What Went Down
Microsoft listed the following services as potentially affected under its main advisory, MO1550821, as the morning went on. The list grew in stages, which is itself a clue: the fault was not in one product but in shared infrastructure underneath many of them.
| Service | What users saw |
|---|---|
| Exchange Online and Outlook (EX1550543) | Mailboxes would not open on web, desktop or mobile, or in third party mail apps. Calendars affected. The worst hit service. |
| Microsoft Teams | The client "may fail to connect or load", which takes chat, meetings and Teams calling with it. |
| SharePoint Online, Planner, To Do | Files, intranets and task lists slow or unavailable. |
| Microsoft 365 Copilot | Disrupted. OpenAI and Anthropic also reported effects on tools that connect to Microsoft. |
| Defender XDR, Defender for Office 365, Purview, Intune | Security, compliance and device management tools affected. |
| Microsoft 365 Apps admin centre | Added late in the morning, limiting what IT teams could change. |
Downdetector also showed smaller simultaneous spikes for Xbox, GitHub and LinkedIn, all Microsoft businesses, though it is not yet clear whether they share a cause.
The Timeline in Australian Time
Microsoft posts its updates in US Eastern time. Converted to AEDT, which is 16 hours ahead in November, the sequence looks like this. Times are approximate and taken from Microsoft's public updates as reported.
| AEDT, 13 Nov | What Microsoft reported |
|---|---|
| 1:45am | A Teams incident in North America (TM1550488) begins. Microsoft later marks it restored after automated recovery. |
| 3:17am | EX1550543 opens: users unable to connect to Exchange Online mailboxes. |
| 5:07am | Microsoft warns that users in any region may be affected. |
| 5:26am | MO1550821 opens covering Microsoft 365 more broadly. Microsoft cites "elevated load" on part of its infrastructure. |
| 5:48am | Connection traffic spread across wider infrastructure to balance the load. |
| 6:12am | All deployments paused. Traffic moved off affected infrastructure and affected servers restarted. |
| 6:31am | Microsoft revises its view: the strain is not a traffic surge but servers becoming unavailable and pushing work onto the rest. |
| 6:38am | Downdetector peaks above 11,000 reports a minute worldwide. |
| 7:19am | No recent change correlates with the start. Failed health checks may stem from one component on affected servers. |
| 7:32am | A change to bypass that component goes to a subset of servers. Planner and To Do added to the affected list. |
| 7:56am | A different health check method returns some servers to service. Recent configuration updates are investigated. |
| 8:41am | Intune, Defender for Office 365, Purview and Power BI added. Microsoft assesses reverting configuration updates. |
| 9:11am | Actions so far "have not provided the anticipated relief". A core process on affected servers is overwhelmed. Part of the infrastructure is isolated to test recovery. |
We published this at about 9:45am AEDT. Microsoft had given no time for full recovery. The authoritative source is status.cloud.microsoft and the incident entries in your Microsoft 365 admin centre, once it loads.
How a Health Check Can Take Down a Service
The most interesting part of Microsoft's updates is the role of health checks. Large cloud services run on thousands of servers behind load balancers. Each server is asked, every few seconds, "are you healthy?" If it fails to answer correctly, the load balancer stops sending it traffic. That is normally what keeps a service up: a sick server is quietly taken out and its work goes elsewhere.
The same mechanism can work in reverse. Microsoft's updates describe something close to this sequence:
1. Servers fail their checks
A component on the servers starts reporting them as unhealthy. Microsoft has said it suspects that component, not the servers themselves.
2. They are pulled from service
The load balancers do their job and stop sending traffic to those servers. Capacity drops.
3. The rest take the load
The same number of users are now served by fewer machines. Microsoft saw this as "elevated load" before realising it was lost capacity, not new demand.
4. The survivors buckle
Under extra load, more servers miss their checks or stop responding, and they too are removed. Microsoft's latest update says a core process on affected servers is becoming overwhelmed, with elevated processor use.
Engineers call this a cascading failure. It explains several of Microsoft's actions this morning. Restarting servers helps only if they stay healthy once traffic returns. Bypassing the health check component returns capacity but removes a safety net. Stopping more servers being removed while others recover, slowly reintroducing traffic, and isolating regions so each can recover on its own are all ways of breaking the loop. It also explains why the first fixes "did not provide the anticipated relief": a server brought back into a pool that is still overloaded can be knocked straight back out.
Why pausing deployments matters
Microsoft paused all deployments and configuration changes early on. In any large incident the first question is "what changed?", and freezing change stops a second problem being layered on top of the first. Microsoft has since said a small number of configuration updates are being examined as possible contributors.
Why a North American Fault Hit Australian Desks
Microsoft's own wording early on was that the Exchange problem involved connections in the Americas. By 5:07am AEDT it was warning that users in any region could be affected, and by the time Sydney and Melbourne offices opened, Australian users were among the hardest hit by reports.
There are a few reasons that can happen even when data is stored in Australian data centres:
- Shared front doors. Sign-in, connection routing and many management functions are global services. If the layer that connects you to your mailbox is struggling, it does not matter that the mailbox itself sits in Sydney.
