Microsoft is recovering from a major global outage that began Thursday afternoon, 12 November 2026, and is still affecting Microsoft 365 services, including Outlook and Exchange Online email, Teams, SharePoint, and OneDrive. Microsoft says there is no indication of a cyber attack, and services are returning gradually rather than all at once.
The websites we host and support are online and unaffected. The risk sits at the login stage. If your login code arrives by email, or your website account is linked to a Microsoft work account, you may not be able to get in until Microsoft’s mail and authentication services catch up.
|
What’s actually gone wrong?
The outage began shortly after 17:00 GMT on Thursday. Microsoft says a large number of its servers became unexpectedly unavailable after a fault in the automated checks that decide whether a server is healthy enough to take traffic. With fewer servers in the pool, the ones left were overwhelmed. That’s why recovery has been slow and uneven rather than a single fix.
Shortly after 07:00 GMT today, Microsoft reported “positive results” after patching an authentication and routing component. Its status page still shows a service degradation. A full post-incident report is promised once the incident is closed.
What it means for your website
Most people will notice nothing at all. The trouble shows up wherever a login depends on Microsoft.
- Emailed one-time passcodes (OTP). If your login code goes to an Outlook or Microsoft 365 inbox, it may arrive hours late. Or not at all. Most codes expire within 15 minutes, so a late email usually means an expired code and another go.
- Microsoft single sign-on. If your login is connected to a Microsoft work account (Entra ID, formerly Azure AD), sign-in may time out, fail, or bounce you back to the login screen.
- Password resets and invitations. Reset links and new user invitations sent to a Microsoft inbox may turn up late, or expire before anyone opens them.
- Order and enquiry notifications. If these land in a Microsoft inbox, they may be delayed. Orders and form submissions are still being captured and stored on the site.
Why OTP is the weak link
An emailed or texted code is a real second factor. It just isn’t a resilient one. It depends on someone else’s delivery service — and right now, that someone else is having a bad week.
An authenticator app works differently. It generates a new six-digit code on your phone every 30 seconds. No email, no text message, no mobile signal. It keeps working when Microsoft’s mail flow doesn’t, and it’s far harder for a criminal to intercept or phish than a code sent by email or SMS.
How to switch (about two minutes)
- Sign in to your website account and open your profile or security settings.
- Choose two-factor authentication, then “Authenticator app”.
- Scan the QR code with Microsoft Authenticator, Google Authenticator, or a password manager that handles time-based codes.
- Store the backup codes somewhere safe and offline.
- Keep email OTP as a fallback if your site offers both. Just don’t let it be the only route in.
Not sure whether your site supports app-based 2FA? Or would you rather we set it up for your team? Email [email protected] and we’ll do it for you.
Can’t get in? Do this.
- Don’t keep retrying. Repeated failed attempts can trigger a temporary lockout that outlasts the Microsoft issue.
- Wait 15–30 minutes, then try once more. Use a different login route if your site offers one.
- If you land on an error page, note the exact wording.
- Email [email protected] with the website address, the email address or username you sign in with, the exact error or a screenshot, the time you tried, and whether you were using an emailed code or a Microsoft sign-in.
We’ll investigate. Where a Microsoft dependency is blocking you, we can set up an alternative way in while the incident runs.
A quick word on scams
Outages are a gift to scammers. Microsoft, Sourcefour, or any legitimate provider will never call or email asking for your password or a one-time passcode. If someone claiming to be from “Microsoft support” offers to fix your login during this outage, don’t engage. Tell us instead.
What happens next
We’re watching Microsoft’s service health updates and will update this notice when the incident is closed. If your website has a login route that depends on Microsoft, we’ll be in touch separately about moving it somewhere more resilient — so an outage at Microsoft can’t lock your team out again.
Your website should work hard for your business. It should let you in, too.
