Analysis: Microsoft says its global outage was 'not related to cyber.' Five questions before its report comes out

What happened

Problems began on Thursday, Nov. 12. Reports on the outage tracker Downdetector spiked at about 12:30 p.m. ET (11:30 a.m. CT), TechRadar reported; CNBC said the problems began shortly before 1 p.m. ET. At 11:54 a.m. CT, Microsoft's status account on X, @MSFT365Status, said it was investigating problems reaching Exchange Online mailboxes in the Americas. Thirteen minutes later it said the issue "may affect Microsoft 365 service connectivity for users in any region."

TechRadar reported that Outlook, Microsoft 365 and Copilot were hit hardest, with reports of OneDrive problems as well. The Guardian also listed Word, Excel, PowerPoint, Teams and SharePoint. Microsoft's status page listed Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Copilot 365 and Microsoft Defender XDR as potentially affected, according to TechRadar. Downdetector users also reported Azure problems, TechRadar said, but none of the Microsoft posts we reviewed list Azure as affected.

Downdetector counts reports from users. TechRadar recorded a peak of more than 131,000 Outlook reports, and the BBC said Outlook reports peaked at nearly 140,000 around 18:00 GMT. The Guardian counted nearly 130,000 reports in 74 countries. The Guardian also reported that the outage lasted roughly 18 hours before services began to recover, just before midday GMT on Friday.

The disruption reached Britain's National Health Service, police forces in Britain, and congressional offices in the U.S. House, where the chief administrative officer sent staff a "campus-wide alert," the Guardian and CNBC reported. On Friday evening Microsoft's service health page said the company was still monitoring and would not consider the issue remediated until a backlog of email messages had been processed.

How Microsoft's explanation developed, in its own words

Thursday, 12:35 p.m. CT: "We've determined a portion of infrastructure is experiencing elevated load across multiple regions, which is likely contributing to the connectivity errors."

1:12 p.m. CT: "We're aggressively pursuing all pathways to reduce impact. We've paused all deployments, we're moving additional traffic off the affected infrastructure, and we're restarting affected servers to return them to service."

1:31 p.m. CT: "We determined the elevated load isn't driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure." At 1:50 p.m. CT it said it was testing "a configuration change to address a problem that's causing servers to fail automated health checks and become unavailable."

2:19 p.m. CT: "We've not identified any recent change correlated with the start of impact; however, our investigation indicates the failed health checks may originate from a specific component that's responsible for processing server health."

3:40 p.m. CT: "we're assessing whether reverting a small number of recent configuration updates we identified could help accelerate recovery." At 6:06 p.m. CT: "we're rebuilding a subset of affected servers using a previous configuration to validate if this prevents them from becoming unresponsive."

Friday, 9:40 a.m. CT, on Microsoft's main X account: "for now we can confirm that there is no indication this is the result of malicious or cyber activity." Microsoft's service health dashboard said, "At this time, we have no evidence of malicious activity associated with this incident," TechRadar reported.

Friday, 10:40 a.m. CT, on Microsoft's main account (repeated by @MSFT365Status at 12:05 p.m. CT): "This was a technical issue not related to cyber or AI / agents. The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change. We have addressed the underlying issue and continue to restore service to remaining customers and regions." The company added: "We will provide a full post-incident report once our review is complete." It gave no date for the report.

Friday: the FAA ground stop, and what officials said about any link

On Friday afternoon the Federal Aviation Administration ordered a ground stop at all U.S. airports "due to extraordinary circumstances and for reasons of safety," Politico reported. Transportation Secretary Sean Duffy said on X that it followed a communication issue affecting all Air Route Traffic Control Centers, and the FAA later attributed it to "a temporary telecommunications outage," according to NBC Chicago and DW.

