Microsoft Outage Eases as Email Backlog Clears; Network Change Blamed

Microsoft says Outlook and Exchange Online are broadly recovering, blames a network change, rules out a cyberattack and is holding delayed mail for 48 hours, but has not declared the outage over.

The featured image accompanying this article was generated by AI and does not depict real people or events.

Microsoft said Friday morning that it was seeing “broad recovery and stability” across its services after a global Exchange Online failure that cut many law firms off from Outlook for most of a day, and for the first time it offered a cause: a problem introduced during an earlier network capacity upgrade that surfaced after a recent network change. The company also said it had no evidence of malicious activity and promised a full post-incident report. As we reported earlier, the outage began Thursday, Nov. 12, and threatened delivery of agency notices, client documents and USCIS login codes. As of Microsoft’s latest updates reviewed for this article, the company had not declared the incident resolved.

What changed since Thursday

Microsoft’s public updates shifted from troubleshooting to recovery over the course of Friday. According to posts quoted by TechRadar and Windows Central, Microsoft said:

Email queues are shrinking. Microsoft said email queues were “significantly reduced and approaching normal levels,” and that it was prioritizing reduction of the email queue and backlog for the environments still affected.
Recovery is not complete. Microsoft said it would “continue to restore service to remaining customers and regions” and that some users may still see intermittent problems.
Delayed mail is being held longer. Microsoft extended its email timeout window to 48 hours to help protect delayed messages while delivery catches up, and said that extension remains in place.
The incident numbers are unchanged. IT administrators can follow the details under EX1550543 and MO1550821 in the Microsoft 365 admin center.

Independent network data points the same way. Internet monitoring firm Kentik, as reported by PPC Land, saw Exchange traffic begin recovering at about 11:20 UTC Friday (3:20 a.m. Pacific), roughly 18 hours after its data showed the disruption starting, with traffic then running above normal as queued mail flowed in. At the outage’s peak, Downdetector logged roughly 130,000 user reports of Outlook problems, according to Windows Central and TechRadar.

The cause, and the cyberattack question

Microsoft’s account of the cause has changed. On Thursday it said it had not identified any recent change that correlated with the start of the problem, and pointed instead to servers failing health checks and a process that sets up secure connections becoming overwhelmed. On Friday it said the incident “was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change.” That is Microsoft’s preliminary explanation; the company says the full post-incident report will come “once our review is complete.” It has not given a date.

For law firms weighing their confidentiality obligations, the more important statement is about security. Microsoft’s service health dashboard said it had “no evidence of malicious activity associated with this incident,” and Charles Lamanna, a Microsoft executive vice president, wrote that there was “no indication this is the result of malicious or cyber activity.” Those statements are carefully hedged, and the final report is the place to confirm them, but nothing Microsoft has published so far suggests client data was exposed.

Microsoft also apologized. Lamanna said late Thursday that the company regretted the disruption, and on Friday Microsoft said it was “deeply sorry for the disruption this incident has caused our customers and partners.” It has not announced service credits.

What recovery means for immigration practices

Recovery brings its own risk: the backlog. TechRadar reported users receiving a wave of delayed emails as queues drained. A day’s worth of client messages, agency alerts and court or e-filing notices may now be landing at once, out of order and with original send times well in the past.

Nothing about the outage changes government deadlines. With USCIS now issuing some Requests for Evidence with roughly 30-day response windows, as we explained in our earlier article, a notice that arrived late still runs from the date printed on it. Microsoft’s 48-hour hold helps with mail that reached its systems, but it does not tell firms whether every outside sender kept retrying, and Microsoft has not said whether any mail was lost. Until the post-incident report says otherwise, firms should treat the inbox as incomplete for the period since Thursday morning.

The outage also lands during a difficult stretch for law firm technology. Many immigration firms are still working with only limited access to their case management system after the INSZoom shutdown, and for some, losing email at the same time removed the main fallback channel for reaching clients and employers.

What to watch

A “resolved” notice: Microsoft has described broad recovery but had not closed the incident in the updates we reviewed. Check EX1550543 and MO1550821 in the admin center before assuming every mailbox is back.
The post-incident report: It should confirm the root cause, whether any mail was dropped rather than delayed, and whether there was any security impact. Firms may want to keep a copy in their files.
Agency portals: Log in to FLAG, your USCIS online account and court e-filing systems directly to check for notices issued since Nov. 12, rather than relying on email alerts arriving.
Junk and quarantine folders: A flood of delayed mail is more likely to trip filters. Ask your IT provider to review quarantine once Microsoft’s security tools are stable.
Your outage record: Keep notes on when you lost and regained access and what you could not do. If a deadline was affected, that record will matter.

This article is for general information and is not legal advice.

Sources

Vasanth Vaidyanathan, Esq.

Administrator

Vasanth Vaidyanathan is an immigration attorney with over 20 years of experience focused exclusively on U.S. immigration and nationality law. He holds an LL.M. from California Western School of Law, San Diego and advises individuals and businesses on employment and family-based immigration matters, including H-1B, PERM, EB categories, and adjustment of status. He has also been a featured speaker at immigration seminars across the U.S. To reach Vasanth visit: https://www.vnathan.com/

Author's website Author's posts