Microsoft outage hits Australia's spy agency, federal police and governments worldwide

We are closing this live blog. The latest verified position is that Microsoft's recovery from the 12 to 13 November outage is well advanced but has not been declared complete. At about 14:00 UTC on Friday Microsoft said email queues were approaching normal levels, and its status page at 14:56 UTC reported sustained improvements, though some users could still see intermittent problems or delayed mail. Teams has been restored, per Microsoft.

What we know: the disruption began on Thursday 12 November and hit Outlook, Exchange Online, Teams, Copilot and other Microsoft 365 services in at least 74 countries. Governments, courts, police, health services, airlines and finance firms reported problems, including Australia's ASIO and Federal Police. Microsoft says it has no indication of a cyberattack. Its incident notes tie the start of the problem to a network configuration change that it rolled back, with an overwhelmed process on affected servers leaving many unavailable.

What we do not know: Microsoft has not confirmed a root cause or declared the incident resolved, and has not yet published its promised post-incident report. Its live status is on the Microsoft 365 service status page (incidents EX1550543 and MO1550821).

At about 14:00 UTC Microsoft said email queues were significantly reduced and approaching normal levels, though some users could still face intermittent access problems or delayed mail, PPC Land reported. Microsoft's status page, at its 14:56 UTC update, reported sustained improvements in service availability but had not declared the incident resolved. Power Apps has been added to the list of affected services, which now stands at 20.

Traffic data from network-analysis firm Kentik, cited in the same report, shows Exchange Online traffic running about 85% below expected from roughly 17:35 UTC on Thursday until recovery began at about 11:20 UTC on Friday. By 13:25 UTC it was about 19% above expected as queued mail caught up. The report adds that the European Commission, Council and Parliament reported little or no impact.

Microsoft has promised a post-incident report with the root cause and says it has no evidence of malicious activity.

In Australia, ABC's live blog reported that Canberra Health Services had email, voicemail and some fax services affected, though phone lines worked and clinical care was reported unaffected. The NSW virtual bail court could not access papers for overnight arrests, and Ergon Energy said field crews were unaffected but relied more on phone contact. ING warned customers about scammers exploiting the outage.

Services Australia said customer-facing services and payments were not affected, and AEMO reported no disruption to energy systems or markets. The Bureau of Meteorology said forecasts and warnings were unaffected, though customers may be unable to reach it by email, per the same report.

Microsoft's recovery updates, as relayed by ABC Australia's live blog, say traffic is being gradually restored in Asia-Pacific with mailbox access improving, and that Europe and Japan are also showing improvement. The US is improving, with some intermittent issues. In its latest update, at about 13:00 UTC, Microsoft reported "encouraging recovery signals" in Asia-Pacific including Australia, while warning that intermittent access problems may persist.

Microsoft has also extended its email timeout window to 48 hours to protect delayed messages. It has not declared the incident resolved and has not published its post-incident report.

Microsoft says its mitigation has restored Teams service health and functionality, and that email delivery is improving across a growing portion of the affected infrastructure, ABC News reported, citing Microsoft 365 Status. Microsoft says it is now focused on recovering the remaining affected environments and reducing the email queue and backlog, and some users may still see intermittent problems. It has given no timeline for a full return to normal.

New York City's Emergency Management Department warned of delays to email and online city services, per the same report.

Euronews's assessment is that the evidence points to an access problem rather than data theft, and that nothing Microsoft has said suggests customer data was exposed or lost. No group has claimed responsibility, Euronews reported. Microsoft says it is not aware of any malicious activity and has not named a root cause.

Euronews flags indirect risks: security monitoring may be weaker while Microsoft Defender XDR is affected, fraudsters may send fake "support" messages, and some emails may arrive late.

The outage has now lasted more than 15 hours, and as of The Register's 12:00 UTC update users were still unable to connect to several Microsoft 365 services, The Register reported. Services that do not depend on Exchange Online are still working, according to Microsoft.

Microsoft's later updates describe capacity improvements and partial recovery in some regions that did not last, with virtual machines stuck in a bad state blocking changes from syncing, per the same report. Microsoft says it is working to find the cause of the traffic influx and repair backend servers. It has not confirmed a root cause.

Microsoft's Microsoft 365 Status account says recovery actions are now complete across portions of the affected infrastructure and traffic is being gradually restored, with improvements in mailbox access and delayed email processing. It cautions that some intermittent issues may continue. An earlier post from the same account said service health remained variable and capacity had not yet fully returned to baseline.

