{"slug": "microsofts-health-checks-killed-the-patient-inside-the-november-outage", "title": "Microsoft’s Health Checks Killed the Patient: Inside the November Outage", "summary": "Microsoft's Exchange Online began rejecting connections at 16:17 UTC on November 12, an incident logged as EX1550543, with outage trackers recording reports from 74 countries within roughly an hour and Downdetector logging nearly 130,000 US reports for Outlook alone, the Boston Globe reported. Microsoft attributed the failure to automated health checks pulling servers whose secure-connection process was overloaded, causing remaining servers to absorb traffic and cascade, with Teams, SharePoint, Copilot and Defender XDR failing in the same window under ticket MO1550821. Microsoft's account shifted from saying no recent change matched the outage to describing a rollback of a network configuration change, two days after its November 10 Patch Tuesday fixed 1,094 vulnerabilities including an actively exploited Outlook zero-day, though Microsoft has drawn no public link between the patch and the outage.", "body_md": "Microsoft’s email backend, Exchange Online, began rejecting connections at 16:17 UTC on November 12 — 8:17 a.m. Pacific — in an incident Microsoft’s own status page logged as EX1550543. Within roughly an hour, outage trackers were recording reports from 74 countries, as [Al Jazeera reported](https://aljazeera.com/news/2026/11/13/microsoft-hit-by-global-outages-what-happened-and-why). By early Thursday afternoon, Downdetector had logged nearly 130,000 US reports for Outlook alone, [the Boston Globe reported](https://bostonglobe.com/2026/11/12/business/microsoft-outlook-outage/), with global reports approaching 140,000 against a base Microsoft says is 430 million Microsoft 365 users. Teams, SharePoint, Copilot and the security product Defender XDR failed in the same window, logged under a second ticket, MO1550821.\n\n## Health checks kill the patient\n\nA health check is a small, periodic request a load balancer or orchestrator sends to a server to decide whether that server is fit to receive traffic. Fail enough checks and the orchestrator pulls the server from rotation — the mechanism exists precisely so one bad machine can’t poison requests for everyone else. Microsoft’s own account, relayed across a string of status updates [tracked by Ars Technica](https://arstechnica.com/tech-policy/2026/11/microsoft-blames-failed-server-health-checks-not-hackers-for-global-outage/), is that a core process on its servers — the one that negotiates secure connections — started getting overwhelmed. Overwhelmed processes respond slowly, so the health checks correctly flagged those servers as unhealthy and the orchestration layer correctly pulled them. The remaining servers then absorbed the orphaned traffic, which overwhelmed their own secure-connection process in turn. That’s a capacity-loss spiral: each server pulled from rotation makes the next pull more likely, and the safety mechanism becomes the failure mode.\n\n**How a health check became an outage** The cascade Microsoft described in its status-page updates\n\n| From | To | How | \n|---|---|---|\n| Network/config change applied | Secure-connection process overloaded |  | \n| Secure-connection process overloaded | Automated health check fails |  | \n| Automated health check fails | Server pulled from traffic rotation |  | \n| Server pulled from traffic rotation | Remaining servers absorb extra load |  | \n| Remaining servers absorb extra load | Secure-connection process overloaded | cascades | \n| Server pulled from traffic rotation | Outlook, Teams, Copilot unreachable |  | \n\nBased on [Microsoft status-page updates, as compiled by Ars Technica](https://arstechnica.com/tech-policy/2026/11/microsoft-blames-failed-server-health-checks-not-hackers-for-global-outage/)\n\nMicrosoft’s account of why the secure-connection process overloaded in the first place has moved under questioning. Early status updates said the company had found no recent change lining up with when the trouble started; later updates described rolling back a network configuration change — a shift, in [reporting from Windows Forum](https://windowsforum.com/news/microsoft-365-outage-server-health-checks-network-rollback-and-an-unconfirmed-root-cause.452150/), from ‘no matching change exists’ to ‘we are undoing a change and watching whether it helps.’ The timing raises a question Microsoft has not addressed: its November Patch Tuesday, released November 10, fixed 1,094 vulnerabilities, including an actively exploited Outlook zero-day that let attackers steal hashed NTLM credentials, [CSO Online reported](https://www.csoonline.com/article/4247015/november-2026-patch-tuesday-63-critical-microsoft-fixes-plus-an-outlook-zero-day-that-allows-theft-of-hashed-credentials.html). Two days later, Outlook’s own backend fell over. Microsoft has drawn no public line between the patch and the outage, and nothing in its status updates does either — but a company that shipped the year’s second-largest monthly patch batch and then watched the exact product in that patch collapse 48 hours later owes more than ‘no indication of malicious or cyber activity,’ which is what executive vice-president Charles Lamanna offered, [as SecurityWeek reported](https://www.securityweek.com/microsoft-365-outage-disrupts-outlook-exchange-online-and-teams/). Microsoft has promised a full Post-Incident Report with root cause ‘after mitigation is complete’ — not published as of Friday.