What should a small business do when Microsoft 365 goes down?

Published 2026-11-13 · Last updated 2026-11-13

When Microsoft 365 goes down, check Microsoft's status page at status.cloud.microsoft, then make sure customers can still reach you another way: a website request form that does not depend on your email, a second place every request lands, and a phone that gets answered. On Thursday, November 12, 2026, Outlook email and several other Microsoft 365 tools failed for hours. Optimus Business Solutions, a web design and AI systems company in Salem, New Hampshire, explains what broke, what kept working, and the three things we would set up so one company's bad day never becomes your whole business's bad day.

What happened in the Microsoft 365 outage on November 12, 2026?

Microsoft's first public post about the problem came at 12:54 PM Eastern on its Microsoft 365 Status account on X, about Outlook mailboxes in the Americas. Around 1 PM Eastern, Reuters reported about 138,000 Outlook problem reports on Downdetector. Those are reports from users, not a count of people affected, but they show how many owners and office workers were looking at the same empty inbox.

Microsoft's own explanation, posted on its service status page, is that a process on its servers responsible for setting up secure connections became overwhelmed, so the servers stopped processing requests. BleepingComputer reported that Microsoft said the load was not caused by a jump in traffic. Microsoft's first fixes did not work; in its words, they "have not provided the anticipated relief." It then began rolling back a recent network configuration change that lines up with when the trouble started. By 9 PM Eastern, more than eight hours after that first post, the outage was still not fixed. At 10 AM Eastern on Friday, November 13, about 21 hours after that first post, Microsoft still listed email delivery as possibly delayed.

Microsoft has not reported any sign of a cyberattack. It describes a server failure, and no final root cause had been published that evening. The Register also reported that some of Microsoft's own admin tools were hit, which made troubleshooting harder for IT teams.

Which Microsoft 365 services were affected, and what kept working?

Email took the worst of it. Microsoft said email delivery could be delayed for hours, and it listed Copilot, Planner, Intune, Purview, Defender and Universal Print among the affected services. Teams is a different story: Microsoft said Teams chat and meetings mostly kept working, and the failures were in features that depend on email and calendar.

And when email went quiet, people did the obvious thing: they picked up the phone. On a day like this, the phone is your backup front door, which is only worth something if somebody answers it.

Is this just a Microsoft problem?

No, and it is worth being fair about that. Every big provider has bad days. Amazon Web Services had a large outage in October 2025, and Microsoft 365 had one in January 2026 that lasted almost ten hours. When millions of businesses share one platform, they share its bad days too.

Websites work the same way. WordPress runs about 39 percent of all websites, according to W3Techs. On October 28, 2026, WordPress released version 7.1.4 to fix a flaw that let attackers with no account run code on a site's server while WordPress was updating itself. On November 3, CISA, the federal government's cybersecurity office, added it to its list of flaws attackers are actively using. Wordfence, a WordPress security company, blocked more than 240,000 attempts in the first week, and it is careful to say that does not mean that many sites were hacked.

The everyday load is bigger than any one headline. In a single week, November 2 to 8, Wordfence logged 497 new security bugs in WordPress plugins, and 40 had no fix yet. Patchstack counts 91 percent of 2025's WordPress security bugs in plugins rather than in WordPress itself. In 2026, WordPress itself landed on CISA's exploited list four times; before this year, only plugins had.

None of this means leave Microsoft, and none of it means WordPress is bad. Both fixed their problems and published what happened. The lesson is separation: the way customers reach you should not all run on one thing that can have a bad day.

What are the three things that keep customers able to reach you?

Here is the short version we give owners:

• Make your website's request form save every request itself, not only email it to you. On most small business websites the form sends each lead straight to your email, so when email stalls, the leads stall too. A form that keeps its own record means a request sent during an outage is still somewhere you can see it.
• Send every request to more than one place, such as an email and a text, or an email and your CRM, so if one channel has a bad day the other one catches it.
• Make sure the phone gets answered, by you, your team, or an AI receptionist, because that is where people turn when email goes quiet.

What should you do during the next outage?

• Check status.cloud.microsoft first. Microsoft posts updates there, and on its Microsoft 365 Status account on X, when its admin tools are having trouble.
• Set your most important files in OneDrive to "Always keep on this device" ahead of time, so you can open them offline.
• Tell customers another way to reach you, such as a note on your website or your Google Business Profile, if email will be slow.
• Expect recovery to come back gradually, as apps reconnect, rather than all at once.
• If you run WordPress, confirm your site is on WordPress 7.1.4 or the security release for your version, and ask your host about the server underneath it, which a WordPress update does not fix.

How does Optimus build website forms that keep every lead when your email is down?

We build custom-coded websites. That means fewer moving parts we did not write, and fewer things waiting on somebody else's patch. Our website's request form keeps its own record of every request before it sends a single email, so a slow inbox does not lose a lead, and for client builds we can send each request to more than one place.

We will be straight about the limits. No website is unhackable, and any host can have a bad day. In 2025, React, the code many modern sites are built on, had a critical flaw of its own. Custom code still needs someone who patches it. The difference is that there are fewer parts to watch, and the people who built them are the ones watching.

Submit an inquiry about a website form that keeps every lead when your email is down →