Microsoft blames server checks for global Microsoft 365 outage

By Rebecca Stone

Microsoft extended its email timeout to 48 hours early Friday morning as a global Microsoft 365 outage continued to affect email, cloud and AI services. The disruption began at midday Thursday.

What does Microsoft say caused the outage?

Microsoft blamed failed server health checks for the incident. The company did not attribute the disruption to hackers in its public account. On its status page, Microsoft said: “we have no evidence of malicious activity associated with this incident.” The statement distinguishes a failed server check from a confirmed intrusion, although Microsoft reserved the final technical explanation for a later report.

Microsoft also promised to “share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete.” The promised report would cover both the cause of the failure and the changes intended to reduce the chance or impact of a repeat.

The Microsoft 365 Status account wrote on X: “Recovery actions are ongoing.” It added: “To help preserve delayed mail during this event, we’ve extended email timeout to 48 hours.” Microsoft made the change early Friday morning to protect customers worldwide from losing email during the extended disruption.

Microsoft separately said on X: “We’re aggressively pursuing all pathways to reduce impact.” NBC News reported that Microsoft's public statements showed the company was blindsided by the outage and struggled for hours to find mitigations that could reliably restore user access.

The immediate stakes extended beyond customers' inboxes. NBC News reported disruption in businesses, hospitals, police departments and schools, placing routine work and public services under pressure during the outage.

How far did the disruption reach?

Microsoft has not disclosed how many users or organizations were affected. Its January estimate put the total number of paid Microsoft 365 commercial subscriptions above 450 million. That figure describes Microsoft's commercial base; it is not a count of affected customers.

• NBC News reported that “few public bodies were immune from the outage.” Businesses, hospitals, police departments and schools were among the organizations scrambling to work around the loss of service.
• In Japan, the outage disrupted government IT infrastructure, Deputy Chief Cabinet Secretary Masanao Ozaki said.
• Some doctors could not send patients “important” updates about medication changes or follow-up care, NBC News reported.
• People were blocked from making bank transfers because they could not receive verification codes, according to NBC News.
• The Supreme Court in the Philippines saw its legal work derailed, NBC News reported.
• One sheriff's office in Colorado said the outage made it difficult for people to post bond for prisoners' immediate release, according to NBC News.

NBC News documented failures across communications, health care, finance and justice. The consequences included delayed medication guidance, blocked transfers, stalled court work and difficulty processing bond for immediate release.

The disruption therefore reached institutions that rely on Microsoft systems for routine operational tasks. Government IT infrastructure failed in Japan, health workers lost a channel for patient updates, banks could not complete verification-dependent transfers, and courts faced an inability to carry out legal work.

The scale matters because Microsoft 365 serves a commercial subscription base that Microsoft estimated at more than 450 million accounts in January. The outage also reached government offices and public services, making availability a concern for users far beyond the company's direct enterprise relationships.

Why did restoration take hours?

Microsoft's public account describes a prolonged mitigation effort rather than an immediate return to normal service. The outage started Thursday at midday and remained ongoing Friday morning. During that period, Microsoft said it was pursuing every available route to reduce the incident's effects.

The 48-hour email timeout did not signal a full restoration. Microsoft described it as a measure to preserve delayed mail while recovery actions continued. The setting gave the company more time to restore access without discarding email that had accumulated during the disruption.

Microsoft's statement that it had “no evidence of malicious activity” answered the first question about attribution, but it did not settle the technical cause. The unresolved questions were why the server health checks failed and why mitigation took hours to restore access reliably.

The report promised after mitigation will carry evidence about Microsoft's own controls. Microsoft said it would include the root cause and defense-in-depth actions. That commitment puts the company's detection and mitigation performance under scrutiny after the company described the disruption as blindsiding.

For customers, the most immediate measure was a mail-preservation setting, not a promise of restored service across the suite. Microsoft's status page documented the full list of affected services. The statement on X confirmed that recovery work continued as the 48-hour timeout took effect.

How does it compare with other major outages?

Ciaran Martin, former head of the UK's National Cyber Security Centre, called the disruption “one of the biggest outages of all time” in an interview with NBC News. He suggested it might be even “worse,” a broader assessment of the disruption than Microsoft had made in its public recovery updates.

NBC News placed the Microsoft failure alongside recent outages of Amazon Web Services and CrowdStrike. The comparison focused on the reach of widely used technology infrastructure; the Microsoft incident also disrupted government, health care, financial and court systems.

Martin's description gives the outage a scale beyond the initial technical account. Microsoft discussed failed checks, mitigation work and email preservation. Martin assessed the wider result for essential services and compared it with other major technology failures.

What remains unresolved?

The first open question is scope. Microsoft has not published an affected-user count, and the figure of more than 450 million paid commercial subscriptions remains a measure of the service's reach rather than confirmed outage impact.

The second is causation. Microsoft says it has no evidence of malicious activity, but has yet to publish the promised root-cause report. The technical details of the failed health checks and the delay in reliable mitigation remain outside its public account.

The third is prevention. Microsoft has said only that its Post-Incident Report will include defense-in-depth actions. It has not yet specified those actions, so the report will determine whether its checks and recovery process change after the event.

For public institutions, the practical test is not only whether Microsoft restores service, but whether the promised safeguards address the failure mode that reached hospitals, schools, police departments and courts. Until that report appears, the company's attribution remains provisional.

The next milestone is Microsoft's promised Post-Incident Report, which must connect the failed health checks to hours of mitigation and set out the defense-in-depth changes intended to reduce a repeat.