\n\n## Who lost email\n\nThe failure mode was mundane — lost email and chat, not lost flight control or lost patient records — but the client list was not. State and local government offices, hospitals, colleges and two utilities in New Mexico reported disruption, and the California cities of Pasadena, Fremont, Burbank and Santa Barbara warned residents their email was down, [Yahoo News Canada reported](https://ca.news.yahoo.com/governments-courts-trains-hospitals-hit-144549869.html). Courts from Los Angeles to Texas to Alberta posted notices that filings and replies could be delayed, and the Los Angeles County Medical Examiner’s Office lost email access. Outside North America, Japan’s government said its shared IT platform was disrupted, the Philippine Supreme Court and Singapore’s courts warned of delays, and Australia’s domestic spy agency and federal police were among the organisations affected. US law-enforcement agencies reported trouble processing bail payments.\n\nHealthcare providers mostly lost administrative systems, not clinical ones, but the strain showed anyway: Toronto’s St. Michael’s Hospital declared a ‘code grey’ — the alert hospitals use for a critical-infrastructure failure — and the Hospital for Sick Children told patients and doctors they might not reach each other by email or phone. The UK’s National Health Service cancelled some operations and reported possible problems issuing electronic prescriptions. England’s exams regulator Ofqual, the school-leaders’ union ASCL and the Department for Education all reported major disruption, and UK defence minister Luke Pollard called for [greater resilience](https://rews.cc/a/don-t-turn-off-the-internet-but-maybe-know-where-the-switch--0f48af) against this kind of failure.\n\nOn the corporate side, the drugmaker Eli Lilly, which runs Microsoft 365 for roughly 40,000 employees, was affected, and NBC News reported that OpenAI and Anthropic both hit problems through Microsoft connectors. Microsoft’s stock fell as the outage dragged on: premarket trackers on Friday put the decline anywhere from 2.7% to 6.4%, to between $516 and $509 a share, erasing more than $100 billion in paper market value at the low point before the stock recovered to close up 1.08%, at $539.44, [Yahoo Finance Australia reported](https://au.finance.yahoo.com/news/microsoft-stock-drops-global-outage-113525939.html) — a spread between estimates that is itself a reminder that ‘how far did the stock fall’ depends on which minute of a volatile premarket session you sample.\n\nMicrosoft told Australian officials it did not believe it was dealing with a cyberattack but something closer to the CrowdStrike pattern — an update gone wrong — Home Affairs Minister Tony Burke said. Richard Buckland, a professor of cybercrime and cyberwar at the University of New South Wales, said it was clear organisations had not prioritised workarounds for exactly this kind of failure since CrowdStrike. One Australian academic, quoted by [ABC News](https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050), put it more bluntly: ‘This all really reminds me of the CrowdStrike outage from a few years ago, except we all got to close up early and go home then.’ The technology analyst Dan Ives called it ‘a very bad day in Redmond’ and said there would be ‘major questions for MSFT.’\n\nCiaran Martin, who ran the UK’s National Cyber Security Centre before becoming a professor at Oxford’s Blavatnik School of Government, told [NBC News](https://www.nbcnews.com/tech/tech-news/live-blog/microsoft-outage-outlook-teams-updates-fix-rcna609118) the incident ‘feels like’ it could turn out worse than last year’s Amazon Web Services outage, and perhaps even CrowdStrike.\n\nLooks like being one of the biggest outages of all time.\n\nThat ranking is a judgment call, not yet a measurement. AWS’s 2025 outage and CrowdStrike’s 8.5-million-device crash each have their own units of damage — minutes of DNS failure in one case, bricked Windows machines in the other — and Microsoft has not published the one figure that would let anyone actually rank this incident against them: total server-hours of Exchange capacity lost, and over what interval. Until the promised Post-Incident Report lands, 140,000 Downdetector reports across 74 countries is the only number anyone outside Redmond has to work with.", "url": "https://wpnews.pro/news/microsofts-health-checks-killed-the-patient-inside-the-november-outage", "canonical_source": "https://rews.cc/a/microsoft-s-health-checks-killed-the-patient-inside-the-nove-1da240", "published_at": "2026-11-13 15:26:53+00:00", "updated_at": "2026-11-13 16:53:11.342929+00:00", "lang": "en", "topics": ["ai-infrastructure"], "entities": ["Microsoft", "Exchange Online", "Outlook", "Microsoft Teams", "SharePoint", "Copilot", "Defender XDR", "Downdetector"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsofts-health-checks-killed-the-patient-inside-the-november-outage", "markdown": "https://wpnews.pro/news/microsofts-health-checks-killed-the-patient-inside-the-november-outage.md", "text": "https://wpnews.pro/news/microsofts-health-checks-killed-the-patient-inside-the-november-outage.txt", "jsonld": "https://wpnews.pro/news/microsofts-health-checks-killed-the-patient-inside-the-november-outage.jsonld"}}