Microsoft’s cloud went dark in 74 countries; and the recovery would not hold

The inboxes that went silent within the hour

On Thursday 12 November 2026, Microsoft’s cloud began failing in the middle of the American working day, and within about an hour the failure was everywhere. Outlook stopped loading, Teams calls dropped, and Copilot went dark with them. Microsoft put the start of its Exchange Online incident at 16:17 UTC; reports to the outage tracker Downdetector began climbing at about 17:25 UTC, and by 18:25 UTC the five affected Microsoft services together were drawing 19,650 problem reports a minute; against fewer than 15 a minute on an ordinary Thursday.

The numbers kept climbing. Outlook reports alone peaked at nearly 140,000 worldwide around 18:00 GMT, more than 2,000 times their normal level, with about 130,000 of them in the United States shortly after 1 p.m. Eastern. A Downdetector map showed the outage reaching across the Americas and into parts of Europe, Asia and Africa

Microsoft said it had found the cause: a portion of its infrastructure was experiencing elevated load across multiple regions. Engineers began routing traffic away from the affected servers, and by about 6 p.m. Eastern the company said it was “observing limited recovery”; but the recovery did not hold. More than ten hours after the failure began, users in Singapore were still struggling to reach colleagues and join meetings, and the disruption had rolled into Friday morning in Australia and across Asia, where the outage reached government offices as well: Australia’s spy agency ASIO and the federal police were both caught up in it, and some Singapore government systems, including email, were affected.

What Microsoft has confirmed; and what the trackers show

Four things are established. First, the scale: 74 countries and territories reported disruption within about an hour, Second, the breadth: the outage touched Outlook, Microsoft 365, Teams, Copilot, Exchange Online and OneDrive, with Azure also drawing sharply elevated reports Third, the cause as Microsoft states it: elevated load across multiple regions, not a cyberattack. Microsoft told Australia’s Home Affairs Minister Tony Burke that it did not believe the outage was caused by a cyberattack, and no evidence of one has surfaced. Fourth, the state of repair: partial and unstable.

Microsoft’s own updates trace a recovery that kept slipping. The company adjusted traffic protocols, redistributed traffic and introduced targeted traffic-blocking measures. In an update at around 12:20 p.m. Singapore time on Friday, it said it was “observing partial recovery across regions in which we’ve applied these adjustments”; then added that the actions were “not resulting in sustained recovery”. Earlier updates carried the same message in plainer language: the fixes were “not taking as expected”, and services that had temporarily come back could go unresponsive again as more users tried to reconnect.

The strain showed in workplaces everywhere. An IT professional at a chemical plant in Singapore told CNA he was alerted at 5:49 a.m. local time, when a colleague on the night shift could not reach Outlook; what looked like a routine email problem turned out to be a failure at the provider’s end. By Friday, Outlook reports had fallen to about 37,000 as of 6 p.m. Eastern; down from the peak, but still far above normal.

Why did the load spike, and when does it end?

The central unknown is the load itself. Microsoft has said a portion of its infrastructure experienced elevated load across multiple regions, but it has not said what generated that load, which systems failed their health checks first, or why the load overwhelmed infrastructure designed to absorb it.

Nor is there a restoration time. Microsoft’s updates describe gradual recovery, not a deadline, and its own language warns that restored services may fail again as users return. The pattern of the day, limited recovery, then relapse, means no one can say whether the outage ends in hours or stretches into a second day. The full scope is also unclear: Azure’s elevated reports suggest the strain reached the platform layer, but Microsoft has not detailed which Azure services were degraded.

When one company’s cloud is the world’s office

What failed on Thursday was not a website. It was the working infrastructure of governments, companies, hospitals and schools; email, meetings, documents and the AI assistant layered on top of them, all rented from the same provider. When that provider’s infrastructure faltered, there was no second office to move into. When the failure sits at the provider’s end, the customer can only wait.

The timing sharpens the point. This is the third major Microsoft 365 disruption this year, after multi-hour outages in January and a code-update failure in August that took several days to resolve fully. Three failures in eleven months is not a run of bad luck; it is a pattern, and it lands the same week governments are debating AI security and infrastructure resilience. The Trump administration’s AI task force met on Thursday to discuss AI-powered cyberattacks on critical sectors; while the most widely used productivity cloud in those same sectors was failing for reasons that had nothing to do with an attacker.

For the Global South, the stakes are sharper still. A Downdetector map showed the outage reaching Africa and Asia within the hour, and institutions there run on the same rented infrastructure with thinner margins; fewer backup systems, fewer alternative providers, less leverage to demand priority restoration. Australia could activate a formal cyber agreement with Microsoft to push its interests to the front of the queue; most countries cannot. The outage was global, but the ability to recover from it is not evenly shared.

How does a cloud built for redundancy fail everywhere at once?

The puzzle of this outage is not that a server failed. Servers fail every day, and clouds are built to route around them. The puzzle is that a failure described as “elevated load” spread to 74 countries within an hour and then resisted repair for more than ten hours. For load to defeat those defences across multiple regions at once, something must have gone wrong in the defences themselves; the traffic management, the health checks, or the coordination between regions that is supposed to isolate a fault instead of spreading it.

Microsoft’s updates point in that direction without saying so. The company adjusted traffic protocols, redistributed traffic and blocked some traffic outright; the moves of an operator fighting its own load-balancing machinery rather than a single broken component. The recovery pattern tells the same story: servers returned to service, stayed stable, and then failed again as users reconnected, as though the system could only carry its normal load when part of its user base was locked out.

The comparison that matters is with the week in technology more broadly, where the dominant story has been a chipmaker’s leadership crisis and the fragility of the AI boom. The Microsoft outage belongs beside it: the AI boom runs on the same concentrated infrastructure, the same handful of providers, the same giant data centres, the same bet that scale is its own insurance. Thursday showed the other side of that bet; through every lens the Bureau reads, the fix for concentration is distribution, the one thing the cloud business model resists.

What breaks next if the email stays down?

The first second-order effect is already visible: the sovereign-cloud debate gains a live exhibit. Governments that have argued for years about whether to host sensitive work on national infrastructure now have a night when their spy agency and their federal police could not send an email. Australia’s answer, in the moment, was a contract; an agreement that put its interests first in the restoration queue. Other governments will ask whether a contract is enough, or whether the answer is infrastructure they control. Expect procurement reviews, resilience audits and fresh questions in parliaments about who provides the state’s email.

The second effect falls on Microsoft itself. Three major Microsoft 365 disruptions in a year, January, August, now November, will invite the scrutiny that follows a pattern, not an incident: regulator inquiries, enterprise customers demanding service credits and contractual guarantees, and a formal root-cause report that will be read line by line. The third effect is commercial: rivals will pitch multi-cloud fallbacks to every enterprise locked out of its inbox; though the alternatives share the same backbone, and the race to build more data centres does not by itself make any one harder to break.

What to watch in the next 24 hours

Watch Microsoft’s status updates first. The company has been posting through its Microsoft 365 status channels; the test of each update is not the language, “progress”, “partial recovery”, but whether the Downdetector counts keep falling and stay down. Watch for the root-cause account too: Microsoft has not said what generated the elevated load, and the credibility of its explanation will depend on specifics; what failed, where, and what changes.

Finally, watch the calendar: a full restoration followed by silence would be the worst outcome; a pattern of three outages in a year, closed without explanation. The Bureau will keep tracking Microsoft’s disclosures, the regulators’ responses and the numbers, and will update this story as the account of what happened becomes clear.