Microsoft 365 outage spreads from Outlook and Teams to Copilot, Defender and Intune
Microsoft's cloud outage began on Thursday as a disruption to Outlook email and Teams video conferencing, then widened into a broader failure of its cloud services for consumer and business email, files and documents.
The incident was first flagged as affecting services in the United States and the Americas before spreading globally. The affected services extended beyond core productivity. Copilot AI tools went down, and so did Defender, the security screening software. System administrators could not reach Intune dashboards or features, which is Microsoft's console for managing company laptops, phones and other endpoints, so they could not manage devices during the event. Some users also had trouble accessing cloud-based Windows computers.
Microsoft attributed the disruption to "a large number of servers being unexpectedly unavailable" and said it continues to investigate the root cause. The company has not, in the material published so far, described what caused those servers to become unavailable.
Microsoft's public status page lists Microsoft 365 for Business or Enterprise as experiencing service degradation, and lists consumer products as degraded as well. The page reports that users may be unable to connect to multiple Microsoft 365 services. Microsoft said it posted incident information on that public page because Microsoft 365 administrators may be unable to reach the admin center, where Service health information normally appears.
In my view, that detail deserves more attention than its place in the update suggests. The channel administrators would normally use to check incident state depended on the same platform that was failing, so the public status page became the fallback for information that operators would ordinarily find inside their own tenant, meaning the isolated section of the service their organization controls. Organizations that treat the admin center as their authoritative incident feed would have needed a second route to the same facts, and the outage shows why that route matters.
By Friday morning on the U.S. East Coast, Outlook had begun to recover. Doug Madory, director of internet analysis at Kentik, reported traffic returning to Microsoft services after about 18 hours of downtime. Madory's measurements describe the network-level picture.
In a status update on Friday, Microsoft said there was "no evidence of malicious activity associated with this incident." The company has not, at the time of this report, released a root-cause analysis.
The broader context here is the concentration of identity, email, collaboration, endpoint management and security screening within a single provider's cloud. When one of those layers fails, the dependencies that tie them together become visible to every customer at once. Copilot, Defender and Intune are not peripheral features in many enterprise estates, and an outage that reaches all of them changes the calculus for incident response, which is harder to run when the tools used to run it are also down.
The recovery timeline is also worth noting for operators. Service restoration arrived within roughly a day of the first reports, and the services that returned first were the ones that had been most visible to users. For teams that rely on Microsoft 365 for mail, documents and device management, the practical questions now concern which fallback channels, offline procedures and admin-access paths held up under pressure, and which did not. Microsoft's root-cause findings, when published, will determine how much of that picture changes.
