A Microsoft Outlook outage on Thursday and a nationwide FAA ground stop on Friday landed 28 hours apart or so, and together they gave the week a theme nobody wanted: modern life runs on technology that breaks in ordinary, preventable ways. Microsoft said its outage hit Outlook, Teams, Copilot and other Microsoft 365 services starting before 11:17 a.m. ET on November 12, 2026. The Federal Aviation Administration then halted flights at every U.S. airport on November 13 after communication problems hit multiple Air Route Traffic Control Centers.
The New York Times and France 24 both covered the two events as a pair, and the pairing is natural. Both involved systems that handle huge volumes of connections, both failed under load, and both left millions of people waiting on something they could not fix. But the available evidence says the incidents were separate. Microsoft said it had no indication that the FAA ground stop related to any Microsoft service, and the Secretary of Homeland Security, Markwayne Mullin, called them separate issues.
This analysis separates what officials have confirmed from what social media has assumed. It also looks at what the two failures say about cloud concentration, legacy network gear and the way organizations plan for the day a core service stops answering. For the immediate question of whether hackers were involved, see our earlier report on the cyberattack question. The short answer so far is no evidence of an attack from either organization.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
Microsoft Outlook Outage: What Microsoft Has Confirmed #
Microsoft’s own account is short, and it is worth reading closely because everything else is commentary. The company said the Microsoft Outlook outage began before 11:17 a.m. ET on Thursday, November 12, 2026, and spread beyond email. Teams and Copilot also suffered, along with other Microsoft 365 services. For many offices that meant no inbox, no meeting links and no AI assistant in the same stretch of the workday.
Microsoft described the cause as a technical issue. A process on affected servers, the one responsible for establishing secure connections, became overwhelmed. Once it choked, the servers stopped processing requests altogether. Microsoft also tied the incident to an earlier network capacity upgrade, saying a problem during that upgrade surfaced after a recent network change.
The company ruled out two popular theories in the same breath. It said the outage was not a cyberattack, and it said the outage had nothing to do with AI or AI agents. That second denial matters because Copilot sat among the affected services, and online speculation had already begun blaming automated agents for the failure.
On the apology and recovery, Microsoft was direct. In its statement the company said, “We are deeply sorry for the disruption this incident has caused our customers and partners.” It added, “We have addressed the underlying issue and continue to restore service to remaining customers and regions.” That second sentence signals a staggered recovery rather than a single switch flipping back on, which is typical for a large cloud estate.
We tracked the first hours of this event in our report on the Microsoft 365 outage and its server failures, and followed it into the next day in a day-two update on the recovery.
How a Secure-Connection Process Can Take Down Servers #
The phrase “a process that establishes secure connections” sounds abstract, so it helps to translate. Nearly every modern service wraps its traffic in encryption. Before a client and a server can exchange anything useful, they negotiate keys and verify identities. That handshake costs computing time and memory on the server side, and a server has a finite budget for it.
When too many handshakes arrive at once, or when handshakes stall and pile up, the process that handles them falls behind. Queues grow, timeouts trigger retries, and the retries add even more load. Engineers call this a retry storm. Left alone, the servers spend all their effort on connection setup and none on real work, which matches Microsoft’s description of servers that stopped processing requests.
Why a Capacity Upgrade Can Backfire
Microsoft pointed to a network capacity upgrade as the starting point. Upgrades exist to add headroom, yet they also change routing, limits and timing assumptions that other components quietly depend on. A fault introduced during the upgrade can sit dormant until a later network change exposes it. That sequence, as Microsoft described it, explains why the failure arrived on a Thursday morning rather than during the upgrade itself.
Microsoft has not published a full post-incident review in the material available to us, so the exact failure chain remains unknown. Readers should treat any detailed technical story beyond Microsoft’s statement as informed guesswork.
FAA Ground Stop: Timeline From 3:30 p.m. to 8:15 p.m. #
The FAA ground stop followed a day later. The agency issued a nationwide ground stop covering all U.S. airports on Friday, November 13, 2026, after communication issues affected multiple Air Route Traffic Control Centers. The FAA said the stop began at roughly 3:30 p.m. ET and that traffic resumed at 8:15 p.m. the same day. Coverage described the stop as lasting more than four hours.
| Date (2026) | Event | Source of the claim |
|---|---|---|
| Thu, Nov. 12, before 11:17 a.m. ET | Outlook outage begins, Teams and Copilot also hit | Microsoft |
| Thu, Nov. 12 | Microsoft attributes outage to overwhelmed secure-connection process | Microsoft |
| Date not stated | Microsoft says underlying issue addressed, restoring remaining customers and regions | Microsoft |
| Fri, Nov. 13, about 3:30 p.m. ET | FAA nationwide ground stop begins | FAA |
| Date not stated | Microsoft says no indication the ground stop relates to its services | Microsoft |
| Fri, Nov. 13, 8:15 p.m. ET | Air traffic resumes | FAA |
Bryan Bedford, the FAA Administrator, attributed the ground stop to faulty equipment. That framing points toward hardware and network gear rather than an outside actor. A ground stop holds aircraft at their departure airports, so a failure in the control centers’ communications ripples across the entire system within minutes. Planes already airborne keep flying, but nothing new leaves the gate.
