Microsoft says its global outage wasn't an attack as Outlook and Teams come back

Microsoft said Friday that its email and collaboration services were largely back after an outage that began Thursday morning, and that it had found no sign of malicious activity behind the failure. What the company still can't explain is why so many of its servers went dark at once.

In a Friday update on its status page, Microsoft said it was “continuing to see improvements in service availability, with email queues significantly reduced and approaching normal levels.” It also warned that the cleanup wasn't finished: “Some users may still experience intermittent access issues or delayed email delivery as recovery continues.”

The outage lasted a long time. Doug Madory, director of internet analysis at Kentik, a company that tracks internet traffic around the world, said in a Bluesky post that traffic was returning to Microsoft's services after about 18 hours of downtime. By Friday morning on the U.S. East Coast, Outlook messages that had been stuck in the backlog were starting to arrive.

Microsoft also said it had put additional mitigation measures in place. Engineers were bringing the last affected infrastructure back online and looking into lingering problems, and the company said it was watching service health and checking that recovery held across the different ways customers connect.

How an email problem became a cloud-wide failure

The trouble first surfaced as an Outlook and Teams outage in Microsoft 365, the subscription bundle that businesses rely on for email, meetings and documents. It was initially flagged in the U.S. and the rest of the Americas, then spread to other regions as engineers struggled to revive downed servers.

From there it widened to Microsoft's cloud services for consumer and business email, files and documents. Copilot, the company's AI assistant, went down, along with Defender, its security screening software. System administrators were locked out of their Intune dashboards, the tools organizations use to manage employee devices. Some users reportedly couldn't reach their cloud-based Windows computers. Banks, schools and a range of corporate customers saw their day-to-day operations badly disrupted.

That list says more than the 18-hour figure does. When Defender and Intune fail at the same moment as email and Teams, the IT staff responsible for keeping an organization running lose the instruments they would normally use to triage the damage and reassure employees. Microsoft sells 365 partly on how tightly its pieces fit together. This week showed the downside of that design: when the pieces fail together, customers have no fallback inside the same ecosystem.

Microsoft has offered only one description of what went wrong. It said the outage involved “a large number of servers being unexpectedly unavailable,” and that the investigation into the cause was continuing.

On Friday it added that there was “no evidence of malicious activity associated with this incident.” Ruling out an attack early is useful for customers deciding whether to treat the episode as a security event. It is also a conclusion they have to accept on trust for now. TechCrunch reported that a Microsoft spokesperson did not respond to its questions about whether the company has the technical means, such as logs, to detect malicious activity, or a way to reconstruct what happened.

What Microsoft has promised to explain

Microsoft said it will keep treating the incident with urgency until it is fully mitigated, and that it will “share a full post-incident report with root cause and defense-in-depth actions after mitigation is complete.” The company hasn't given a date for that report.

That document will matter more than any status-page update. The key question is why a problem first seen in one part of the world couldn't be contained there, and why it took engineers so long to find what was causing servers in Microsoft's data centers to fail. A credible report would answer both. A vague one that points to a single faulty change without explaining how it spread would leave customers with the same exposure they had on Thursday.

This also isn't an isolated event. In September, a days-long outage hit Microsoft's cloud services, and the company blamed a “core authentication configuration” issue that kept users from signing in. Two major failures in roughly two months, each traced, as far as anyone knows, to Microsoft's own systems, will make it harder for the company to describe these episodes as rare.

The broader risk has been visible for years. In July 2024, a faulty security update from CrowdStrike crashed millions of Windows machines and grounded flights. That was a third-party mistake. This week's outage appears to have started inside Microsoft's own infrastructure and reached deep into its own services, including the security and management tools customers would normally use to respond.

For now, the practical effect for most people is smaller: some email may still arrive late, and access may drop in and out while Microsoft finishes the recovery. The longer-term issue for IT departments is how much of an organization's communications, security and device management should depend on a single provider whose servers can all go down at once. Microsoft's root-cause report is the next confirmed step. It will be the first real evidence of whether the company understands that problem as well as its customers now do.