Microsoft 365 Outage: How to Keep File Access Running

By Ron Bhojwani

Last Updated: November 13, 2026

On November 12, 2026, an Exchange Online failure spread across Microsoft 365, disrupting Outlook, Teams, SharePoint Online and Copilot worldwide into November 13. Microsoft logged the Exchange incident as EX1550543 at 11:17 AM ET and opened a wider incident, MO1550821, about two hours later. Both were still open at 11:23 AM ET on November 13, and Microsoft says it has found no evidence of malicious activity.

This post covers what failed, why services beyond email failed with it, how it compares with this year's other incidents, and how to keep file access running next time. Microsoft has said it will publish a Post-Incident Report with the root cause once mitigation is complete. We'll update this page when it does.

THE SHORT VERSION

On Thursday, November 12, a Microsoft 365 incident that began in Exchange Online spread to Outlook, Teams, SharePoint, Copilot and Defender XDR, with Downdetector reports from 74 countries. Microsoft traced the strain to servers becoming unexpectedly unavailable, which pushed load onto the remaining infrastructure. Some restored servers went down again overnight, and recovery was still underway Friday morning.

No cloud platform is immune to incidents like this. The lesson for IT and security leaders is architectural: when email, collaboration and documents all run on one provider's shared infrastructure, a fault in one component can reach all of them at once.

Files kept on an organization's own Windows file servers and NAS do not share that dependency. MyWorkDrive provides secure remote file access to those servers through a gateway the organization hosts and controls, using existing NTFS permissions and with no data migration. When a cloud suite has a bad day, IT still controls the file servers, the gateway and the access path.

What happened during the November 12 Microsoft 365 outage

The outage started at 11:17 AM ET on November 12 in Exchange Online. A process on Exchange servers that establishes secure connections became overwhelmed, servers stopped responding, and features in other Microsoft 365 services that depend on Exchange failed with them. By Friday morning email queues were close to normal, but Microsoft had not closed the incident.

Early on, Microsoft's @MSFT365Status account said the elevated load wasn't caused by more traffic, "but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure." The company paused all deployments, moved traffic off the affected infrastructure and restarted servers. A Teams incident earlier that morning was logged separately, and Microsoft hasn't said whether the two are related.

Timeline of the Microsoft 365 outage on November 12 and 13, 2026, in Eastern Time: Teams incident TM1550488 from 9:45 to 10:53 AM, Exchange Online incident EX1550543 from 11:17 AM, MO1550821 opened at 1:26 PM, partial recovery in the afternoon, a relapse at 6:59 PM when returned servers became unresponsive again, a patch to an authentication and routing component at 2:25 AM, the email timeout window extended to 48 hours at 4:55 AM, email queues near normal at 9:01 AM, and the incident still open at 10:52 AM on November 13.

November 12 to 13, 2026: Microsoft 365 incident timeline (Eastern Time)
WhenIncidentWhat Microsoft reported
Nov 12, 9:45 to 10:53 AMTM1550488 (Microsoft Teams)Some users in or routed through North and South America may have been unable to access or use Teams functionality. Resolved the same morning.
Nov 12, 11:17 AMEX1550543 (Exchange Online)Users may be unable to connect to mailboxes through Outlook on the web, MAPI, Exchange ActiveSync or REST. On-premises mail flow to or from Exchange Online may be affected.
Nov 12, 1:26 PMMO1550821 (Microsoft 365 suite)Users may be unable to connect to multiple services. First list: Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365 and Microsoft Defender XDR. Cause at that point: elevated load across multiple regions.
Nov 12, 6:59 PM to Nov 13, 2:25 AMOvernight relapseServers returned to service became unresponsive again once they received traffic. At 8:06 PM Microsoft began reverting a network configuration change that correlated with the start of impact, and at 9:54 PM said its fix was not taking as expected. A patch to an authentication/routing configuration component brought the first lasting stability at 2:25 AM.
Friday, Nov 13EX1550543 and MO1550821Email timeout window extended to 48 hours at 4:55 AM. Queues "approaching normal levels" at 9:01 AM. Both incidents still open at 11:23 AM, with Microsoft "focused on addressing residual impact."