For the broader picture of how the stop unfolded across the control centers, see our coverage of the FAA telecom outage and the funding ask that followed.
Inside the FTI Network Flood: 1,000 Attempts Every 4 to 5 Seconds #
The FAA supplied the most concrete technical detail of the week. The agency said its legacy equipment became unstable when data flooded the FAA FTI network at a rate of 1,000 connection attempts every 4 to 5 seconds. By our arithmetic, that works out to somewhere between 200 and 250 connection attempts per second. The FAA said the flood created instability with aircraft communications and radar feeds.
Those numbers describe a connection storm, and the parallel with Microsoft’s explanation is hard to miss. In both cases, a system built to accept connections received more than it could handle. In both cases, the overload made the rest of the system unreliable. The two organizations run entirely different stacks, a commercial cloud on one side and federal air traffic infrastructure on the other, yet the failure mode looks familiar to any network engineer.
The FAA did not say, in the material we reviewed, where the flood originated or why it began. Those answers decide whether this was a misconfiguration, a failing device or something external, and the agency has not given them. Until it does, the cause stays open even though the symptom is well described.
Two Incidents, Two Days, No Confirmed Link #
Whenever two high-profile outages land back to back, a single-cause story spreads fast. This one spread too. Posts claimed the Microsoft failure caused the FAA stop, or that a coordinated attack hit both. None of that has support from the people responsible for the systems.
Microsoft said it had no indication that the FAA’s nationwide ground stop related to any Microsoft services. Mullin, who runs the Department of Homeland Security, described the two incidents as separate issues and said he saw no reason to connect them. Bedford pointed to faulty equipment. Three officials, three statements, one direction.
| Claim circulating online | Status | What the record says |
|---|---|---|
| Both outages had one shared cause | Unconfirmed | Microsoft cites a secure-connection process and a network change, the FAA cites legacy equipment and the FTI network flood |
| Shared infrastructure caused both failures | Unconfirmed | Microsoft says it has no indication of a Microsoft link to the FAA stop |
| A cyberattack caused the Microsoft outage | Denied by Microsoft | Microsoft calls it a technical issue |
| AI or AI agents caused the Microsoft outage | Denied by Microsoft | Microsoft says the outage was not related to AI or AI agents |
| The incidents were coordinated | Unconfirmed | DHS Secretary Mullin called them separate issues |
| Exact number of Outlook users affected | Unconfirmed | Downdetector-related reports in coverage ranged from about 130,000 to more than 140,000 |
The last row deserves a caveat. Downdetector counts user-submitted reports, so the totals measure how many people complained, not how many accounts failed. Different outlets quoted different snapshots, which explains the spread. Nobody has published an authoritative count of affected Outlook users.
Readers who want a look at the wilder theories can read our fact check of three conspiracy claims tied to the outage, where we found nothing confirmed.
Why Both Failures Point to Fragile Technology #
Stripped of the debate over blame, the two events share a shape. A component that handled connections hit a limit, and everything built on top of it went down. That is the core meaning of fragile technology here. The word does not mean old or cheap. It means a system where one overloaded piece can interrupt many dependent services at once.
Single Points of Failure Hide in Plain Sight
Most organizations know their headline dependencies, such as the email provider or the primary data center. Fewer map the second-order ones, such as the secure-connection layer that fronts a service or the network that carries radar data to a control center. Those hidden layers fail less often, but when they do, the blast radius is wide. Both the Microsoft and FAA incidents started in exactly that kind of layer.
Change Is the Riskiest Moment
Microsoft tied its outage to a capacity upgrade and a later network change. Reliability engineers have long observed that deliberate changes cause a large share of serious incidents. Upgrades add risk precisely because they are meant to improve things. The lesson is not to avoid upgrading. It is to stage changes, watch them closely and keep a fast rollback path.
Legacy Equipment and the Cost of Waiting on Upgrades #
The FAA’s own wording put legacy equipment at the center of its explanation. Air traffic control is a famous example of a mission-critical system that cannot simply be switched off for a rebuild. Operators upgrade in slices while the old and new layers run side by side, and every seam between them is a place where unusual traffic can cause trouble.
