Microsoft 365 recovery advances, but full recovery has no ETA

By Rebecca Stone

After more than 24 hours of disruption to Microsoft 365 worldwide, Microsoft said at 6 p.m. UTC (1 p.m. ET) on Friday, Nov. 13, that service recovery was broad but incomplete.

Microsoft reported broad recovery and stability across its services, but degradation continued in Microsoft 365 services that interact with Exchange Online.

Components that do not depend on that connection remained functional.

Email itself could be delayed or inaccessible, and other Microsoft 365 products were also affected.

The cause and Microsoft’s response

Microsoft ruled out both a cyberattack and AI.

The company identified a technical issue introduced by an earlier network capacity upgrade.

That problem surfaced after a recent network change.

On its service health dashboard, Microsoft said: “Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration.”

The staged return prioritized stability over speed across a service set used by businesses worldwide.

That approach explains why some access returned before dependent workflows, including email, had recovered fully.

The remaining service gaps

The outage had hit services unevenly since it began, and Microsoft continued to list these problems:

• Email and administration. Users might be unable to load some Microsoft 365 Admin Center pages. The outage also hit Cloud Update, Cloud Policy, and Inventory in the Microsoft 365 Apps Admin Center.
• Devices and compliance. Microsoft Intune device enrollment, device check-in, and device compliance policies could still suffer intermittent disruption.
• Chat and collaboration. Users might fail to load Copilot 365 Chat or receive responses through either the web version or the app. The outage also affected a long list of functions in Microsoft Purview and Microsoft Teams.
• Files and cloud PCs. Users of Microsoft 365 apps such as Word or Excel might be unable to view recently used files. The problem could still block some users from connecting to Cloud PCs when customers had configured their Windows 365 tenant and Cloud PCs to use Microsoft Purview Customer Key for Windows 365 Cloud PCs.

What does this change for IT and security teams?

At 8 p.m. UTC (3 p.m. ET), two hours after the earlier update, Microsoft said it was still draining queued messages and rebalancing traffic.

Customers could see improved sign-in and access while delivery and processing continued to catch up.

Microsoft had no estimate for full recovery and warned that service access can recover before mail flow fully normalizes.

For marketing leaders, the practical point is simple: restored sign-in does not mean normal mail flow.

Teams relying on chat, file access, or compliance tools still face uneven recovery.

The recovery process also creates an opening for attackers.

Matt Hull, vice president of cyber intelligence and response at NCC Group, said: “cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create.”

He said organizations should remind colleagues to stay vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay.

Social engineering is a particular concern because attackers may impersonate Microsoft or internal IT teams.

They may try to persuade employees to reset passwords, approve multi-factor authentication requests, or provide remote access to their devices.

The review still to come

Microsoft apologized for the disruption, said it takes the trust customers place in its services seriously, and promised a full post-incident report after its review.

The company had not set a publication date for that report.

Until mail delivery and processing normalize, better access will not necessarily mean normal service performance.