Microsoft outage leaves directors on the phone

Microsoft’s Microsoft 365 disruption began at 6.26pm GMT on Thursday 12 November 2026 and was still affecting Outlook email into the UK working day on Friday 13 November 2026. BleepingComputer reported Microsoft’s advisory that the broader incident started at 1.26pm Eastern Time, after engineers had already been looking at Exchange Online mailbox connectivity in the Americas.

What this means if you are a director is simple. A supplier you pay for email, files and order systems can go dark while your wages, VAT and supplier bills do not. Coregas, an Australian industrial and medical gas supplier, told customers its Microsoft 365 and Business Central systems were affected and asked them to place orders by phone on 13 November, extending that day’s cut-off to 4.30pm. Toll said operations continued but email could be delayed or undelivered, and directed urgent requests to operations teams by phone. That is a firm reduced to the handset because one cloud vendor holds the messages and the order book. It is not proof that every business became phone-only. Air India told the Associated Press it had temporarily rerouted email and that flights were unaffected. West Northamptonshire Council said Outlook and email were affected while its website and telephone contact remained available. Different fallbacks, same lesson: if the only way a customer or a creditor can reach you is an inbox Microsoft controls, you do not have a fallback.

At 10am GMT on 13 November, the University of Sussex said email was still unavailable, 15 hours and 34 minutes after the start time Microsoft gave. Core Teams calls, meetings, group chats and channel messages were still working. SharePoint and OneDrive files remained accessible, though sharing links could fail, and calendar functions were affected. Sussex told people to save local copies and to phone offices about teaching, meetings or deadlines. One broken service is not every app. For a trading company it is enough. If the mailbox that receives purchase orders and the system that raises invoices both sit on the same vendor, a partial outage is still a cash-flow event.

Microsoft’s advisory, as reported by BleepingComputer, identified possible connection problems affecting Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR. Outlook users reported trouble opening mailboxes and sending or receiving mail. BleepingComputer also reported rising Downdetector complaints for Azure, OneDrive and the Microsoft Store. User reports of Azure trouble do not mean the whole Azure platform was down. The reporting does not establish an Xbox outage. Deutsche Welle reported that Downdetector recorded nearly 130,000 US reports of Outlook problems shortly after 6pm GMT on 12 November. Those are voluntary complaints, not a count of people affected. The Associated Press reported Microsoft’s figure of more than 430 million people using Microsoft 365 apps. That is a user base, not an outage count. How many firms lost orders, and for how long, is still unconfirmed.

Microsoft first put connectivity errors down to elevated infrastructure load, then said servers had unexpectedly become unavailable and put pressure on what remained. Engineers paused deployments, redistributed traffic and restarted servers. BleepingComputer reported Microsoft saying users in any region could be affected. Later updates said some recovery changes were not holding, then that capacity was improving. Moneycontrol reported a status-page update at 7.29am GMT on 13 November that a patch had improved server stability in part of the infrastructure. The Guardian reported Microsoft was extending the email timeout window to 48 hours to help protect delayed messages. Those are signs of recovery, not a statement that every service was back. Microsoft said it had no indication of malicious activity. That is not a finding that every security cause has been ruled out. Australian Home Affairs Minister Tony Burke said Microsoft believed an update had gone awry. That is a minister’s account of what Microsoft believed, not a completed root-cause report. Microsoft has said it will publish a post-incident report. Administrators can follow incident references EX1550543 and MO1550821 in the Microsoft 365 admin centre. The public status page moves. Check the time on any update you rely on.

The UK government said it was working with Microsoft to assess effects on public services and that it had contingency plans. That statement does not say which services used those plans, whether they worked, or who signed off the decision to put a council inbox, a police form or an NHS mailbox on one vendor. The Guardian reported Dorset Police could not receive online form submissions and asked for time-critical non-emergency reports by phone, and that NHS services had warned of Outlook and Teams problems. Who decided the concentration, who benefits from the contract, and who pays when the inbox fails are still the questions a director should ask of their own supplier, not only of Whitehall.

The public updates do not show whether Thursday night’s incident produced extra revenue for Microsoft. Independent hosts and open-source suppliers could win work if firms diversify. No contract signed on the back of this outage is on the record. Who pays today is clearer. Coregas customers and the staff taking telephone orders do extra work. Sussex students and staff lost email and, in places, calendars, teaching and deadlines. West Northamptonshire Council users and staff lost email. The cost in lost orders is not published. You should assume it is yours until a creditor tells you otherwise.

A director reading this on 13 November 2026 should not treat the outage as a finding of wrongful trading or as grounds for disqualification. Wrongful trading is a claim about continuing to trade when you knew, or ought to have concluded, there was no reasonable prospect of avoiding insolvent liquidation, and then failing to take every step to minimise loss to creditors. Disqualification is a separate regime, usually after formal insolvency, about unfit conduct. An inbox that will not open is not, by itself, either of those. It can become a problem if you ignore a missed VAT payment, a bounced supplier, or a personal guarantee call because you were waiting for Outlook to come back. HMRC is a creditor with a timetable, not an enemy. A time to pay arrangement is a written deal about dates and amounts. It is harder to get, and easier to break, if you have no record of what you owe because the only copy lived in a mailbox you cannot open.

The first person who rings you this week about a formal procedure may be an insolvency practitioner, a lender, or a lead-generation site dressed up as advice. They are paid when a company voluntary liquidation (CVL), a company voluntary arrangement (CVA) or an administration is instructed. A cash-flow dip caused by missed orders is not a sentence. Formal insolvency is sometimes the right choice. It is a choice. If you have an overdrawn director’s loan account or a personal guarantee on the bank, the outage does not create that exposure and it does not erase it. Handle both early, with your own records, not with a script from someone who earns from the procedure.

That is why open-source, self-hosted solutions win. Not because a free mail server on a shelf in the office would have kept every Sussex calendar and every Coregas invoice alive on Thursday night. The notices from the firms and the university do not compare Microsoft with an independently hosted, maintained and backed-up alternative, and this piece will not invent that comparison. They win because the fallback is yours. You choose the machine, the backup, and the second route a customer uses when the first one fails. A cloud contract means someone else runs the computers your orders and your creditor correspondence sit on. When those computers stop, you are the one on the phone, and the person who profits from recommending a CVL is not waiting for Microsoft’s post-incident report.

The honest limit is the cost and the failure mode. Self-hosting shifts the risk onto you: patching, backups, a second connection, someone who can answer the phone when your own server or your own line fails. A badly maintained open-source box is not a resilience plan. It is another single point, with no vendor status page and no one else to blame. Ask what it would cost, in money and in a named person’s time, to keep it patched, backed up off site, and reachable on a line that does not depend on the same vendor. Ask whether that second route would still answer if Microsoft’s network, and your broadband, both failed. If you cannot answer those two questions, you do not yet have a fallback. You have a hope.

Law in Scotland and Northern Ireland is not identical on insolvency procedure and on some creditor remedies. The duty to keep records, and the sense in speaking to creditors before a deadline is missed, is the same practical point in each jurisdiction.