// Plain English

Microsoft 365 Is Down for Tens of Thousands, and This Week's Security Patch Is Breaking Windows Too

Outlook is down: 130,000 outage reports at 1:27 PM ET

Outlook and Microsoft 365 went down for tens of thousands of users on Thursday afternoon, November 12. At 1:27 PM ET, more than 130,000 people had reported Outlook problems to outage tracker Downdetector, with another 46,000 reporting Microsoft 365 issues. Microsoft confirmed it is investigating problems with Exchange Online mailboxes across the Americas, tracked as incident EX1550543. The root cause is not yet public.

This is the scale of the problem. Reports began surging just after noon ET. Microsoft's own service health notice puts the incident start at 11:17 AM EST and says users may be unable to connect to their Exchange Online mailboxes through multiple methods, including Outlook on the web. Microsoft later said the issue may affect Microsoft 365 service connectivity for users in any region. Teams and Copilot also spiked in user reports, with about 3,000 Teams reports and 4,400 Copilot reports around the same time, and the Microsoft Store showed a spike as well. Earlier in the day Microsoft fixed a separate Teams disruption in North America, resolved around noon. Microsoft's next scheduled update on the outage was expected at 3:00 PM ET.

The same week, Microsoft's November security update is breaking Windows on the devices that did install it. Update KB5132061, released on Patch Tuesday, November 10, will not install on Windows 11 machines that had the October preview update installed, failing with errors 0x80070306, 0x800f0989, or 0x800f0993. Microsoft confirmed the failures and is pushing an automatic server-side repair that started November 11 at 10 AM PT, with all affected devices expected to be repaired within 24 to 48 hours. No action is needed on the device.

That is not the only damage from the patch. Microsoft confirmed that Windows updates since the October Patch Tuesday are causing SQL Server performance and stability problems, hitting linked server queries that use OLE DB providers to reach external databases, including Oracle and PostgreSQL. An out of band fix is coming in the next few days, and Microsoft Support for Business has a mitigation in the meantime. The November update also broke printing for documents containing images with a zero height or width, seen in Word and possibly other apps, and broke some Windows activation and licensing operations run through SLMGR, failing with error 0x80041008. A fix for the activation issue is due in the coming days.

Here is what is not yet known, and it matters. Microsoft has not disclosed a root cause for the outage, and has not linked it to the security patch. The outage is a cloud connectivity problem in Exchange Online infrastructure. The patch problems are on Windows devices. They share a week, not a confirmed cause. Treat them as two failures running at the same time until Microsoft says otherwise.

What to do now. If your mail is down, do not reinstall Outlook or rebuild your profile. Check your tenant's status in the Microsoft 365 admin center under EX1550543, and use Teams or the phone where they still work. Expect mail delays even after access returns. If you run IT, hold the November update rollout until the automatic repair lands, check whether your machines have the October preview update KB5127936 installed, and watch for the out of band SQL Server fix. Do not mass reimage machines that failed to install the update. The repair is server side and needs no action from you.

Why this week matters. Email is the front door of most companies. A morning without it means stalled approvals, missed client mail, and a help desk flooded with the same question. And a patch that cannot install leaves machines unprotected against what it was meant to fix. Tuesday's update covered 1,235 flaws, 66 of them critical, including an exploited Outlook zero day. Every day the patch sits uninstalled on affected machines is another day those flaws stay open.

This is a developing story. The numbers above are as of early Thursday afternoon, and Microsoft's next update was expected at 3:00 PM ET.

Update, 3:05 PM ET: Microsoft says the elevated load is not from extra traffic. A number of servers unexpectedly became unavailable, straining the infrastructure that remains. The company is redistributing connection traffic worldwide, has paused deployments and configuration changes while it reviews recent changes for any correlation to the outage, and is restarting affected servers. No root cause and no restoration time have been given. Outage reports are falling from the early afternoon peak but remain high.

Update, 4:47 PM ET: Microsoft has not declared the incident resolved. In its 4 PM update, the company said an alternative health-check method let a subset of affected servers return to service, and it is applying that change more broadly while preparing automated recovery to restart unresponsive servers. Microsoft traced the failures to servers failing automated health checks and said a small number of configuration updates are being investigated as potential contributors, not a confirmed cause. Outage reports have fallen sharply, with about 54,000 Outlook reports at 4:20 PM ET, down from the 129,000 peak. The next update is due by 5:30 PM ET.

Update, 3:37 AM ET: Microsoft says it has found what is knocking the servers offline: a process on the affected servers that establishes secure connections becomes overwhelmed, causing the servers to stop processing requests. The company is testing a configuration change on a subset of servers and has begun reverting a recent network configuration change that correlates with the start of impact, after saying earlier in the day that no recent change correlated. Overnight, the fixes did not hold. As of 1:15 AM ET, Microsoft says the recovery actions are not taking as expected, with no time for full recovery, and the incident is still open more than 12 hours in. Microsoft executive Charles Lamanna confirmed the outage was not caused by a cybersecurity breach. Traffic limits remain in effect in specific locations, and the affected list now includes Microsoft Graph requests for mail, calendar and contacts, some Microsoft Fabric exports, and Microsoft 365 Education features.

Sources

Kevin Swaney, Principal Cybersecurity Engineer

Kevin Swaney

Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com

← kevintswaney.com