underlying cause of the traffic influx and advance the recoverability of the backend servers,” and is “taking a measured approach to identify and repair affected infrastructure” so it can confirm its changes actually took hold. It repeated that it is “not aware of any malicious activity” behind the incident and said it will publish a post-incident report with full root-cause details once the problem is mitigated. In a 1:12 a.m. post on X, Microsoft said it is working on “recovering our frontend servers while implementing further traffic optimization actions to improve service stability and increase capacity.” The incident has now been open for about 14 hours, with no estimate for full recovery. Microsoft’s next update is due by 2 a.m. ET.
Updated 12:25 a.m. ET Friday: Microsoft said its fixes are producing only partial, short-lived gains and that a new obstacle has emerged. In notes posted at 11:10 p.m. ET, the company said it was adjusting traffic protocols, redistributing traffic and “applying strategic traffic blocking measures,” and was seeing partial recovery in regions where it made those changes, but “these actions aren’t resulting in sustained recovery.” Its 11:56 p.m. and 11:59 p.m. notes added that the mitigation work has triggered “a surge in outbound call volume from our routing services to our backend servers.” Engineers are scaling up virtual machines to add capacity and trying to force machines “in a bad state” to sync the recent network change, but some are stuck, “preventing our changes from syncing as expected,” Microsoft said. In a 12:01 a.m. post on X, it said it is working to “address our current blocker.” The incident has been open for more than 13 hours, and Microsoft has not said when full service will return. Its next updates are due by 1 a.m. and 1:30 a.m. ET.
Updated 11:20 p.m. ET: Microsoft said for the first time that it sees no sign of an attack. “For now we can confirm that there is no indication this is the result of malicious activity,” the company said in its 10:34 p.m. and 10:36 p.m. ET incident notes. Engineers are reviewing traffic flows and the affected infrastructure “to identify opportunities to optimize routing,” and are verifying why services failed so they can “develop specific actions to improve stability,” Microsoft said, repeating the routing message in a 10:48 p.m. post on X. The incident has now been open for more than 12 hours, and Microsoft still has not said when full service will return. Its next update is due by 11:30 p.m. ET.
Updated 10:15 p.m. ET: Microsoft reported another setback just before 10 p.m. ET. After monitoring the changes it had applied to improve service, the company said it “confirmed that change is not taking as expected,” according to its 9:54 p.m. and 9:58 p.m. incident notes. Engineers are now “identifying alternate workstreams that can be applied to increase capacity in the face of sustained traffic management imbalances,” Microsoft said, repeating that message in a 10:13 p.m. post on X. About an hour earlier, it had said it was adding infrastructure capacity where possible to support traffic in regions coming back online. The incident remains open more than 10 hours after Microsoft’s records say it began, and the company has not said when full service will return. Its next updates are due by 10:30 p.m. and 11 p.m. ET.
Updated 9:15 p.m. ET: Microsoft reported progress shortly before 9 p.m. ET. “We’re seeing positive results with our efforts to restart affected infrastructure,” the company said in its 8:45 p.m. incident notes, adding that it is monitoring those servers to verify they stay stable and will expand its remediation as stability is confirmed. In an 8:59 p.m. post on X, Microsoft said it is recovering server availability “in an isolated manner.” The incident remains open, and Microsoft has not said when full service will return. Its next updates are due by 9:30 p.m. and 10 p.m. ET.
Updated 8:15 p.m. ET: Microsoft said shortly after 8 p.m. ET that it has found what is knocking the servers offline: a process on the affected servers “responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests.” It is preparing a configuration change to address that behavior, testing it on a subset of servers before applying it more broadly along with restarts of the affected infrastructure. In parallel, Microsoft said it has “begun reverting a recent network configuration change that correlates with the start of impact” and is monitoring whether that helps recovery. Earlier in the afternoon, the company had said it had not identified any recent change correlated with the start of impact. The temporary traffic limits it described at 7 p.m. are now in effect in specific locations, and Microsoft will gradually reintroduce traffic if servers there stay stable. In an 8:01 p.m. post on X, Microsoft said it had revised its list of affected services, which now also includes Microsoft Graph requests for mail, calendar and contacts data, some Microsoft Fabric exports, Microsoft 365 Education features such as Assignments, some Microsoft 365 admin center pages and the recent-files view in Microsoft 365 apps. Its next updates are due by 9 p.m. and 9:30 p.m. ET.
