By Friday afternoon, Microsoft’s patch was working and email was flowing again. The outage hadn’t been declared resolved, and the root cause wasn’t confirmed. Here is what changed, and what it meant for your business over the weekend.
This is a follow-up to our original advisory.
- Recovery: a Microsoft patch to an authentication/routing component restored service gradually on Friday 13 November.
- Email: delayed messages had a 48-hour retry window, so they should arrive late rather than bounce.
- Your data: there is no sign of data loss or a breach.
- Stay alert: outage-themed scams are circulating. Confirm any banking change by phone.
Five things that changed on Friday
A patch is working
Microsoft reported “positive results” after patching an upstream authentication/routing configuration component.
Recovery is deliberately slow
Traffic was reintroduced carefully so recovered servers wouldn’t be flooded again.
Email is coming back
Mailbox access and delayed email processing improved; some intermittent issues continued.
No root cause yet
Microsoft promised a Post-Incident Report with the root cause and “defense-in-depth” repairs.
Wider impact than first known
Australian intelligence and federal police, UK public services and Windows 365 Cloud PCs were affected.
“We are seeing early signs of stabilization, but service capacity has not yet returned to normal levels and health remains variable as traffic is carefully reintroduced.”Microsoft 365 status update, Friday 13 November02 · Analysis
What the patch tells us about the cause
Our professional assessment. Microsoft’s Post-Incident Report will be the final word.
Every Outlook or Teams connection passes through layers: first an authentication and routing layer, then a secure (encrypted) connection, and only then your mailbox. Microsoft’s fixes pointed at the first two layers, not at the mailbox servers or your data.
That matters for two reasons. There is no sign that mailbox data was lost or exposed. And it fits the pattern behind many recent cloud outages: a change in a shared, central component that every user depends on.
Our post-outage Microsoft 365 security review checks sign-ins, inbox rules and MFA changes since 12 November.
What to do now
- Don’t declare victory yetKeep your backup channel until MO1550821 and EX1550543 are marked resolved.
- Tell clients: delayed, not lostMail sent since Thursday should arrive late. Ask clients to resend only if it hasn’t arrived by Saturday evening.
- Watch for a flood of old mailCheck payment instructions, tenders and deadlines. Confirm banking changes by phone.
- Stay alert to scamsFake “password reset” and “restore your mailbox” emails are circulating.
- Record the impactHours lost and workarounds, for insurance, service credits and your own review.
- Book a short review next weekUse Microsoft’s report to test your plan: what if this had lasted three days?
Talk to your clients before they talk about you
The businesses that came out of this best told clients early: “Our email is delayed because of the global Microsoft outage. Nothing is lost, and here’s how to reach us meanwhile.”
A short, calm message protects trust far more than silence does.
The bigger lesson still stands
No single provider should be the single point of failure for your email, your data and your security at the same time. Independent Microsoft 365 backup, monitoring that doesn’t depend on the platform it protects, and a written “cloud is down” playbook are what separate an inconvenient day from a costly one.
Managed security and SOC services, independent Microsoft 365 backup and business continuity planning, built for South African businesses.
Sources: Microsoft 365 Status updates (incidents MO1550821, EX1550543); NBC News; CNN; TechRadar; SecurityWeek; ABC News; WindowsForum. Originally published at about 14:00 SAST on 13 November 2026. General guidance only.
