Microsoft's own servers buckled, and Outlook went dark around the world

At about 12:50 p.m. Eastern on Thursday, Microsoft posted a line that every IT department on earth has learned to dread. The company was "investigating reports of users experiencing issues accessing Exchange Online," it said. Exchange Online is the plumbing behind Outlook. Within minutes, inboxes stopped refreshing, desktop mail clients froze or crashed, and phones sat on the same unread count for hours.

More than 16 hours later, as Friday morning got going on the US East Coast, it still wasn't fixed. Microsoft's own wording at that point: service health "remains variable and capacity has not yet fully returned to baseline."

No attacker and no third-party patch this time. By Microsoft's account, its own servers simply stopped coping, and the company spent a night trying one fix after another while the outage rolled from America into Asia's business day and then Europe's morning.

A night of fixes that didn't stick

The timeline, pieced together from Microsoft's status posts as quoted by NBC News, ABC News, CNBC and ABC7 Los Angeles, reads like an incident channel nobody wanted to be on.

By 2:50 p.m. Eastern, Microsoft was testing a configuration change to its cloud servers. Around 4 p.m. it said it had validated a different way of running server health checks that brought some machines back. "We're now applying this change more broadly," it posted, according to CNBC. By 4:40 p.m. it was restarting affected servers. At some point Teams was declared restored, then Microsoft said it had "paused all deployments" and was "moving additional traffic off the affected infrastructure," ABC News reported. Servers it returned to service in the evening could go unresponsive again as soon as traffic hit them.

The explanation kept moving too. CNBC reported that Microsoft first blamed a traffic surge and a component that processes server health. Later it described "elevated load across multiple regions," caused by a "number of servers being unexpectedly unavailable; straining the remaining infrastructure." Then, per NBC: "core process on affected servers is becoming overwhelmed, causing capacity loss." By Thursday night, ABC7 reported, Microsoft had narrowed it to "a process on the affected servers responsible for establishing secure connections" that was getting swamped, and said it was reverting "a recent network configuration change that correlates with the start of impact."

That last phrase is the one to keep an eye on. A recent change, rolled out by Microsoft, lining up with the moment things broke. The company hasn't said the change caused the outage. It has said it will publish "full details of the root cause, defense-in-depth repair items, and more within a Post-Incident Report."

At 11:36 p.m. Eastern, Microsoft said it was "observing partial recovery across regions in which we've applied these adjustments," but not sustained recovery. Overnight it warned that some attempts to improve things weren't going as planned. At around 2:30 a.m. it finally had something better to report after patching an upstream authentication and routing component: "We're seeing positive results for server stability." By Friday morning it described "early signs of stabilization."

Who got caught

Downdetector logged more than 130,000 reports of Outlook problems at Thursday's peak, according to CBS News and the Associated Press. Microsoft's own list of services that "may be impacted," as published by ABC7, ran to Exchange Online, Teams, SharePoint Online, Copilot, Defender XDR, Defender for Office 365, Planner, To Do and Intune. NBC reported that the consumer side was hit as well: Outlook.com, OneDrive, OneNote and Microsoft 365 for the web. OpenAI and Anthropic both reported trouble connecting to Microsoft 365 tools, according to CBS.

The list of casualties says a lot about how much of public life now runs through one company's mail servers.

In the US, NBC reported that email at federal agencies and on Capitol Hill was affected, along with the Los Angeles County Sheriff's Department and the county medical examiner's office. In Colorado, the Arapahoe County Sheriff's Office couldn't take bond payments online, so people had to go to the jail and pay in person. New York City Emergency Management warned that city agencies "may experience delays or temporary disruptions" and told residents to use 311 and 911 as normal. In Canada, CTV News reported hospitals, universities and Via Rail among those hit.

Overseas, Singapore's Government Technology Agency said government email was down. Japan's deputy chief cabinet secretary, Masanao Ozaki, said government IT systems were affected. The Philippines' Supreme Court said some operations, including email replies, were disrupted. Air India rerouted its email and said flights were unaffected; IndiGo said its email support channel was down. Danny Lau, who owns an aluminium firm in Hong Kong, told the AP his Outlook couldn't receive updates from US customers, which could "impact the production timeline."

Markets noticed. Workhorse Group pushed back its quarterly results, saying "The rescheduling is due to business disruptions caused by the global Microsoft outages taking place today." Richemont's earnings release slipped slightly on Friday, CNBC reported. Microsoft's own shares were down 2.6% in premarket trading.

The CrowdStrike comparison

Australia's home affairs minister, Tony Burke, spoke to Microsoft's top executive in the country and the national cyber coordinator. He relayed two things, as reported by Reuters and CBS. "They (Microsoft) don't believe they are dealing with a cyberattack," he said. And Microsoft compared what it was dealing with to the CrowdStrike disaster of July 2024, when a faulty security update crashed millions of Windows machines and grounded flights. Burke said they "believe they are dealing in some ways similar to what we saw with respect to CrowdStrike."

That comparison is generous to Microsoft in one way and damning in another. CrowdStrike was a vendor's bad file landing on Microsoft's platform. This time there's no outside vendor to point at. Charles Lamanna, Microsoft's executive vice president for Copilot, agents and platform, posted late Thursday: "There is no indication this is the result of malicious or cyber activity." He added: "We regret that today's outages caused disruptions for our customers, and we are working to address the issue."

For customers, that is cold comfort. An attack would at least have been an outside force. This was Microsoft's own infrastructure falling over under its own load, and taking courts, sheriffs, airlines and governments with it.

Email that bounced isn't lost, at least. Microsoft extended the retry window for delayed messages to up to 48 hours, CNBC reported, so most of Thursday's mail should eventually land. Then a lot of inboxes will fill up at once. For a system that broke because its servers couldn't handle the load, that's an awkward way to finish.

Sources: NBC News, CNBC, CBS News / Associated Press, ABC News, ABC7 Los Angeles, CTV News.