When the Cloud Goes Down: the Microsoft 365 Outage and What to Take From It

On 12 November at 18:17 Kyiv time, an outage began in Microsoft 365 that is still ongoing as this article goes out. Mailboxes, calendars, Teams and SharePoint stopped opening. Companies around the world were affected — Ukrainian ones included, because most corporate mail here runs on Microsoft 365.

We felt it on our own mailbox and checked exactly what had broken. Below are the facts we verified ourselves, Microsoft's official position and, most importantly, what a business owner should take away from it — whether or not they use Microsoft.

What exactly is down

The first reaction to «mail won't open» is always the same: it must be us, the password, the internet, the domain settings. So we started by checking our own side, and it gave a clear picture.

• Signing in works. Microsoft recognises the account and grants access — so the password, the permissions and the access settings have nothing to do with it.
• Requesting mail returns a server error — code 502. Not «access denied», not «wrong password», but «the server could not answer».
• The calendar fails the same way — code 503. So this is not about mail alone, but about everything that lives in Exchange Online.
• The domain's mail records (MX) are unchanged and still point to Microsoft. Mail is being sent exactly where it should be.

The conclusion is simple: our side is intact, the service itself is not answering. Anyone in doubt should run the same check — it takes a few minutes and settles half the questions.

The official timeline

Microsoft tracks the outage under two numbers: EX1550543 for mailbox access in Exchange Online, and MO1550821 for everything that depends on Exchange. A separate Teams incident (TM1550488) is already closed. At first the wording pointed to the Americas; later it changed to «may affect users in any region».

Times below are Kyiv time.

• 18:17, 12 November. Users cannot open their mailboxes. Microsoft reports it is investigating a problem with mailbox access.
• 20:19. Elevated load is recorded across several regions at once.
• 21:18. Clarification: the load grew not because of an increase in traffic. Some servers suddenly became unavailable and the remaining ones took over their work.
• 21:43. The affected servers are failing automated health checks — and the system is taking them out of service by itself.
• 21:57. «We've not identified any recent change correlated with the start of impact.»
• 00:00, 13 November. «A core process on affected servers is becoming overwhelmed, causing capacity loss.»
• Overnight. A further detail: what is overwhelmed is the process responsible for establishing secure connections. In parallel, Microsoft begins reverting a recent network configuration change that correlates in time with the start of the outage.
• 06:11. «We can confirm that there is no indication this is the result of malicious activity.»
• 13:04. Recovery is complete in the Asia Pacific region, traffic is being restored gradually, and the work is being extended to other regions.

The cause: still unnamed

The most honest thing to say at the time of publication is that there is no official cause. Microsoft's explanations shifted over the course of the day — from «we see no recent change» to «we are reverting a recent network configuration change that correlates with the start of impact». The company promises a full post-incident report with a root cause once recovery is complete.

One thing Microsoft states without hedging: this is not a cyberattack. That wording was used twice, several hours apart.

The most instructive part of this story is not the cause but why the repair dragged on. Servers brought back into service failed again as soon as traffic reached them. Microsoft said outright that the changes were «not taking as expected». What followed was a loop of work: all deployments and configuration changes paused, restarts, an alternative health-check method, part of the fleet rebuilt on a previous software configuration, extra capacity added with virtual machines. Things only moved after a patch to the component responsible for authentication and request routing.

What is happening to email

This is the question that worries people most, so it gets its own section.

• Delivery is delayed — Microsoft states this directly in the incident description.
• The email timeout window has been extended to 48 hours. Normally a server that cannot deliver a message within a set time returns it to the sender as a failure. The extended window means messages will not bounce back; they will wait in the queue instead.
• Microsoft has not reported data loss. To be precise, though, it has not explicitly said «nothing was lost» either. What it literally said is that delayed messages are being preserved.

The practical consequence: do not resend your emails. They are in the queue, and when the service recovers the recipient will get duplicates. Expect a flood instead — a whole day's worth will arrive at once.

What a business should do right now

1. Make sure the problem is not on your side. If signing in works but mail will not open, the fault is with the provider. The status is visible in the Microsoft 365 admin center under Service health, incidents EX1550543 and MO1550821.
2. Do not touch your settings. During someone else's outage, the most damage comes from trying to «fix» things at home: changed domain records, reinstalled mail clients, reset passwords. When the service comes back, you will be left untangling your own consequences.
3. Switch on a backup channel. Move urgent client matters to a messenger or the phone for the duration. Tell the people waiting on you — a short «our mail is down, please write on Telegram» beats silence.
4. Record the downtime. If the stoppage cost you money, write down the times and the consequences. Microsoft has service-level commitments; whether this particular outage gives you grounds for a credit is a question for your licensing agreement and the partner you bought the licences through.

Four takeaways

An outage on this scale is rare, and concluding «the cloud is bad» would be wrong: your own server in a back room fails more often and takes longer to recover. The takeaways are different.

1. A backup channel has to exist before the outage, not be invented during it. If all client communication runs through one provider's mail, their failure stops you completely. A Telegram bot, a corporate messenger, a phone line — anything your clients already know about.
2. Don't put everything in one basket. Mail, documents, chat, authentication and security from a single supplier is convenient right up to the day something breaks there. Then everything stops at once. That is exactly what happened: Teams, SharePoint and Defender went down along with mail.
3. Whatever earns the money should be under your control. Your website, orders, catalogue and enquiries belong where you can check the state yourself, bring up a copy and answer a client without waiting for someone else's status report.
4. Learn to tell «ours» from «theirs». The simple check at the start of this article saves hours of panic and prevents needless changes to your settings.

How we have it arranged

We use Microsoft 365 for mail and documents — and during this outage our mailbox would not open either. What we build for clients, however, kept working: websites on our own Smart CMS, chatbots, client portals and telephony all live on our own servers, separately from mail. Not a single client website was affected by this outage.

That is precisely the split described in the takeaways: office tools from a reliable external supplier, and whatever sells and takes orders where we are answerable for it ourselves.

About the sources

We ran the access checks, the mail-record lookups and the response codes ourselves. The timeline and Microsoft's quotes come from its posts in the admin center and on the service health page, relayed by industry trackers and cross-checked against each other, because both of those sources are available only to a given customer's administrators. For every owner, the primary source is their own admin center.

---

If you are not sure how dependent your business is on a single supplier, or what would happen to your website on a day like this, write to us. We will look at it together and say plainly what belongs in separate baskets. And the state of the website itself can be checked free of charge in three minutes at audit.sgt.com.ua.