Updated 7:15 p.m. ET: Microsoft reported a setback just before 7 p.m. ET. The servers it had returned to service “initially remain healthy,” but they “can become unresponsive again once they begin receiving traffic,” the company said in its incident notes and a 7:06 p.m. post on X. Engineers are analyzing diagnostic data from those servers with networking and platform experts to find what triggers the behavior. Microsoft is also temporarily limiting which types of traffic can reach the affected infrastructure in specific locations, to see whether a particular type of request is contributing to the problem and to restore service incrementally. In parallel, it is rebuilding a subset of the affected servers with a previous software configuration and will extend that approach if it works. Microsoft’s wider notice now also lists Windows 365 Cloud PCs for customers that use Microsoft Purview Customer Key. Its next update on the Exchange incident is due by 8 p.m. ET.
Updated 6:10 p.m. ET: Microsoft reported its first signs of progress just before 6 p.m. ET, saying it has begun returning a portion of the affected servers to service and “they’re remaining stable so far,” according to its incident notes and a 6:04 p.m. post on X. It has shifted traffic and connections to alternative pathways where possible and has seen “limited recovery in some regions.” Microsoft said it has streamlined the process for bringing the remaining servers back and is applying protective traffic-management measures in one location to reduce load, which it will extend to other locations if they work. Users may see a gradual recovery as their apps reconnect, the company said. It also added Universal Print, where users may hit errors submitting print jobs, to the list of affected services. Its next updates are due by 7 p.m. and 7:30 p.m. ET.
Updated 5:20 p.m. ET: Microsoft said shortly after 5 p.m. ET that “our actions taken thus far have not provided the anticipated relief” and that it is “continuing to pursue all available pathways to restore service,” according to its incident notes and a 5:09 p.m. post on X. It now says a core process on the affected servers is becoming overwhelmed, which makes the servers stop responding and contributes to the capacity loss. To test a possible fix, Microsoft is fully isolating a portion of its service infrastructure, restarting the affected components and gradually reintroducing traffic before applying the approach more broadly. It is also evaluating whether isolating traffic within each region would let affected regions recover independently. Microsoft added parts of the Microsoft 365 Apps admin center, including Cloud Update, Cloud Policy and Inventory, to the list of affected services. Its next updates are due by 6 p.m. and 6:30 p.m. ET.
Updated 4:58 p.m. ET: Microsoft still had not restored service as of its 4:31 p.m. ET incident notes, which it repeated on X at 4:40 p.m. Engineers are restarting and validating the affected servers to return them to service and looking for ways to speed that up. Microsoft also said it is assessing whether reverting “the small number of recent configuration updates we identified could help accelerate recovery.” It has now added Intune, Defender for Office 365 and Power BI exports of sensitivity-labeled reports to the list of affected services. Its next updates are due by 5 p.m. and 5:30 p.m. ET.
Microsoft had not fully restored Outlook and other Microsoft 365 services as of its 3:56 p.m. ET update Thursday, almost three hours after nearly 130,000 users told Downdetector they could not reach their email, AP reported.
Microsoft says a large number of its servers dropped out of service after failing automated health checks, which pushed load onto the rest of its infrastructure. It has not named a root cause or said when service will return. Its service-health notice, MO1550821, lists Exchange Online, Teams, SharePoint Online, Copilot, Defender XDR, Defender for Office 365, Intune, Planner, To Do and Purview as potentially impacted, along with Microsoft Graph requests for Exchange data, some Power BI and Microsoft Fabric exports, Microsoft 365 Education features, parts of the Microsoft 365 admin center and Microsoft 365 Apps admin center, Universal Print and Windows 365 Cloud PCs set up with Purview Customer Key. The list spans mail, chat, files, device management, its AI assistant and security and compliance tooling. Microsoft opened that second notice at 1:26 p.m. ET, about two hours after the Exchange incident began.