- Load moving between regions. One of Microsoft's first mitigations was to spread traffic across wider infrastructure. That is sensible, but it can carry stress into regions that were fine.
- Timing. The incident escalated during the US afternoon, which is the start of the Australian working day. Australia hit the fault at the moment it needed email most.
Microsoft 365 does offer Australian data residency, and that matters for privacy and compliance. Today is a reminder that where data is stored and where a service is run are not the same thing. A platform can keep your files in Australia and still depend on systems and decisions elsewhere to let you reach them.
Why Teams Calls Failed With the Email
For businesses that use Microsoft Teams as their phone system, today was not just an email problem. Teams Phone sits at the end of a chain of Microsoft 365 services, and a break anywhere in the chain stops the phone ringing.
| Link in the chain | What it does for a phone call | Exposed today? |
|---|---|---|
| Microsoft sign-in | The user must be signed in for a call to reach them. | Logins were reported as affected. |
| Teams client and service | Calls ring in the Teams app on desktop, mobile or certified Teams phones. | Yes. Teams "may fail to connect or load". |
| Auto attendants and call queues | Run as Teams resource accounts inside Microsoft's service. | Depend on the same service. |
| Voicemail | Teams voicemail is delivered to the user's Exchange Online mailbox. | Yes. Exchange was the worst hit service. |
| Call forwarding and admin | Set in the Teams app or Teams admin centre. | Microsoft 365 admin centre listed as affected. |
Where Teams numbers arrive by Operator Connect or Direct Routing, the carrier or session border controller sits in front of Microsoft and can usually divert numbers elsewhere. That is the best escape hatch available today. With a Microsoft Calling Plan, the number lives inside Microsoft and the options are narrower. Our earlier guide to Teams Phone and Direct Routing in Australia covers the differences.
What We Know and What We Do Not
| Known, from Microsoft | Not known yet |
|---|---|
| Servers became unexpectedly unavailable and capacity was lost. | Why the health check component started failing. |
| A core process on affected servers is overwhelmed, with high processor use. | Whether a configuration update triggered it. |
| Deployments are paused and recent configuration updates are under review. | When full service will return. |
| The fault is in Microsoft's infrastructure, affecting all regions. | Whether the Xbox, GitHub and LinkedIn spikes share the cause. |
Some commentators have suggested a misrouted network change, and others have raised the possibility of an attack. Nothing Microsoft has published supports either, and its description so far points inward, at its own server fleet. Australia's National Cyber Security Coordinator, Lieutenant General Michelle McGuinness, is aware of the outage and looking into it, which is standard for an event of this size. Expect Microsoft's preliminary post incident review within a few days, and a fuller one later.
Concentration Risk: The Real Lesson
This is Microsoft 365's second major outage of 2026, after a multi hour Outlook and Teams disruption on 22 January. Every large platform has bad days, and smaller ones are not immune. The issue is not that Microsoft failed. It is how many separate things a business loses when one platform does.
A typical Australian small business on Microsoft 365 this morning lost email, calendars, shared files, internal chat, video meetings, two-factor codes sent by email, and, if Teams was its phone system, its incoming calls and voicemail. Several of the tools it would normally use to work around the problem were inside the outage too. The ABC reported medical practices unable to send referrals and a rail operator unable to load train details, both examples of a single dependency reaching well beyond the IT department.
Risk managers call this concentration risk, and the answer is the same as in any portfolio: do not put everything critical in one place. For most businesses that does not mean leaving Microsoft. It means keeping the channel customers use to reach you, the phone, on a separate platform with a separate failure path. We made a similar argument after the Telstra national outage in July, and in our guide to phone redundancy.
Five Questions to Ask Any Provider
Whether your phones run on Teams, on us, or on anyone else, these are fair questions to ask once today is over.
- "If your platform is down, can my numbers be diverted without it?" The answer should name a mechanism outside the platform, such as a carrier level divert, and who can trigger it.
- "Does my phone system depend on my email system?" Voicemail, sign-in and admin access are the usual hidden links.
- "Where is the service run from, and who runs it?" Data stored in Australia is good. A service designed, operated and supported in Australia is a different and stronger answer.
- "How will you tell me what is happening?" Look for a status page and a real person on the phone, not only a post on a social network.
- "What did your last major incident teach you?" Every provider has had one. A straight answer is a good sign.
Uniden Voice Is Running Normally
Uniden Voice does not run on Microsoft 365. Our cloud phone platform is designed, built, hosted and supported in Australia, on systems we run ourselves, so this morning's Microsoft fault has not affected it. Calls, call queues, auto attendants, voicemail, call recording and the Uniden Voice apps have all been working normally, and EVOC2 desk and cordless phones keep ringing whether or not anyone's laptop can load Teams.
Uniden was founded in Japan in 1966 and has been part of Australian homes and offices since 1989. Uniden Voice is Australian owned and operated, and its local team is answering calls today. If your business is struggling to stay reachable this morning, call us and we will help you work out what can be done with what you have, customer or not.
Many of our customers keep Microsoft 365 for email and documents and use Uniden Voice for their phones. On a day like today, that split is the difference between "our email is down" and "we are closed".