Microsoft 365 went down around 18:00 UTC on Thursday, November 12, and it did not come back quickly. Exchange Online, Outlook, Teams meetings, Copilot, Intune and a long tail of Exchange-linked services stayed degraded for more than a day, and Microsoft only said it had finished addressing the underlying issue on Saturday, November 14.
Most coverage has focused on what broke inside Microsoft. The more useful question for a founder or ops lead is simpler: if this happens again next quarter, what does your team do in the first hour? This piece answers that, with a fallback plan sized for companies of 5 to 200 people.
What actually happened
The timeline matters, because it shows why “just wait it out” was a bad plan this time.
- Thursday afternoon (US time): Microsoft flagged Exchange Online mailbox problems in the Americas. Downdetector reports for Outlook passed 130,000 within roughly an hour, according to Insurance Business, citing The Washington Times. Those are user reports, not a count of affected customers.
- Thursday night: Microsoft said servers were failing automated health checks and dropping out, which pushed load onto the remaining machines. It tried an alternative health-check method, which brought back only a subset of servers.
- Friday: The Register reported the outage had passed 27 hours, with restarts and traffic rerouting producing only partial recovery. Microsoft’s own status line said it had no ETA for full recovery. Microsoft also apologised publicly and said there was no sign of malicious activity.
- Saturday: Microsoft said services were restored and that it was checking the email backlog had been processed. According to Lowyat, the company traced the problem to an issue from an earlier network capacity upgrade that surfaced after a more recent network change, and promised a full post-incident report.
What is still uncertain: Microsoft has not published that report yet, so the precise failure chain is unconfirmed. No source we read says email was lost; the reporting points to queued and delayed mail instead. If you run a business on Exchange Online, treat “delayed” as the working assumption and check for anything time-sensitive that arrived late.
The real lesson: one vendor was carrying five jobs
For a typical small company on Microsoft 365, this one incident took out email, calendar invites, video meetings, the AI assistant and, for admins, the device-management console. Intune and the Microsoft 365 admin center were among the affected services early on, which meant some IT teams could not even see what was happening to their own fleet.
That is the part most continuity plans miss. A common “backup” is “if Outlook is down, we’ll use Teams.” This week both depended on the same Exchange-linked plumbing. Insurance Business made the same point from the broker side: switching between two Microsoft apps is not a fallback.
None of this is an argument for leaving Microsoft. Google Workspace, Slack and AWS have all had bad days too. It is an argument for knowing which of your critical functions share a single point of failure, and having one cheap alternative for each.
Who should care most
- Sales-led startups whose pipeline lives in email threads and calendar invites. A lost Thursday afternoon is a lost set of demos.
- Agencies and service firms with client deadlines delivered by email.
- Finance teams approving payments by email. Outages are exactly when an “our email is down, use this number instead” message slips through. We covered how that kind of pressure is exploited in our piece on the $129M deepfake CEO scam case.
- Anyone with Copilot or AI agents wired into Microsoft 365. Reports cited by Insurance Business said even third-party AI tools from OpenAI and Anthropic could not reach Microsoft 365 data during the incident. Automations fail quietly; check what did not run.
A 60-minute Plan B for small teams
You do not need an enterprise business-continuity programme. You need answers to five questions, written down before the next outage.
| Function | Ask yourself | Cheap fallback |
|---|---|---|
| Internal chat | Does our chat run on the same vendor as our email? | A free Signal or WhatsApp group for leads only, set up in advance with current numbers |
| Customer email | Can customers reach us if inbound mail stalls for a day? | A status line on your website and a support phone or form that does not route through your mailbox |
| Meetings | Who hosts tomorrow’s external calls? | A second video tool account (Zoom or Google Meet free tier) and a habit of putting a phone number in key invites |
| Admin access | If the admin portal is down, how do we see incident updates? | Bookmark the public status page and the @MSFT365Status account; note your tenant’s incident IDs when they appear |
| Payments and approvals | Could someone push a payment change while email is unreliable? | A written rule: no bank-detail changes approved during an outage, verified only by a known phone number |
In the first hour of the next outage
- Confirm it is the vendor, not you. Check the vendor status page and one outside source before anyone starts resetting passwords or reconfiguring DNS.
- Move internal coordination to the pre-agreed channel and post one owner for updates.
- Tell customers. A one-line banner on your site (“Email may be delayed; call us at…”) prevents a flood of duplicate requests once mail returns.
- Start a log. Note the start time, which tools failed, staff hours lost and any missed transactions. Insurance Business points out that cyber business-interruption cover usually has a waiting period of roughly 8 to 12 hours before it applies, and you will need evidence either way.
- Freeze risky changes. Microsoft froze its own deployments during this incident. You should do the same for payment changes and admin settings.
After service returns
- Search inboxes for messages that arrived hours late and flag anything with a deadline.
- Re-run or check any automation, sync or AI workflow that depended on Microsoft Graph or Exchange during the window.
- Re-send external meeting invites created during the outage; some may not have gone out.
- Read Microsoft’s post-incident report when it lands, and ask whether your Plan B would have shortened your downtime.
Should you diversify vendors?
For most small companies, running two full productivity suites is expensive and confusing. The better trade is selective redundancy: one independent channel for staff, one for customers, and one way to hold meetings. That costs close to nothing and covers most of what hurt teams this week.
The bigger shift is cultural. Cloud consolidation makes sense for cost and security, as we argued in why cloud infrastructure is critical for SaaS startup growth. But consolidation and concentration are the same thing seen from two sides. Infrastructure is becoming the constraint across tech, as the power story behind Google’s $17B Wyoming data center shows, and a single change deep inside one provider’s network can now pause thousands of businesses at once.
Our view: do the one-hour exercise on Monday, while this week is fresh. The next outage will not give you a day’s notice.
