Business users across the world have lost access to email, chat and Microsoft's Copilot assistant after a failure inside Microsoft's business cloud.
The trouble started shortly after noon Eastern time on November 12. Users couldn't open Outlook mailboxes or sign in to Microsoft 365 apps, and for a time Microsoft's own status page wouldn't load. Reports of Outlook problems on Downdetector passed 130,000 at around 1:15 p.m. ET, and Microsoft 365 as a whole drew more than 48,000, according to The Washington Times. Downdetector counts user-submitted reports, not the number of people affected.
Microsoft first acknowledged problems reaching Exchange Online mailboxes in the Americas at 12:54 p.m. ET, and later said users in any region could be affected. Its service health alert named Exchange Online, Teams, SharePoint Online, Copilot for Microsoft 365 and Defender XDR as potentially affected.
Public agencies were hit too. The Massachusetts state government said its email and other Microsoft services were unavailable, WGBH reported. Anthropic and OpenAI both said their AI tools could no longer connect to Microsoft 365, according to CNET.
Read next: When someone else’s outage becomes your claim
Microsoft points to failing servers
Microsoft said the problem was not a surge in traffic. A large number of servers had gone offline unexpectedly, shifting their load onto the rest of the system. The company froze deployments and configuration changes, moved traffic to other infrastructure and began restarting servers that were failing automated health checks while it tested a configuration fix, its Microsoft 365 Status account said on X. "We're aggressively pursuing all pathways to reduce impact," the account posted.
As of publication, Microsoft had not published a root cause or said when service was fully restored. It has directed administrators to incidents EX1550543 and MO1550821 in the Microsoft 365 admin center, or to its public cloud status page if the admin center won't load.
This is Microsoft's second major Microsoft 365 outage of 2026. In January, a failure that took down Outlook, Defender and Purview lasted almost 10 hours, The Register reported.
No attack, but possibly a claim
No attacker appears to have been involved, and that makes the coverage question harder. A growing share of large cyber losses now comes from faulty updates, configuration errors and infrastructure failures at a vendor. At Allianz Commercial, contingent business interruption (losses caused by a supplier, cloud host or IT vendor) accounted for about 15% of the value of cyber claims above €1 million in the first half of 2025, up from 6% in 2024.
Two policy terms will largely decide whether this outage produces claims. The first is the waiting period. Cyber BI cover usually starts only after eight to 12 hours of downtime, so an outage lasting a few hours may never reach it for most insureds. The second is wording: whether system failure cover applies when the failure happens at a third-party provider, and whether dependent BI language includes software-as-a-service vendors or only named cloud hosts. Brokers have been raising this at renewal, putting a spotlight on contingent business interruption coverage.
Past outages show how far apart economic and insured losses can be. Parametrix estimated that the faulty CrowdStrike update in July 2024 cost Fortune 500 companies about $5.4 billion, of which only $540 million to $1.08 billion was likely insured. For the October 2025 AWS outage, CyberCube estimated insured losses between $38 million and $581 million, and Moody's put its mean estimate at $22 million. Short durations, vendor credits and waiting periods kept claims low, and most of the cost stayed with the businesses affected.
Read next: Amazon Web Services outage losses could reach $581M: CyberCube
Some insurers are designing cover for outages too short to reach a standard waiting period. In August, AIG launched a parametric cloud outage endorsement with Parametrix for eligible US cyber clients. It has a two-hour waiting period and no retention after that. In the capital markets, Hannover Re's $35 million Cumulus Re III cat bond pays out on sustained downtime at AWS, Microsoft Azure or Google Cloud in designated US and EU regions.
It is not clear whether Thursday's failure would trigger either product. The outage hit Microsoft 365, a software service, rather than Azure's underlying cloud capacity, and each product's triggers depend on which services and regions it monitors.
Other providers have had similar failures. In October, a power failure in one Google Cloud zone knocked UK banks, retailers and public services offline at the same time.
Read next: Parametrix issues largest Cumulus Re cat bond for cloud risks
Brokers can start by asking affected clients to record what happened: when the disruption began and ended for them, how many staff hours were lost, and which transactions failed or were delayed. Allianz's claims team says this evidence is often overlooked during an incident, even though business interruption is usually the largest part of a cyber claim. "Business interruption remains the single biggest financial loss driver for cyber," Caitlin Ewing, a complex cyber claims analyst at Allianz Commercial, said in October.
The next step is a review of wordings and waiting periods. Brokers should check whether each client's policy responds to a non-malicious failure at a SaaS provider, and whether a shorter waiting period or a parametric layer would have made a difference this week. Clients may be receptive: in the Allianz Risk Barometer 2026, US respondents ranked cyber their top risk at 40% and business interruption second at 37%, according to the survey's US results.
Continuity plans need a look as well. A plan that switches staff to Teams when Outlook fails offers no backup when both run on the same Microsoft infrastructure.
Read next: CrowdStrike: Why did insurers get off quite lightly?
This story may be updated as Microsoft releases more details on the cause and duration of the outage.