That is why the funding debate follows every FAA outage. Modernization competes with the day-to-day need to keep flights moving, and the benefits show up only when something does not fail. Our report on the earlier FAA telecom outage and the money requested to fix it covers that policy tension, and Friday’s ground stop adds fresh evidence to the same argument.
There is also a human side. Travelers absorbed the delays. A system that fails safe, by stopping flights instead of risking collisions, still imposes a real cost on the public. Reliability is not only about safety. It is also about how often the safe state gets triggered.
Cloud Concentration: When One Vendor Carries the Office #
The Microsoft Outlook outage fits a pattern in cloud computing. Companies adopted software as a service to shed maintenance work, and in exchange they accepted shared fate with the vendor. When Outlook, Teams and Copilot sit under one umbrella, a single fault can remove email, chat, video meetings and the AI layer together. A company with a split toolset would lose one of those, not all four.
The bundling has real upsides. Identity, security and administration work in one place, and the vendor invests more in uptime than most customers could. Microsoft’s recovery work across remaining customers and regions shows the scale of that engineering effort. But concentration also changes the question a risk manager must ask. The issue stops being whether the vendor is reliable on average and becomes what the company does during the hours the vendor is not.
Some firms felt this directly. Euronext, for instance, asked listed companies to use the phone for urgent matters during the Outlook disruption, a reminder that old channels still serve as the fallback when new ones fail. Our report on Euronext and the phone-first request has the details. For more on cloud reliability and architecture, visit our cloud computing section.
Market Impact: What Buyers and Investors Will Weigh #
We will not guess at stock moves, since neither incident comes with confirmed financial figures in the sources we reviewed. The more useful question is how each event shifts purchasing and policy behavior over the coming quarters.
For Microsoft, the cost is reputational first. Enterprise customers renew on trust, and a multi-service outage invites tougher questions in contract talks. Expect procurement teams to ask for clearer service-level language, faster incident communication and detail on how network changes get staged. Microsoft’s quick denial of any cyber or AI cause helps contain one narrative but does not erase the operational lapse it admitted.
For the FAA and its suppliers, the effect runs through budgets and oversight. A nationwide ground stop of more than four hours gives lawmakers a vivid example to cite when they debate funding for air traffic modernization. Vendors of network equipment, monitoring tools and resilience services stand to gain attention, though any procurement will move on a government timeline rather than a market one.
For competitors in productivity software and cloud hosting, the incident is an opening and a warning at once. Rivals can pitch resilience, but each runs similar machinery and faces the same class of risk. A competitor that gloats today may face its own connection storm next quarter.
Comparing the Two Failures Side by Side #
| Factor | Microsoft Outlook outage | FAA ground stop |
|---|---|---|
| Date | Thursday, Nov. 12, 2026 | Friday, Nov. 13, 2026 |
| Start | Before 11:17 a.m. ET | About 3:30 p.m. ET |
| End | Staggered restoration, ongoing at last report | Traffic resumed 8:15 p.m. ET |
| Stated cause | Overwhelmed secure-connection process after a network change | Legacy equipment destabilized by an FTI network data flood |
| Trigger detail | Earlier network capacity upgrade | 1,000 connection attempts every 4 to 5 seconds |
| Services hit | Outlook, Teams, Copilot, other Microsoft 365 services | Aircraft communications and radar feeds, all U.S. airports halted |
| Cyberattack? | Microsoft says no | No attack confirmed in available statements |
| Official framing | Technical issue | Faulty equipment (Bryan Bedford) |
The table shows how closely the technical stories rhyme and how little else they share. Different operators, different networks, different regulators. The overlap lives in the failure pattern, not in any shared hardware or software, and nothing in the record suggests otherwise.
Historical Context: Outages as Recurring Stress Tests #
Large outages are not new, and each generation of infrastructure produces its own. Past cloud and software failures have taken down airlines, hospitals and banks when a single update or configuration change went wrong. Air traffic control has its own record of equipment and communications failures that grounded flights. The common thread is that tightly coupled systems turn small faults into large events.
What changes over time is the number of dependencies. A decade ago, an email outage was an inconvenience. Today Outlook sits next to Teams and Copilot, and many firms route approvals, customer replies and scheduling through that stack. The FAA, meanwhile, runs a network that connects radar, voice and flight data across the country, so a single unstable layer touches every airport at once.
Other sectors tell the same story. Our look at the CSX outage and its weeks-long backlog shows how a rail operator kept some safety systems intact while dispatching and scheduling still needed weeks to recover. Safety layers can hold while operations still suffer, and that split shows up again in the FAA stop.
