{"id":4228,"date":"2026-11-13T06:49:20","date_gmt":"2026-11-13T14:49:20","guid":{"rendered":"https:\/\/cyber.mag212.com\/microsoft-365-outage-day-two-ex1550543-exchange-online-13-november-2026\/"},"modified":"2026-11-13T06:49:20","modified_gmt":"2026-11-13T14:49:20","slug":"microsoft-365-outage-day-two-ex1550543-exchange-online-13-november-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/microsoft-365-outage-day-two-ex1550543-exchange-online-13-november-2026\/","title":{"rendered":"Deuxi\u00e8me jour de panne de Microsoft 365\u00a0: ce que Microsoft a dit, ce qu\u2019il n\u2019a pas dit et ce que les \u00e9quipes informatiques doivent faire"},"content":{"rendered":"\n

On Friday morning, Microsoft\u2019s public status page still showed Microsoft 365 business and consumer services as degraded, more than a day after Outlook and Exchange Online problems began. Microsoft has frozen changes, rolled back a recent network update and added capacity, and it says it has found no malicious activity. What it has not done is name a root cause. This article updates our 12 November coverage with what changed overnight and what to do while the incident remains open.<\/p>\n\n\n\n

Incidents<\/strong><\/td>EX1550543 (Exchange Online) \u00b7 MO1550821 (dependent services)<\/td><\/tr>
Status 14:00 UTC Fri<\/strong><\/td>Service degradation, business and consumer<\/td><\/tr>
Cause<\/strong><\/td>Not confirmed; secure-connection process overloaded<\/td><\/tr>
Next<\/strong><\/td>Post-incident report promised after mitigation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What changed since yesterday<\/h2>\n\n\n\n

[Confirmed]<\/strong> At 14:00 UTC on Friday (6 a.m. Pacific), Microsoft’s public status page still listed Microsoft 365 business and enterprise services as degraded, with “Users may be unable to connect to multiple Microsoft 365 services”, and consumer products also degraded. (Microsoft status<\/a>) [Reported]<\/strong> Both incidents remain open. Microsoft says features that depend on Exchange Online are impacted while the rest keep working, has found no malicious activity, and will publish a post-incident report with root cause after mitigation. (SecurityWeek<\/a>)<\/p>\n\n\n\n

[Reported]<\/strong> Overnight, Microsoft described a process on the affected servers “that sets up secure connections” becoming overwhelmed, after which the servers stop handling requests. It paused all deployments and configuration changes around 19:06 UTC Thursday, began reverting a recent network change whose timing lines up with the outage, and at 04:57 UTC scaled up virtual machines to absorb a traffic surge. Servers returned to service around midnight UTC failed again under load. Microsoft has not said the network change caused the outage. (LazyAdmin<\/a>) (SOCRadar<\/a>) (WindowsForum<\/a>)<\/p>\n\n\n\n

\"Timeline:
Figure 4 \u00b7 Microsoft 365 outage, day two.<\/strong> Key moments reported by Microsoft and secondary outlets, UTC. Root cause is not confirmed. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

What to do now<\/h2>\n\n\n\n

Track the incident when the admin center won’t load<\/h3>\n\n\n\n

OS: Windows \/ macOS \/ Linux \u00b7 Shell: PowerShell 7 + Microsoft Graph SDK \u00b7 Privileges: ServiceHealth.Read.All \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

Connect-MgGraph -Scopes 'ServiceHealth.Read.All'\nGet-MgServiceAnnouncementIssue -ServiceHealthIssueId 'EX1550543' |\n  Select-Object Id, Status, Classification, LastModifiedDateTime, Title\nGet-MgServiceAnnouncementIssue -ServiceHealthIssueId 'MO1550821' |\n  Select-Object Id, Status, LastModifiedDateTime<\/code><\/pre>\n\n\n\n
Shows Microsoft’s own status and last update time for your tenant. Sign-in may itself fail during the outage; use the public status page if so. Commands not tested by MAG212 CYBER.<\/strong><\/p>\n\n\n\n
    \n
  1. Users:<\/strong> don’t reset passwords or reinstall Outlook. Mail sent to you is normally delivered once service returns.<\/li>\n\n\n
  2. IT:<\/strong> freeze changes to MFA, Conditional Access and mail flow; send one status note a day; keep an out-of-band channel for urgent work.<\/li>\n\n\n
  3. [MAG212 analysis]<\/strong> Security teams:<\/strong> Defender XDR and Purview were on the affected list, so check for alert backlogs once service returns, and warn staff about outage-themed “re-verify your account” phishing.<\/li>\n\n\n
  4. Afterwards:<\/strong> read the post-incident report, check whether the outage qualifies for SLA service credits, and log your business impact.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> both incidents show as resolved, mail queues drain, and Teams calendars and SharePoint search behave normally. (Our 12 Nov coverage<\/a>)<\/p>\n\n\n\n
    Reading the signals<\/h2>\n\n\n\n
    [MAG212 analysis]<\/strong> Microsoft\u2019s own updates describe a component that sets up secure connections becoming overwhelmed. Servers returned to service fell over again under load, which is typical of a recovery where pent-up demand from millions of clients arrives at once. Scaling up capacity, as Microsoft did overnight, addresses that symptom. Whether the reverted network change was the trigger is still unconfirmed, and we have not treated it as the cause.<\/p>\n\n\n\n
    [MAG212 analysis]<\/strong> Multi-day cloud outages are rare but not unprecedented, and they expose plans that assume email is always available. Password resets, MFA enrolment, incident notifications and supplier communications often all run through the same mailbox. This is a good moment to write down which of those you could do without Exchange Online.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    Exchange Online underpins email, calendars and many Teams, SharePoint and security features for hundreds of millions of users. A second day of disruption affects business operations, but it also creates security risk: alert pipelines in Defender and Purview may lag, and attackers reliably send outage-themed phishing that asks users to \u201cre-verify\u201d their accounts.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    Track EX1550543 and MO1550821 on Microsoft\u2019s status page or through Graph, freeze identity and mail-flow changes until both are resolved, warn staff about outage-themed phishing, and review security alert backlogs once service returns. When Microsoft publishes its post-incident report, check it against your own impact and any SLA credit you may be owed.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 13 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    Microsoft 365 et Exchange Online \u00e9taient toujours d\u00e9grad\u00e9s le 13 novembre, soit le lendemain du d\u00e9but de la panne. Microsoft a suspendu les d\u00e9ploiements, annul\u00e9 une modification du r\u00e9seau, augment\u00e9 la capacit\u00e9 des serveurs et n'a d\u00e9tect\u00e9 aucune trace d'attaque, mais n'a pas encore confirm\u00e9 la cause premi\u00e8re. Chronologie, identifiants d'incident et mesures \u00e0 prendre pour les utilisateurs, les \u00e9quipes informatiques et de s\u00e9curit\u00e9.<\/p>","protected":false},"author":1,"featured_media":4226,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[350,340,67,341,302],"class_list":["post-4228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","tag-business-continuity","tag-exchange-online","tag-microsoft-365","tag-outage","tag-outlook"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4228"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4226"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}