Homeland Security Secretary Markwayne Mullin told reporters outside the White House: "There is no indication, and we have no reason to believe as of right now that this was a threat to the United States," Politico reported. Asked whether it could have been a cyberattack, he said, according to The Hill: "As we investigate what caused this, you always got to assume that as many cyberattacks that take place that you make that assumption. So, but as of right now, that's not known."

On a link to Thursday's outage, Mullin said he believes they are "separate issues" and does not see "any reason to connect those two at all," People reported. A Microsoft spokesperson told People: "Microsoft has no indication that the FAA nationwide ground stop is related to the recent service disruption." Three senior officials told NBC News there is nothing to indicate a connection between the two. Officials also told NBC News they had not seen the kind of activity usually associated with a cyberattack, while cautioning that the investigation was in its early stages.

Who else has weighed in

As of 6:45 p.m. CT Friday, we found no public statement about the Microsoft outage from the Cybersecurity and Infrastructure Security Agency (CISA), the federal agency for cyber defense. The newest release on its news page was dated Nov. 9.

Rep. Josh Gottheimer of New Jersey, who worked at Microsoft before Congress, told CNBC he had asked for a briefing. "Is there something that went on that's nefarious here, or is this just something else? These outages occur in a lot of the companies, but the size of it and the length of it and the timing of it," he said.

Australia's home affairs and cyber security minister, Tony Burke, said Microsoft "believe they are dealing in some ways similar to what we saw with respect to CrowdStrike where there is an update that has gone awry," Reuters reported, according to CNBC. Mark Gregory, an associate professor of engineering at RMIT University in Melbourne, told the Guardian that the outage appeared to affect the network layer and that losing part of a server pool can overload the rest, causing "a cascading problem."

For context: earlier large outages

July 19, 2024, CrowdStrike: a faulty software update crashed Windows computers worldwide. The same day, CrowdStrike chief executive George Kurtz said, "This is not a security incident or cyberattack," Reuters reported. Microsoft estimated that 8.5 million Windows devices were affected, AP reported. CrowdStrike published its root cause analysis on Aug. 6, 2024, tracing the outage to a content configuration update.

July 30, 2024, Microsoft Azure: Microsoft said the initial trigger was a distributed denial-of-service (DDoS) attack and that "an error in the implementation of our defenses amplified the impact of the attack rather than mitigating it," The Register reported. The Register reported at the time that a preliminary post-incident review was due in about 72 hours and a final one in about two weeks. In that case the company publicly identified an attack as the trigger.

Oct. 29, 2025, Azure Front Door: Microsoft's status page said, "We have confirmed that an inadvertent configuration change was the trigger event for this issue," The Verge reported.

January 2023, FAA: the last nationwide ground stop before Friday followed the failure of the system that sends messages to pilots, which NBC Chicago reported was caused by a corrupted system file.

Open questions (analysis)

1. Why did the explanation change? At 2:19 p.m. CT on Thursday, Microsoft said it had "not identified any recent change correlated with the start of impact." By Friday it said the incident "surfaced following a recent network change" tied to "an earlier network capacity upgrade." Investigations often refine early findings. What did engineers find between those two posts, and when?

2. How was "not related to cyber" settled before the review is done? Microsoft ruled out a cyber cause on Friday morning, in the same statement that said a full report would come "once our review is complete." What evidence supports that conclusion now, and will the report show it?

3. What should the public make of two outages on back-to-back days? A nationwide outage of a major cloud service and a nationwide ground stop came one day apart, and officials described each as not malicious within hours. Officials and Microsoft say there is no evidence of a link. Will each investigation publish enough detail for the public to see that for itself?

4. Who checks the findings? We found no public CISA statement on the Microsoft outage, and a member of Congress has asked for a briefing. Will any federal agency or independent auditor review Microsoft's conclusions, and will the FAA publish its own account of Friday's failure?

5. When will the report be public? Microsoft has given no date. After the July 2024 Azure outage, a preliminary review was due in about 72 hours and a final one in about two weeks, The Register reported. Will this report be published in full, and when?