Outlook is recovering on day two, and Microsoft says it has no indication of a hack

Microsoft's first explanation for Thursday's Outlook outage, in the updates CNBC summarised on Nov. 12, was that a number of servers had become unexpectedly unavailable and that the rest were straining under elevated load across multiple regions. By Friday morning the company had moved on to talking about recovery, though it had not declared the service fixed, and ABC News reports that some users were still having intermittent problems with mail. Microsoft also says it has no indication that malicious or cyber activity caused the outage. None of the company's reported statements, from Thursday's first notices to Friday morning's recovery updates, gives a time for full service to return.

Microsoft's Friday morning updates, as CNBC reports them, describe a recovery that is uneven by region. The company pointed to "broader improvements" in some regions, while CNBC's report calls the recovery in Asia Pacific early and uses the phrase "encouraging recovery signals" for it, a form of words that stops some way short of saying the region is back. The reporting does not say which customers in which regions now have normal service, and the wording on Microsoft's own status page for Friday was not available at the time of writing.

Thursday's sequence is only partly pinned down. In statements carried by ABC News, Microsoft said it had restarted servers and that "We've paused all deployments", meaning it had stopped rolling out changes to the service while it dealt with the fault, and it apologised: "We regret that today's outages caused disruptions for our customers, and we are working to address the issue." The timing of the pause and the restarts is unknown, which leaves their place in the day open. Around 4 p.m. ET, CNBC reports, Microsoft said it had "validated an alternative service health check method", a different way of deciding whether a server is fit to take traffic, and that the change had brought some servers back into service. A later update quoted by ABC spoke of "encouraging recovery progress, with service availability and email delivery performance improving".

Timeline drawn from CNBC and ABC News reports of Microsoft's updates.

Outlook on the web and on the desktop, Teams, SharePoint and Copilot are all on CNBC's summary of affected services, along with connected services such as Outlook Calendar, and New York City agency email was caught up as well, ABC reports. How many city agencies were involved is unknown. The same goes for which Microsoft 365 services kept working normally throughout. The number of people affected is also unknown, since Microsoft has given no figure in any of its reported statements, and live coverage has filled the gap with a TechRadar live blog headline reading "Outlook and Teams still down for millions as global disruption continues". The TechRadar page was not available beyond that headline at the time of writing, and where its "millions" comes from is unknown.

Microsoft's answer to the hack question is consistent across the outlets that carried it. Charles Lamanna, an executive vice president, said in ABC's report that "there is no indication this is the result of malicious or cyber activity", and the company "has not detected any malicious activity causing the outage", in CNBC's wording. Both describe what Microsoft has found so far: one speaks of indication and the other of detection, and neither amounts to a finding that rules an attack out. Microsoft has not given a root cause either. Its only public account of what went wrong is that a number of servers became unexpectedly unavailable and the load on the rest went up, which describes the failure without explaining it. Why the servers went down, why it took an alternative health check method to bring some of them back, and whether the deployments it paused played any part were all unknown as of Friday morning, and Microsoft has not said when it will publish a fuller account.

Microsoft's reported statements contain no workaround for people who simply need their mail. The company extended the retry window for delayed emails to 48 hours, CNBC reports in a paraphrase, and Microsoft's own wording on the change was not available at the time of writing. How much mail is sitting in that queue is unknown, and what happens to messages held up longer than 48 hours has not been reported. Whether switching between the web version of Outlook and the desktop app gets mail moving is unverified, and CNBC's summary lists both as affected; how the mobile apps have fared is unknown. The plainest advice reported so far came from a city government: New York City Emergency Management told residents to use other ways of reaching city agencies while agency email was disrupted, ABC reports, with 311 for non-emergency matters and 911 for emergencies.

The stock market's reaction is known only in outline. MarketWatch's headline, as it appears in the article's web address, says Microsoft stock slumped on an outage that includes Copilot, the AI assistant Microsoft builds into Outlook, Teams and the rest of Microsoft 365. The MarketWatch article was not available beyond its headline at the time of writing, so the size of the fall and the closing price are unknown. Copilot has been on CNBC's list of affected services since Thursday. Microsoft has given delayed emails 48 hours to find their way through, and it has yet to give itself a date for declaring the outage over, or for saying what its servers were doing when they went unavailable.