Resilience Checklist for IT Teams #
Teams cannot prevent a vendor outage, but they can shrink its impact. These steps respond directly to the failure modes described by Microsoft and the FAA.
- Keep an out-of-band channel. A phone tree, an SMS group or a second chat tool lets staff coordinate when email and Teams go dark.
- Map hidden dependencies. List the connection and identity layers that sit in front of each critical service, not just the service itself.
- Rate-limit your own clients. Aggressive retry logic turns a small fault into a connection storm, so use backoff and jitter.
- Stage network changes. Roll upgrades out in small slices with automatic rollback and a hold period before the next step.
- Rehearse the failure. Run a drill where the primary collaboration suite is unavailable for half a day and see who can still work.
- Write down who decides. Pre-assign authority to declare an incident, so communication does not stall waiting on the tool that just failed.
None of these measures needs a large budget. Most need a few hours of planning and a willingness to test. The organizations that coped best during the outage were, in all likelihood, the ones that already had a plan for it.
The AI Question: Why Denials Matter #
Microsoft went out of its way to say the incident was unrelated to AI or AI agents. The statement reflects a live public worry. As companies wire AI agents into infrastructure, every large failure invites the question of whether an agent caused it. Copilot being among the affected services sharpened that suspicion.
On the record, Microsoft ties the event to a network issue, and the FAA ties its event to equipment. Neither cites AI. Questions about an AI link to the ground stop have surfaced separately, and we covered them in our report on the FAA probe into a possible AI connection, where nothing has been confirmed. The responsible approach is to wait for formal findings before assigning blame to any technology category.
Predictions: What Comes Next #
These are our judgments, not reported facts, and they rest on how similar incidents have played out before.
- Microsoft will publish a fuller post-incident review. Large vendors usually follow a multi-service outage with a detailed write-up covering the network change, the overwhelmed process and the fixes. Expect it to focus on staging and rollback.
- Lawmakers will cite the ground stop in modernization debates. A nationwide halt that lasted more than four hours is hard to ignore, and the FTI network flood gives staffers a specific technical hook.
- Enterprises will add outage clauses to cloud contracts. Buyers will push for faster notification and clearer remedies when a vendor-side network change causes downtime.
- Out-of-band communication tools will see more interest. Teams that lost email and chat together will look at independent backup channels.
- Link theories will persist until formal reports land. Without detailed findings from both organizations, the claim that the events were connected will keep resurfacing, even though officials have called them separate.
The Takeaway: Plan for the Day the Handshake Fails #
The record supports a plain reading. Microsoft had a technical failure in how its servers established secure connections after a network change. The FAA had an equipment failure when connection attempts flooded its legacy network. Officials from Microsoft, the FAA and the Department of Homeland Security each said so in their own way, and none described a link or an attack.
What the week really showed is how thin the margin can be. A process that sets up secure connections, or a network that carries radar and radio data, sounds like plumbing until it stops. Then email, meetings, AI assistants and thousands of flights all wait on it. Organizations that treat outages as a planning input rather than a surprise will spend less time stuck. The rest will keep learning the same lesson at the same cost.
Frequently Asked Questions #
When did the Microsoft Outlook outage start? Microsoft said the outage began before 11:17 a.m. ET on Thursday, November 12, 2026. It affected Outlook, Teams, Copilot and other Microsoft 365 services.
What caused the Outlook outage? Microsoft said a process on affected servers that established secure connections became overwhelmed, so the servers stopped processing requests. The company tied the incident to an issue during an earlier network capacity upgrade that surfaced after a recent network change.
Was the Microsoft outage a cyberattack? No, according to Microsoft. The company called it a technical issue, not a cyberattack, and said it was unrelated to AI or AI agents.
How long did the FAA ground stop last? The FAA said the nationwide ground stop began at about 3:30 p.m. ET on Friday, November 13, 2026, and air traffic resumed at 8:15 p.m. Coverage described it as lasting more than four hours.
What caused the FAA ground stop? The FAA said its legacy equipment became unstable when data flooded the FAA FTI network at a rate of 1,000 connection attempts every 4 to 5 seconds. FAA Administrator Bryan Bedford attributed the stop to faulty equipment.
Were the Microsoft outage and the FAA ground stop connected? Nothing confirms a connection. Microsoft said it had no indication that the ground stop related to its services, and DHS Secretary Markwayne Mullin called the two incidents separate issues.
How many people did the Outlook outage affect? No authoritative figure exists. Downdetector-related reports in coverage varied, with figures around 130,000 and more than 140,000 cited, and those count user reports rather than affected accounts.
How can a company prepare for a cloud email outage? Keep a second communication channel, map the hidden connection and identity layers behind critical services, use retry backoff in your own clients and rehearse a work session without your primary collaboration suite.