Report: Microsoft began mitigating its email outage after 20 hours

• Microsoft began mitigating its email outage after about 20 hours, The Pragmatic Engineer author Gergely Orosz reported after speaking with Microsoft developers.
• Recovery involved registry-key patches, rack reboots and traffic routing, according to Orosz.
• Copilot and security products appeared on Microsoft's potentially affected services list.
• Microsoft later linked the incident to an earlier network-capacity upgrade and ruled out AI or cyberattacks.

Some legacy Exchange components were reportedly moved onto Azure as part of the forward fix. Microsoft also extended its email timeout window to 48 hours, while an independent delivery report documented inbound delays across consumer and business Microsoft mailboxes.

Roughly 12 hours into the outage, Orosz reported that servers became unresponsive after being brought back online. Microsoft's updates described servers failing automated health checks, leaving the remaining infrastructure to absorb more traffic, according to Malwarebytes' account.

Orosz reported mitigation beginning at roughly 20 hours. That's an ugly recovery clock for business email.

Orosz described four kinds of recovery work:

• Rolling back network configuration changes.
• Applying registry-key patches.
• Rebooting specific racks.
• Routing traffic to manage a thundering herd of returning requests.

Rollback alone did not mitigate the outage, he clarified in a reply. His account did not identify the registry keys or individual network settings involved.

Microsoft's captured service-health notice, published through its public status page, listed these potentially affected services:

• Exchange Online.
• Microsoft Teams.
• SharePoint Online.
• Microsoft Copilot 365.
• Microsoft Defender XDR.
• Microsoft Planner.
• Microsoft To Do.
• Microsoft Intune.
• Microsoft Defender for Office 365.
• Microsoft Purview, including authorization, auto labelling, data loss prevention, communication compliance and data classification.
• Power BI, specifically intermittent failures exporting reports with MIP sensitivity labels to PDF.

Availability varied by application and user, Malwarebytes reported. Orosz separately heard that Teams was working during the email outage:

• AI-generated changes: Before Microsoft's later statement, Orosz pushed back on AI blame, noting that days-long outages also happened before AI.
• Layoffs: Orosz challenged claims about Outlook layoffs, saying the cuts being cited involved Xbox rather than Outlook.
• Generated replies: He blocked an account he called an LLM bot and accused another account of generating templated replies. Those were his characterizations of the accounts.

Microsoft subsequently described a two-stage trigger: an issue introduced during an earlier network-capacity upgrade surfaced after a recent network change. Its statement said the underlying issue had been addressed while restoration continued for remaining customers and regions.

That account followed Orosz's earlier report of networking problems in the legacy system. He said his sources had ruled out DNS, while the detailed root cause remained unclear internally beyond the incident team at the time of his update.

Microsoft promised a full post-incident report after mitigation, covering the root cause and additional safeguards. The company also said it restored service gradually, validating stability at each stage because of the scale of returning demand.