Microsoft has not declared the incident resolved. Its live status is on the Microsoft 365 service status page (incidents EX1550543 and MO1550821).

Australian Home Affairs Minister Tony Burke said Microsoft believes it is dealing with "an update that has gone awry", likening it to the CrowdStrike outage of July 2024, SBS News reported. Burke said he had spoken to the National Cyber Security Coordinator and to the head of Microsoft Australia and New Zealand.

Microsoft has not confirmed a root cause, and says a full post-incident report will follow once the incident is mitigated. ASIO and the Australian Federal Police both confirmed they were affected, per SBS, which gave no further detail on how.

The UK's NHS said some patients may struggle to get medication and that staff email is down in several regions, though patient appointments should continue, The Independent reported. The National Pharmacy Association said the outage affects pharmacies' ability to communicate with GP practices and some patients, per the same report.

In Australia, SBS News reported that the ACT, Tasmanian and Western Australian governments, courts in South Australia and Victoria, and the Northern Territory's education department were among those affected. Charles Sturt University and Macquarie University had problems with multi-factor authentication.

NHS England staff fell back to paper records and other systems, and the GMB union said 111 and 999 staff could not refer patient details in the usual way, though emergency call-outs appeared unaffected, CX Today reported. This is one outlet's account and we have not yet seen it confirmed by NHS England.

In Australia, Service NSW reported that some service-centre and call-centre transactions were unavailable, per the same report. Triple Zero, Australia's emergency call service, said there would be no direct impact on its services.

Microsoft says recovery actions are complete on parts of the affected infrastructure and traffic is gradually returning, with improvements in mailbox access and delayed email processing. Some intermittent problems may continue while it restores the rest and adds capacity, according to its update as reported by Local 12. Microsoft has not declared the incident resolved, and its post-incident report is still to come.

Microsoft Dynamics 365 Contact Center, logged as incident CR1550885, was down for just under eight hours on Thursday evening, with agents unable to take calls or messages. Microsoft says agent access was restored at 00:57 GMT on Friday, CX Today reported. The same report says Microsoft told the Guardian recovery was complete in parts of Asia Pacific and was extending to other regions.

Air India, IndiGo and Akasa Air said their email support services were affected by the outage, but flight operations continued normally, according to International Business Times. Air India redirected customer messages through alternative systems.

In finance, Euronext had email problems affecting its listing teams, per the same report. In Taiwan, one financial company used fax machines to confirm trades after its email failed and another cancelled a bond repurchase transaction, attributed to Reuters. NBC News also lists Euronext, Aviva and Maersk among affected businesses.

Associated Press video on the wider impact: Watch on YouTube. NBC News also has a short video report.

Microsoft's incident notes tie the start of the disruption to a recent network configuration change, which it has rolled back, CIO reported. Microsoft says a process on affected servers that sets up secure connections became overwhelmed and stopped handling requests, leaving a large number of servers unavailable.

Microsoft has since restarted infrastructure, added capacity, limited some traffic and is reintroducing connections gradually while it checks stability. Some servers became unresponsive again as traffic returned, and overnight fixes did not work as expected. The outage began at 16:17 UTC on Thursday, per the same report.

No final root-cause report has been published. Microsoft's live status is on its Microsoft 365 service status page (incidents MO1550821 and EX1550543).

Microsoft says it has made further progress restoring service, with mailbox access and delayed email improving, though some users may still see intermittent problems, NBC News reported. Microsoft said it was "not aware of any malicious activity", and a full post-incident report is promised later. The outage has now lasted more than 12 hours, according to The Next Web.

The disruption has reached governments, police forces and businesses across several countries. Japan's government moved to paper-based processes after ministries struggled to send email, The Next Web reported, and Microsoft's connector problems also affected AI tools including ChatGPT and Claude.

Video from the Associated Press:

Watch on YouTube

Microsoft says there is no indication the outage was a cyberattack. Australian Home Affairs Minister Tony Burke said Microsoft told him the same. Microsoft has attributed the problem to elevated load on its infrastructure caused by a number of servers becoming unexpectedly unavailable, Cybernews reported. It says it has paused deployments, moved traffic off affected infrastructure and is restarting servers.

Australia's domestic spy agency ASIO and the Australian Federal Police have confirmed they were affected by the global Microsoft outage. ASIO director-general Mike Burgess and AFP Commissioner Krissy Barrett said so at a news conference, according to Reuters. Neither said which systems were hit or how their work was affected.