A major Microsoft 365 outage has disrupted businesses worldwide, leaving users unable to access services including Outlook, Microsoft Teams and other Microsoft applications.
The disruption, which began on Thursday 12th November 2026, has continued into Friday, affecting organisations that rely on Microsoft's cloud services for everyday communications and business operations.
Microsoft has stated there is no indication that the outage was caused by a cyber attack. However, while organisations wait for services to return to normal, there is another security risk worth watching: cyber criminals exploiting the disruption to target employees with phishing emails, fake support messages and fraudulent login requests.
For UK businesses, understanding the difference between a genuine service outage and an opportunistic cyber attack is important.
Microsoft began experiencing widespread service disruption on Thursday 12th November 2026, with users reporting difficulties accessing several Microsoft 365 applications.
Affected services have included:
The impact has varied between users, organisations and regions, with some services remaining accessible while others have experienced prolonged disruption.
Microsoft has identified authentication and routing configuration issues within its infrastructure as part of its investigation.
In its service health updates, Microsoft reported that it had applied a configuration component patch and was observing improvements in server stability. Recovery work has involved restoring affected infrastructure and monitoring service availability.
However, the incident has not been declared fully resolved at the time of writing and Microsoft's investigation into the complete root cause remains ongoing.
Businesses can follow the latest information directly through the Microsoft Service Health portal.
No evidence currently indicates that the Microsoft 365 outage was caused by a cyber attack.
Microsoft has explicitly stated that it is not aware of malicious activity causing the incident.
The technical information released so far points towards infrastructure configuration and service availability problems, rather than ransomware, a security breach or another malicious intrusion.
This distinction matters. A major technology outage does not automatically mean a service provider has been compromised.
However, the absence of a cyber attack behind the original incident does not mean businesses can ignore the security risks that follow.
When a widely used platform experiences disruption, employees naturally look for answers.
They want to know when services will be restored, whether they need to sign in again and what they should do to regain access.
Cyber criminals can use that uncertainty to their advantage.
A major Microsoft outage provides a convincing scenario for phishing and social engineering attacks. Threat actors do not need to compromise Microsoft's infrastructure to exploit the situation. They can simply impersonate Microsoft, an internal IT department or a trusted support provider.
For example, an employee experiencing genuine Outlook problems might receive a message claiming:
"Microsoft 365 services have now been restored. Please re-authenticate your account to regain access."
The message could contain a link to a convincing but fraudulent Microsoft login page designed to steal credentials.
Other potential approaches include:
1. Fake Microsoft 365 Recovery Emails
Attackers may send emails claiming that Microsoft has restored services and employees must verify their accounts, reset their passwords or complete a security check.
These messages can use Microsoft branding, reference the real outage and create urgency to encourage employees to click malicious links.
2. Fraudulent IT Helpdesk Calls
An attacker could impersonate an internal IT technician or Microsoft support representative, claiming to be helping employees reconnect to Outlook or Teams.
They may ask users to disclose verification codes, approve authentication requests or install remote access software.
3. Fake Service Restoration Links
Employees searching online for outage updates may encounter misleading websites or messages directing them to unofficial recovery pages.
These pages could attempt to capture Microsoft 365 credentials or persuade users to download malicious software.
4. Unexpected Multi-Factor Authentication Requests
Attackers who have already obtained credentials may attempt to use the disruption as an excuse for unexpected multi-factor authentication (MFA) prompts.
An employee might be told that approving a notification is necessary to restore access to their account.
These are potential attack scenarios based on established phishing and social engineering techniques, not confirmation that they have been observed in connection with this specific outage.
The underlying risk is straightforward: when employees expect technical problems, unusual requests can appear more believable.
While Microsoft works to restore its services, businesses should remain alert to suspicious activity.
1. Warn employees about outage-related phishing
Remind staff that unexpected emails requesting password resets, account verification or service reactivation should be treated with caution.
Employees should access Microsoft 365 through their usual trusted applications or bookmarked websites rather than following unsolicited links.
2. Verify IT support requests
Any unexpected call or message claiming to be from Microsoft or an internal IT team should be independently verified through established support channels.
Employees should never share passwords, MFA codes or approve unfamiliar sign-in requests.
3. Monitor identity activity
Security teams should review Microsoft Entra ID sign-in activity where available, paying attention to suspicious authentication attempts, unusual locations, unexpected MFA requests and changes to privileged accounts.
Monitoring should continue as services recover, particularly where delayed or intermittent visibility may affect investigations.
4. Review suspicious messages as email services recover
Once Outlook and Exchange Online services return to normal, employees should remain cautious about messages received during or immediately after the disruption.
Security teams should review reported phishing emails and investigate any suspicious login or account recovery activity.
5. Check business continuity arrangements
If a single cloud service becomes unavailable, businesses need reliable ways to communicate, coordinate and continue essential operations.
Review alternative communication methods, incident response contacts and access to critical operational information.
This incident highlights two separate but equally important considerations for businesses: operational resilience and cyber security.
Even organisations with strong security controls can experience disruption when a critical third-party service becomes unavailable.
That makes business continuity planning essential.
At the same time, businesses must be prepared for the security risks that can arise around major incidents.
Phishing, identity compromise and social engineering do not stop because a service is experiencing technical difficulties. In some circumstances, the confusion surrounding an outage can make these attacks more convincing.
For security teams, the priority is to maintain visibility, investigate suspicious behaviour and respond quickly when genuine threats are identified.
At CybaVerse, we believe effective cyber security goes beyond detecting an alert.
Through CybaOps, our unified cyber security platform, we combine threat detection, investigation and response with the expertise of our UK-based Security Operations Centre.
Our Identity Threat Detection and Response (ITDR) capabilities help identify suspicious activity across Microsoft environments, including unusual sign-ins, potential account compromise and changes to privileged access.
Our cyber operators monitor threats 24/7, investigate suspicious behaviour and take appropriate response actions to help contain genuine security incidents.
While a platform such as CybaOps cannot prevent a Microsoft infrastructure outage, it can help organisations detect and respond to malicious activity targeting their own environment.
The message for UK businesses is simple: the Microsoft outage is not currently attributed to a cyber attack, but that does not mean cyber criminals will ignore the opportunity.
Stay informed, communicate clearly with employees and make sure suspicious activity does not go unnoticed.
For the latest service information, visit Microsoft Service Health.
Concerned about suspicious Microsoft 365 sign-in activity or identity threats? Speak to the CybaVerse team about strengthening your detection and response capabilities.