One Server Failure Took Down Outlook, Teams and Copilot — How Microsoft's Cloud Domino Fell

On Thursday afternoon, email stopped working for millions of people at once — and it was not just email. Outlook would not load. Teams would not connect. SharePoint stalled, Copilot went quiet, and the outage spread across 74 countries in about an hour. The cause was not a hack, not a surge of traffic, and not a cut cable. According to Microsoft, it was a handful of servers failing a routine health check — and then everything else falling over trying to cover for them. This is how one small failure inside the world's most-used workplace cloud took down five services, and what it tells us about how fragile "the cloud" really is.

What went down — and how fast

Microsoft says the incident in its Exchange Online email service began at 16:17 UTC on Thursday, November 12. Within roughly an hour, complaints on the outage tracker Downdetector surged worldwide, peaking at 19,650 reports per minute across five Microsoft services by 18:25 UTC — against fewer than 15 reports a minute on a normal Thursday. Outlook alone drew nearly 130,000 reports shortly after 1pm Eastern time, more than 2,000 times its normal level. By the time the reports were counted, the disruption had reached 74 countries and territories, mostly across the Americas, Europe and Australia.

The services Microsoft lists as affected are Exchange Online — the email engine behind Outlook — plus Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR. Reports also spiked, to a much smaller degree, for Xbox, GitHub and LinkedIn, which Microsoft also owns — but those saw comparatively minor blips, not the full outage that hit the workplace tools. The distinction matters: this was a Microsoft 365 outage, not a Microsoft-everything outage. And it was, by Microsoft's own count, the third major Microsoft 365 disruption this year.

Why one failure took down five services

The mechanism, as Microsoft has described it so far, is a cascade — the cloud version of a domino run. A large pool of servers unexpectedly failed automated health diagnostics and dropped offline. That sounds minor: cloud systems are built with spare capacity precisely so that individual servers can fail without anyone noticing. But when traffic automatically shifted onto the remaining servers, a core process on those machines became overwhelmed by elevated processor usage, and healthy servers began turning unresponsive too. Each failure pushed more load onto the survivors, and the survivors failed in turn.

That is why the outage crossed service boundaries. Outlook, Teams, SharePoint and Copilot are different products, but they share the same underlying infrastructure — and above all they share Exchange Online. Email is the connective tissue of Microsoft 365: Teams meetings are scheduled through it, SharePoint notifications flow through it, Copilot reads it. When the email layer buckled, the services built on top of it had nothing to stand on. Microsoft's own updates put it plainly: a portion of its infrastructure was experiencing elevated load across multiple regions, and that load was likely contributing to the connectivity errors.

The recovery has been slower than the collapse. Microsoft said it was testing a configuration change and restarting affected machines, and later confirmed that recovery was underway — but also that some of the fixes were not "taking as expected", with servers it brought back failing again once traffic returned. To protect mail caught in the jam, the company extended its email timeout to 48 hours, so delayed messages would not simply expire. More than ten hours after the first failures, Microsoft had still not confirmed full restoration, and had not named a final root cause.

Not a cyberattack — and why that matters

Microsoft has said repeatedly that it is not aware of any malicious activity behind the incident, and that full details of the root cause will come in a post-incident report once the problem is mitigated. That rules out the explanation many people reach for first — and it is worth pausing on why. A cyberattack is, in a sense, the comforting explanation: it has an enemy, a motive, a fix. An internal cascade has none of those. It means the system failed itself, under normal conditions, because of the way it is built.

That is the real story of this outage, and it is bigger than one bad afternoon. Modern work runs on a small number of enormous shared platforms, and those platforms are designed around a bet: that failures stay small and isolated. Thursday showed what happens when the isolation fails. A health check — a safety mechanism, designed to catch sick servers — became the trigger that took healthy servers offline. The redundancy that was supposed to absorb the failure became the channel that spread it.

The practical advice, while recovery continues, is unglamorous. Check Microsoft's status page before assuming your own connection is at fault. Do not resend the same email repeatedly — with the timeout extended to 48 hours, delayed mail is being held, not lost, and duplicates will only add to the backlog. And for organisations, the lesson is the one every major outage teaches and almost nobody acts on until the next one: a single provider for email, chat, files and AI assistance is a single point of failure, however many servers it runs on. The cloud did not go down because it was attacked. It went down because, for a few hours, its own safety systems worked exactly as designed — and that was the problem.