Microsoft 365 recovery stalls as fixes fail to hold, more than 12 hours on

Microsoft was still struggling to restore its Microsoft 365 services on Friday, more than 12 hours after a global outage took down Outlook, Teams, SharePoint, Copilot and other workplace tools. The company said its overnight fixes were not taking as expected and it had given no time for full recovery.

For millions of workers, the disruption was not an abstract technical problem. Microsoft 365 is the everyday infrastructure of modern offices, schools and public services, combining email and calendars in Outlook, meetings and messaging in Teams, and document storage and collaboration in SharePoint. When those systems falter together, meetings are missed, messages go undelivered and shared files become unreachable. Copilot, the company's artificial intelligence assistant woven into those same tools, was also affected, underlining how tightly the services are now linked.

That breadth made Friday's update so sobering. This was not a brief interruption followed by a clean restart. It was a prolonged recovery in which progress proved fragile, and in which Microsoft itself acknowledged that the changes it was making were not producing sustained recovery.

Fixes that would not hold

Some servers had been brought back and stayed stable for a time. Microsoft said it had validated a new health-check method on a subset of the affected infrastructure and was applying it more broadly, while preparing an automated process to detect and restart unresponsive servers.

But some servers that had returned to service became unresponsive again once they started taking customer traffic, and the company said the changes were not producing sustained recovery. That pattern — systems appearing healthy in isolation, then struggling under real-world load — is one of the most difficult problems engineers face during a major outage. A server can pass internal checks and still fail when thousands of users reconnect at once and overwhelm the systems meant to help them recover.

Microsoft traced the failure to servers that became unexpectedly unavailable after failing automated health checks, which overloaded the systems that remained. In large cloud platforms, automated health checks are supposed to protect reliability by removing faulty machines from service before they cause wider harm. When too many machines are removed at the same time, however, the remaining capacity can be left carrying more traffic than it was designed to handle, creating a cascade in which each new failure makes the next one more likely.

A spokesperson said there was no indication of a cyber attack, and Microsoft has not published a full root cause. That distinction matters for customers deciding how to respond. A security incident would demand a very different set of actions from a capacity and reliability failure, and the company's statement was intended to rule out, at least on the evidence available, the more alarming explanation while its investigation continued.

What the numbers showed

Reports of problems peaked at close to 130,000 for Outlook around 1 p.m. Eastern time on Thursday, according to Downdetector, and had fallen to about 13,000 five hours later. That is a sharp improvement, but still far above a normal day.

Sites such as Downdetector do not measure an outage directly. They collect reports from users, so their figures offer a useful picture of scale and direction rather than a precise count of affected accounts. Even with that caveat, the data told a clear story on Thursday: a sudden, very large spike, followed by a gradual decline that still left many users reporting problems hours later.

For individual workplaces, that uneven recovery can be especially frustrating. One team may find email working while a neighboring department cannot open shared documents, or a service may return briefly and then disappear again. Microsoft's account of servers becoming unresponsive after restoration helps explain why the experience for customers was not a simple, uniform return to normal, but a patchy one that varied by service, location and time of day.

What happens next

The incident is tracked under service advisories EX1550543 and MO1550821, and administrators are advised to check status.cloud.microsoft for the latest. Those advisory identifiers are the reference points IT teams use to follow Microsoft's official updates and to match the company's guidance against the symptoms their own users are seeing.

Until Microsoft can show that restored servers stay stable under full customer traffic, confidence in the recovery will remain tentative. The company will also face questions once services are fully restored about how the initial health-check failures spread so widely, why the overload was not contained sooner, and what safeguards will prevent a similar cascade in future.

Outages of this scale are a reminder of how concentrated the world's digital workplace has become. When a single provider supports email, meetings, files and AI assistance for so many organizations at once, a failure in one layer can be felt almost everywhere, almost immediately. Microsoft's immediate task on Friday was the practical one of keeping its fixes in place. Its longer task will be to explain in full what went wrong — something it has not yet done — and to persuade customers that the system they depend on each morning is more resilient for the experience.