Microsoft 365 outage hits Outlook, Teams and Defender XDR for hours

A Microsoft 365 outage that began on Thursday afternoon has cut users off from Outlook, Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and the Defender XDR security platform, and was still unresolved more than five hours after Microsoft first reported it. In its latest update at 22:09 UTC, Microsoft said its actions so far "have not provided the anticipated relief" and that a core process on the affected servers is becoming overwhelmed.

Microsoft first reported mailbox access problems in the Americas at 17:54 UTC under incident EX1550543, and 13 minutes later said users in any region could be affected. A broader admin center advisory, MO1550821, lists Defender XDR among the affected services, BleepingComputer reports. Microsoft is also posting updates on its public status page, because many administrators cannot reach the admin center. Downdetector says reports came from 74 countries and territories.

What Microsoft says is failing

Microsoft's explanation has changed during the day. At 18:35 UTC it blamed elevated load on part of its infrastructure. At 19:31 UTC it said the load was not caused by more traffic but by a number of servers becoming unexpectedly unavailable, which strained the rest. At 19:50 UTC it said servers were failing automated health checks and dropping out of service.

At 20:19 UTC Microsoft said it had found no recent change that lined up with the start of the outage, and that the failed health checks may come from a component that processes server health. At 21:00 UTC it said an alternative health check method had brought some servers back. By 21:40 UTC it was assessing whether to roll back "a small number of recent configuration updates" it had identified. It has paused all deployments and is restarting affected servers.

What the outage means for defenders

With Defender XDR listed as affected, security teams that run detection and response through Microsoft's portal may have lost visibility or response actions for part of the outage. Microsoft has not said what Defender XDR functions failed. Teams that rely on it should check, once service returns, whether alerts or automated actions were delayed during the outage window.

No sign of an attack

Posts on X, including widely shared Spanish-language ones, claim the outage was a hack or was caused by the Outlook zero-day Microsoft patched on Tuesday. Nothing Microsoft has published supports that. Its updates describe servers failing health checks and an overloaded process, not malicious activity. The Outlook flaw leaks login hashes when a user opens a crafted message. It does not take down Exchange Online servers, and Microsoft has not linked the two.

What is not known

Microsoft has not given a root cause, an expected recovery time, or said whether an earlier Teams outage in the Americas on Thursday morning (TM1550488, which BleepingComputer says ran from 14:45 to 15:53 UTC) is related.