That post, on X at 12:54 p.m. ET, said Microsoft was investigating problems reaching Exchange Online mailboxes in the Americas. Thirteen minutes later it said the issue “may affect Microsoft 365 service connectivity for users in any region.” Microsoft’s incident record for administrators lists a start time of 11:17 a.m. ET (16:17 UTC), according to Cloud Admin Hub and the University of Pennsylvania’s PennO365 incident feed, which republish Microsoft’s service-health data. Its first notice to admins went out at 11:20 a.m.
Earlier in the day, a separate Teams incident in the Americas ended with Microsoft posting at 12:09 p.m. that “Customer impact is now fully resolved.” The mail outage is a separate incident, and Microsoft tracks the Teams, SharePoint, Copilot and Defender XDR problems under a second notice, MO1550821. Consumers were affected as well, TechCrunch reported, with OneDrive and Office for the web among the services people could not reach. Microsoft’s public status page, which was slow to load for The Verge and Engadget, showed no Azure issues when WebProNews checked it at about 4:05 p.m. ET, and Microsoft’s notices for this outage do not list Azure. Windows Central, citing Downdetector, reported that Outlook, Teams, Copilot, OneDrive and Azure “all appear to be affected.”
Microsoft’s explanation has changed through the afternoon. At 1:35 p.m. it cited “elevated load” in a portion of its infrastructure across multiple regions. At 2:31 p.m. it said the load “isn’t driven by an increase in traffic, but by a number of servers being unexpectedly unavailable.” At 2:43 p.m., its incident notes said the failing health checks “may be related to a recent change to a component involved in processing those checks.” By 2:57 p.m. the notes said Microsoft had not identified recent changes that correlate with the start of impact. At 3:56 p.m., they said a review of recent changes had found “a small number of configuration updates that we’re investigating as potential contributors to the issue.”
The company has paused all deployments and configuration changes, moved traffic off the affected infrastructure and restarted servers. At 2:43 p.m. it began testing a configuration change on a subset of affected infrastructure. It deployed “a targeted change to bypass this component on a subset of servers” to see whether availability returns, and looked into why affected servers showed “elevated processor usage while handling requests.” At 3:38 p.m., Microsoft said that while it validated the change, “many of the affected servers have become unresponsive,” which kept it from confirming whether the change works, and it restarted those servers. At 3:56 p.m., it said it had validated an alternative health check method on a subset of affected infrastructure, which let those servers return to service, and was applying it more broadly. It is also preparing an automated recovery process to detect and restart unresponsive servers.
Downdetector reports for Outlook fell through the afternoon but stayed high. Tom’s Guide counted about 77,000 at 2:51 p.m. ET and about 61,000 at 3:41 p.m., and NBC News had put the count above 120,000 around 1:30 p.m.
TechCrunch noted that Microsoft’s last major incident came in September, when a days-long Microsoft 365 outage was blamed on a “core authentication configuration” issue.
As of 6:11 a.m. ET Friday, Microsoft said traffic was being gradually restored and that mailbox access and delayed email processing were improving, though intermittent issues may continue and the service remained formally degraded. It has extended the email timeout window to 48 hours to preserve delayed mail. Earlier it reported a flood of traffic to its backend servers, machines stuck in a bad state, an overwhelmed secure-connection process and the reversal of a recent network change that correlates with the start of impact, followed by a routing patch that improved server stability. It says it has no evidence of malicious activity, has not said when full service will return and has not formally named a root cause, which it says will come in a post-incident report.
Status as of 6:20 a.m. ET Friday. Microsoft’s latest service health notes were at 4:55 a.m. and 4:57 a.m. ET, with posts on X at 5:28 a.m. and 6:11 a.m. ET.