When the cloud goes down: the Microsoft 365 outage and what a business should take from it

At 18:17 Kyiv time on 12 November an outage began in Microsoft 365, and it is still going on as this piece is published. Mailboxes, calendars, Teams and SharePoint stopped opening. Companies around the world were hit, Ukrainian ones among them, because most corporate email here runs on Microsoft 365.

We felt it on our own mailbox and checked what exactly had broken. Below are the facts we verified ourselves, Microsoft's official position, and the main thing: what a business owner should take from it, whether or not they use Microsoft.

What exactly is not working

The first reaction to "the mail will not open" is always the same: it must be us, the password, the internet, the domain settings. So we began by checking our own side, and it gave a clear picture.

• Signing in to the account works. Microsoft recognises the user and grants access, so neither the password nor the permissions nor the access settings have anything to do with it.
• Requesting messages returns a server error - code 502. Not "no access", not "wrong password", but "the server could not answer".
• The calendar fails the same way - code 503. So it is not the mail alone but everything that sits in Exchange Online.
• The domain's mail records (MX) have not changed and still point at Microsoft. Mail is being sent where it should be.

The conclusion is simple: our side is intact, it is the service itself that is not answering. Anyone in doubt should run the same check - it takes a few minutes and settles half the questions.

The official timeline

Microsoft is tracking the outage under two numbers: EX1550543 - access to Exchange Online mailboxes, and MO1550821 - everything that depends on Exchange. A separate Teams failure (TM1550488) has already been closed. At first it was described as affecting America; later the wording changed to "may affect users in any region".

The times below are Kyiv time.

• 18:17, 12 November. Users cannot open their mailboxes. Microsoft reports that it is investigating a problem with mail access.
• 20:19. Increased load recorded in several regions at once.
• 21:18. Clarification: the load grew not because of an influx of traffic. Some servers suddenly became unavailable and the rest took over their work.
• 21:43. It emerges that the affected servers are failing the automatic health check, so the system itself is taking them out of service.
• 21:57. "We have not identified any recent change associated with the start of the failure."
• 00:00, 13 November. "The main process on the affected servers is becoming overloaded, which causes a loss of capacity."
• Overnight. Clarification: what is overloading is specifically the process responsible for establishing secure connections. In parallel Microsoft begins rolling back a recent network configuration changethat coincides in time with the start of the outage.
• 06:11. "We confirm: there is no indication that this is the result of malicious activity."
• 13:04. Recovery is complete in the Asia-Pacific region; traffic is being let through gradually and the work is being extended to other regions.

The cause: still not named

The most honest thing that can be said as this is published: there is no official cause. Microsoft's explanations changed over the course of a day - from "we see no recent change" to "we are rolling back a recent network configuration change that coincides with the start of the outage". The company promises a full analysis with the cause once recovery is complete.

What Microsoft states unambiguously is that this is not a cyberattack. That wording was used twice, a few hours apart.

The most interesting part of this story is not the cause but why the repair dragged on. Servers returned to service fell over again as soon as traffic was let onto them. Microsoft openly admitted that the changes were "not working as expected". What followed was work in circles: halting all updates and configuration changes, restarts, a workaround for the health check, rebuilding some servers on the previous configuration, adding capacity with virtual machines. Movement began only after a patch to the component responsible for authorisation and request routing.

What is happening to messages

This is the question that worries people most, so it gets its own section.

• Delivery is delayed - Microsoft admits as much in the outage description itself.
• The waiting window for a message has been extended to 48 hours. Normally a server that cannot deliver a message within a certain time returns it to the sender marked as failed. An extended window means messages will not bounce back but will wait in the queue.
• Microsoft has not reported any data loss. But let us be precise: it has not said outright that "nothing has been lost" either. What it literally said is that delayed messages are being retained.

The practical consequence: do not resend messages. They are sitting in the queue, and when the service lets go, the client will receive duplicates. Expect a flood - a day's worth will arrive at once.

What a business should do right now

1. Make sure the problem is not yours. If signing in works but the message will not open, it is the provider's side. The state of the outage is visible in the Microsoft 365 admin centre, under "Service health", by the numbers EX1550543 and MO1550821.
2. Do not touch your settings. During somebody else's outage the most damage is done by attempts to "fix" things at home: changed domain records, reinstalled mail programs, reset passwords. When the service comes back, you will be left untangling your own consequences.
3. Switch on a backup channel. Move urgent client matters to a messenger or the phone for the duration. Warn those waiting on you - a short "our mail is down, write to us on Telegram" beats silence.
4. Record the downtime. If the stoppage cost you money, write down the time and the consequences. Microsoft has service-level obligations; whether this outage gives grounds for compensation in your particular case is a question for your licence agreement and the partner the licences were bought through.

Four lessons for the future

An outage of this scale is rare, and concluding from it that "the cloud is bad" would be wrong: your own server in a back room goes down more often and takes longer to recover. The lessons are different.

1. A backup channel has to exist before the outage, not be invented during it. If all communication with clients runs through one provider's mail, its failure stops you completely. A Telegram bot, a corporate messenger, a phone - anything the clients know about in advance.
2. Do not put everything in one basket. Mail, documents, communication, authentication and security with a single supplier is convenient right up to the day something breaks at their end. Then everything stops at once. That is exactly what happened: Teams, SharePoint and Defender went down along with the mail.
3. What earns the money should be under your control. The website, the orders, the catalogue, the enquiries - keep them where you can check the state yourself, bring up a copy and answer the client without waiting for somebody else's report.
4. Learn to tell "ours" from "theirs". The simple check from the start of this article saves hours of panic and guards against needless changes to settings.

How it is arranged at our end

We use Microsoft 365 for mail and documents, and during this outage our mailbox would not open either. But what we do for clients was working and still is: websites on our own Smart CMS, chatbots, client portals and telephony live on our own servers, separate from the mail. Not one client site suffered from this outage.

That is exactly the spread of risk the lessons are about: office tools with a reliable outside supplier, and whatever sells and takes orders kept where we answer for it ourselves.

About the sources

We ran the checks on access, mail records and response codes ourselves. Microsoft's timeline and quotations are taken from its messages in the admin centre and on the service status page, as relayed by industry watchers and cross-checked against each other, because both of those sources are available only to a given customer's administrators. For every owner, the primary source is their own admin centre.

---

This material was prepared by the SmartGTteam. If you are not sure how much your business depends on a single supplier, or what would happen to your website on a day like this, write to us: center@uvc.in.net or +38 073 949 61 79. We will look at it together and tell you plainly what is worth spreading across different baskets.