Affected services, as Microsoft names them

By its 10:52 AM ET update on November 13, MO1550821 listed 21 services: Exchange Online, Microsoft 365 admin center, Microsoft 365 apps, Microsoft 365 Apps Admin Center, Microsoft 365 Education, Microsoft Copilot 365, Microsoft Defender for Office 365, Microsoft Defender XDR, Microsoft Fabric, Microsoft Graph, Microsoft Intune, Microsoft Planner, Microsoft Power Apps, Microsoft Purview, Microsoft Teams, Microsoft To Do, Power BI, SharePoint Online, Universal Print, Viva Engage and Windows 365.

Azure was not on Microsoft's list. Some users reported Azure problems on Downdetector, but Microsoft's incident posts don't mention Azure. OneDrive isn't named either.

How an Exchange Online failure reached SharePoint, Teams and Copilot

Microsoft 365 services share dependencies inside each tenant. Teams scheduling, SharePoint external sharing, Copilot's access to work data and Purview labeling all call Exchange Online or Microsoft Graph APIs that read Exchange data. When Exchange stopped answering, those features failed together, while the parts of each service that don't touch Exchange kept running. Microsoft put it plainly in MO1550821: "Elements of those services that do not depend on interaction with Exchange Online remain functional."

Teams is a good example. Microsoft said calls, meetings, group chats and channel messages mostly worked. Calendar scheduling, meeting invites, Live and Virtual events, and the creation of private or shared channels did not.

“Accessing files stored directly in SharePoint Online remains functional.”

Source: Microsoft 365 Service Health, incident MO1550821, November 13, 2026 (public copy via PennO365)

Outside reports agree that SharePoint files could still be opened. Treat that as provisional: it comes from status updates written mid-incident, not from Microsoft's review. What Microsoft did confirm is that some users had trouble sharing SharePoint files with people outside their organization, that Microsoft 365 apps may not show recently used files, and that Copilot couldn't reliably reach files.

The side effects went well beyond mail:

  • Copilot and connectors. Copilot Chat might not load or answer, and Copilot experiences "may be unable to access work data such as email, calendar, and files." Graph API requests touching Exchange data could time out. A separate Power Platform advisory, PP1550869, covered flows, apps and connectors that rely on Graph data; Microsoft marked it restored at 10:50 AM ET on November 13.
  • Defender Safe Links. Earlier MO1550821 updates listed failures for Safe Links, Safe Attachments, Quarantine and Threat Explorer in Defender for Office 365. Later updates narrowed this to policy evaluation that relies on Purview signals.
  • Intune. Device enrollment, device check-in and device compliance policies "may have been intermittently impacted." If your Conditional Access policies require a compliant device, check sign-in logs for that window.
  • Purview. DLP, auto-labeling, sensitivity labels, audit searches and eDiscovery were affected, and users might not be able to open protected content. Windows 365 Cloud PCs using Purview Customer Key might not connect.

Microsoft 365 outages in 2026

We count seven notable Microsoft 365 incidents in 2026 through November 13. Exchange Online was the root service in four of them, all since October 12, and Exchange or Outlook was affected in six. The North American outages in January and July each ran 10 to 11 hours. The November 12 incident has already run longer than both.

Notable Microsoft 365 incidents in 2026 (through November 13)
DateIncident IDRoot serviceServices affectedDurationRegion
January 22 to 23MO1221364Service infrastructure in North America "not processing traffic as expected," per MicrosoftExchange Online and Outlook, Teams, Microsoft 365 admin center, Defender, PurviewAbout 10 hoursNorth America
July 23MO1437424Networking; Microsoft reverted a networking updateSharePoint Online, OneDrive, Teams, Microsoft 365 admin center, Copilot Chat, Power Automate, LoopAbout 11 hoursNorth America
October 12EX1500900Exchange Online: an update to Exchange admin center authentication componentsExchange admin center (admins only)4 hours 35 minutesNot stated
October 13MO1505952Global Secure Access infrastructureOutlook, Outlook on the web, OneDrive, SharePoint Online, Teams, Windows 365, for users connecting through Global Secure Access10 hours 51 minutesGermany and the UK
November 6EX1542182Exchange Online mailbox infrastructureMailbox access through any connection method2 hours 52 minutesNorth America
November 9Not published in public sourcesExchange Online: connection terminationsMailbox access through Outlook on the webAbout 4.5 hoursEurope, Middle East and Africa
November 12 to 13EX1550543, MO1550821Exchange Online21 services on Microsoft's listMore than 24 hours; still openWorldwide

The table leaves out Microsoft's many smaller weekly advisories. Incident IDs, times and root causes come from Microsoft's Service Health posts where they're public. The January and July durations come from coverage by The Register and BleepingComputer, and the November 9 duration from public status trackers.

Which file access paths were affected

Of the ways people reach files, browser and Teams-based access to SharePoint took the most visible hits, though Microsoft says opening files there kept working. Files on on-premises servers were not affected by this incident unless the sign-in for that path ran through a Microsoft 365 service that failed.

File access paths during the November 12 outage
Access pathWhat it depends onObserved impact
SharePoint and OneDrive in the browserSharePoint Online or OneDrive, Entra ID sign-in, and Exchange Online for sharing and some featuresSharePoint: opening files reported working by Microsoft; external sharing issues and missing recent files lists confirmed. OneDrive: not reported
OneDrive sync clientOneDrive sync service, with a local cache on the deviceNot reported. Files already downloaded to the device stay usable offline either way
Teams Files tabTeams client and SharePoint OnlineNot reported for opening files. Teams calendar, channel creation and Copilot in Teams affected
SharePoint over WebDAVSharePoint Online, the Windows WebClient service and a browser sign-in cookieNot reported
On-premises SMB over VPNVPN gateway, your domain controllers, your MFA providerNot reported. Affected only if VPN sign-in relied on a service on Microsoft's list
On-premises SMB through MyWorkDriveMyWorkDrive server, your file server, Active Directory or your identity providerNot reported. Office for the web editing relies on OneDrive or SharePoint staging

If your mapped SharePoint drives were acting up, our comparison of OneDrive sync and WebDAV mapped drives explains where each one breaks.

What IT teams should do during a Microsoft 365 outage

Check Service Health and note the incident IDs, move staff communication to a channel outside Microsoft 365, and point people to whatever file access still works.

  1. Confirm the incident. Open Health > Service health in the Microsoft 365 admin center and search for the incident ID. Some admin center pages failed on November 12, so keep @MSFT365Status bookmarked as a fallback.
  2. Record the impact. Note the incident IDs, when your users were affected, and how many. You'll need these for internal reporting and for any SLA credit claim, which Microsoft doesn't apply automatically.
  3. Switch channels. Send updates by SMS, a phone tree or an external status page. When Outlook and Teams calendars are both down, an email about the outage won't reach anyone.
  4. Tell people where their files are. Point staff to the paths that still work: synced files, on-premises shares, desktop Office with local saves.
  5. Leave things alone. Pause tenant changes. Tell users not to sign out, clear app data or reinstall, which is the advice Microsoft gave Power Apps mobile users during this incident.
  6. Expect late mail, not lost mail. Microsoft extended its email timeout to 48 hours, so delayed messages should still arrive.

A file access self-audit

Answer these while November 12 is still fresh:

  • Where do each team's working files live? SharePoint, OneDrive, on-premises shares, Azure Files, or a mix. Write it down per team, not per company.
  • Which identity provider signs users in for each access path? A file server is only as available as the sign-in in front of it.
  • Which editing path does each group rely on? Office for the web, desktop Office, or a self-hosted editor.
  • What's the backup channel when email and Teams are both down? Name it, test it, and make sure staff know it exists.
  • Which files did people need on November 12 and couldn't reach? Ask department heads this week, while they still remember.

Keeping file access separate from Microsoft 365

Give staff a path to their files that doesn't depend on Exchange or SharePoint being available. For files that already live on your own servers, that path can sit entirely outside the Microsoft 365 tenant.

There are three common ways to do it:

  • VPN. It works independently of Microsoft 365, but it puts every remote device on the network and needs a client installed on each one.
  • Sync clients with a local cache. Files already on the device stay available. Anything not yet synced, or stored online-only, is out of reach, and changes wait in a queue.
  • An HTTPS gateway in front of on-premises file servers. Users reach shares from a browser or mapped drive without a VPN, and sign-in goes through your own directory.

MyWorkDrive is the third kind. It publishes your existing SMB shares from a Windows server you run, with browser, mapped drive and mobile access and NTFS permissions enforced as they are today. There's no migration and no second copy of the data. The same server can also connect SharePoint and Azure Files next to your SMB shares, which matters for the honest limits below.

Diagram comparing two paths. Left, inside the Microsoft 365 tenant: Exchange Online feeds Teams calendar and scheduling, SharePoint external sharing and Exchange-linked features, and Copilot's access to email, calendar and files, so one failure reaches all three, plus 21 services on Microsoft's list. Right, a separate path: a user connects over HTTPS to MyWorkDrive, which reaches your file server over SMB, with sign-in through Active Directory or your identity provider and no Exchange Online or SharePoint Online in the path.

What a MyWorkDrive deployment depends on during a Microsoft 365 outage
SettingWhat it depends onHolds up during an M365 outage?
Entra ID sign-inMicrosoft Entra IDYes, if Entra stays up. Entra was not on Microsoft's list for this incident
Active Directory sign-inYour domain controllers; your SAML provider if you use single sign-onYes. With single sign-on, it follows the availability of your identity provider
Office for the web editingA temporary copy staged in OneDrive or SharePointNo. It works only while OneDrive or SharePoint does
Desktop Office, Office Online Server, ONLYOFFICEYour own infrastructureYes
SharePoint or Azure Files backendMicrosoftSame as Microsoft

Two more notes. If you publish MyWorkDrive through its cloud connector relay rather than your own hostname and certificate, that path runs on Cloudflare's tunnel service, not Microsoft's. And if you plan on self-hosted editing, set up ONLYOFFICE or Office Online Server before you need it; Office Online Server reaches end of life on December 31, 2026, which makes ONLYOFFICE the longer-term choice. Our Office editing and identity and access pages cover the options in detail.

Cloud outages aren't unique to Microsoft. We wrote about the same question after the October 2025 AWS outage.

Updates after Microsoft's post-incident review

Status as of November 13, 2026, 11:23 AM ET: Microsoft has not published its Post-Incident Report. This section will be updated with the confirmed root cause, the final duration, and whether SharePoint file access held up throughout.

  • Root cause: pending
  • Final duration: pending
  • SharePoint file access during the outage: pending confirmation

Sources

Frequently Asked Questions

What caused the Microsoft 365 outage on November 12, 2026?

Microsoft hasn't published a root cause yet. Its status updates say a process on Exchange Online servers that establishes secure connections became overwhelmed, so servers stopped processing requests. Microsoft began reverting a network configuration change that correlated with the start of impact, patched an authentication and routing component, and found no evidence of malicious activity.

Was Azure down during the November 12 Microsoft 365 outage?

Azure was not on Microsoft's list of affected services. The incident started in Exchange Online, and Microsoft named 21 Microsoft 365 services that depend on it. Some users reported Azure problems on Downdetector, but those were user reports, and Microsoft's incident updates did not confirm any Azure impact.

Could users open SharePoint files during the outage?

According to Microsoft's status updates, yes. Microsoft said that accessing files stored directly in SharePoint Online remained functional, while external sharing and features that depend on Exchange Online were affected. Treat this as provisional until the post-incident review is out, because individual tenants may have seen different behavior.

How do I access files when SharePoint is down?

Use a path that doesn't run through SharePoint. Files the OneDrive sync client has already downloaded open offline, though changes won't sync until service returns. Files on an on-premises file server stay reachable over VPN or through an HTTPS gateway such as MyWorkDrive, as long as their sign-in method is working.

What should IT do during a Microsoft 365 outage?

Check Service Health in the Microsoft 365 admin center and note the incident IDs. Send staff updates through a channel outside Microsoft 365, such as SMS or a status page. Point people to file access that still works, pause tenant changes, and record affected users and times for any SLA credit claim.

How often does Microsoft 365 go down?

Microsoft posts smaller advisories every week, but broad outages are less frequent. We count seven notable incidents in 2026 through November 13, including multi-hour outages in January, July, October and November. Exchange Online was the root service in four of them, all since October 12.

Does MyWorkDrive work when Microsoft 365 is unavailable?

Yes, for files on your own servers, as long as the sign-in method stays up. With Active Directory sign-in, MyWorkDrive doesn't depend on Microsoft 365. Entra ID sign-in depends on Entra, which wasn't on Microsoft's affected list. Office for the web editing stages files in OneDrive or SharePoint, so it depends on them.


Start a free trialBook a demoView pricing


Ron Bhojwani

About Ron Bhojwani

Ron is CEO of MyWorkDrive and a product engineer by background: he spent six years in engineering and product leadership at CData Software, then served as MyWorkDrive's Chief Product Officer before stepping into the CEO role. A Dartmouth College alum, he writes for IT leaders navigating file access, data sovereignty, and enterprise IT strategy.