Outlook Outage Leaves Law Firms Exposed

For much of Thursday and into Friday, attorneys across the country opened Outlook and got nothing: spinning inboxes, connection errors, messages stuck in the outbox. Microsoft has confirmed a global outage of Exchange Online, the cloud email system behind Outlook and most of Microsoft 365. For law firms, and immigration practices in particular, this is more than an inconvenience. Government agencies, clients and opposing counsel all reach lawyers by email, and for more than a day many of those messages have not come through.

What actually broke

Outlook, the app on your desktop, phone or browser, is only the front end. Your mailbox lives on Microsoft’s Exchange Online servers. That back end is what failed.

According to Microsoft’s service health dashboard, the incident began at 16:17 UTC on Thursday, November 12 (8:17 a.m. Pacific, 11:17 a.m. Eastern). Microsoft first reported problems reaching mailboxes in the Americas, then widened the warning to say users in any region could be affected.

Microsoft’s explanation has changed as its engineers learned more:

First account: a large number of Exchange servers went offline unexpectedly. Their traffic shifted onto the servers still running, and those became overloaded.
Latest account: a process on the affected servers that sets up secure (encrypted) connections gets overwhelmed. When that happens, the server stops handling requests.
The fix so far: Microsoft has paused deployments, moved and throttled traffic, and restarted servers. It is also rolling back a recent network configuration change that lined up with the start of the outage, testing it on a subset of servers before applying it everywhere.

This is why the outage has dragged on. Microsoft brought some servers back several times, and they failed again once real traffic hit them. Overnight, Microsoft said its latest fixes were “not taking as expected.” It has not yet published a final root-cause report.

How big is it

This is not a local glitch, and it is not your firm’s IT setup. Outage reports came from 74 countries. Microsoft says users may be unable to reach their mailbox through any of the usual routes: Outlook on the web, the Outlook desktop app, phone mail apps (Exchange ActiveSync), and other apps that connect to it. It also says email delivery may be delayed.

The damage goes beyond email because so much of Microsoft 365 depends on Exchange:

Teams: calendars and meeting scheduling are affected, though chat and calls have mostly worked.
SharePoint, Copilot, Planner and To Do: disrupted where they depend on Exchange.
Security tools (Defender for Office 365): links rewritten by Safe Links may not open, releasing messages from quarantine may fail, and message tracing may be delayed.
Hybrid setups: firms that still run their own Exchange server alongside Microsoft’s cloud may see mail flow problems too.
Connected tools: practice-management systems, e-signature tools and AI assistants that plug into Microsoft 365 may also fail, since they reach your mail and calendar through Microsoft.

Governments in Singapore and Australia, the Philippines Supreme Court and New York City agencies have all reported disruptions, and some public companies delayed earnings releases.

Will the missing emails arrive?

Short answer: most of them should, but not all of them are guaranteed, and some may arrive late enough to matter.

When someone sends you an email, their mail server hands it to your mail server. If your server can’t take it, the sender’s server normally gets a “try again later” response, keeps the message in a queue, and keeps retrying. Most senders retry for somewhere between one and five days, depending on how they are set up. Once Exchange Online can accept mail again, those queued messages should start arriving, often in a large batch.

Microsoft’s own wording so far is that email delivery “may be delayed.” It has not said messages were lost. But there are real risks:

Senders that give up. If the outage runs past a sender’s retry window, that server stops trying and sends a bounce notice back to the sender. You never see it. A client may assume you got their message.
Automated government systems. Notices from agency systems are usually sent from no-reply addresses. If one of those systems gives up, nobody on the sending side is likely to notice or resend.
Messages that arrive in a flood. When service comes back, hundreds of delayed emails may land at once. An important notice can be buried, filtered to junk, or held in quarantine, especially while Microsoft’s quarantine tools are themselves unstable.
Messages that expired in the meantime. One-time login codes and password reset links usually expire in minutes. Any that arrive late are useless.

The practical rule: don’t treat a quiet inbox after the outage as proof that nothing was sent. Check the source directly.

The emails immigration lawyers can’t afford to miss

Immigration practices depend on email from government systems more than most practice areas. Two examples stand out.

Department of Labor PERM notices. DOL’s FLAG system sends email notifications on PERM labor certification applications. A delayed or missing notice can mean an attorney does not learn about a status change or a request from the agency in time to act on it.

USCIS online account login codes. Attorneys filing online through the USCIS account system often get a one-time verification code by email at login. With Outlook down, many attorneys could not get those codes, which means they could not log in to file cases, check notices or upload responses. Any code delivered after the outage will already have expired; request a new one. But, sometimes government agencies will stop emailing secure codes if the messages are not able to be delivered. The idea behind that probably is that they don’t want someone else to hack the domain and operate the emails. So many immigration law firms may experience not getting confirmation emails or secure codes when they try to file cases online through USCIS website.

On top of that: client documents, employer HR contacts, consular appointment emails, court e-filing notices and opposing counsel’s correspondence all usually arrive by email.

Why this outage hits harder right now

The timing is bad for immigration practitioners. On August 5, 2026, USCIS issued Policy Alert PA-2026-05, which changed how it handles Requests for Evidence (RFEs) and Notices of Intent to Deny (NOIDs):

Officers no longer have to give the full 12-week (84-day) RFE response period, and practitioners are now seeing RFEs with about 30 days to respond.
NOID responses remain capped at 30 days.
The extra 14 days USCIS used to allow for notices mailed abroad is gone. Only a three-day mailing allowance remains.
USCIS generally does not extend RFE deadlines, and any reply, even a partial one, is treated as a request to decide the case on the record as it stands.

With 30-day windows, there is little room for delay. Deadlines are set by the date on the notice, and they do not pause because Microsoft is down. Every day a firm cannot reach clients for evidence, receive documents, or log in to file is a day taken out of a short response period.

What to do now and when service returns

While the outage continues:

Go to the source. Log in to FLAG and your USCIS online account directly to check for notices instead of waiting for email alerts. If you can’t get a login code by email, see whether the account lets you add another verification method, such as an authenticator app.
Call clients with open deadlines. Prioritize matters with RFE, NOID or other response deadlines in the next few weeks. Confirm by phone that documents and messages are moving.
Tell people how to reach you. Post a notice on your website and voicemail with a working phone number and an alternate way to send documents.
Keep a record. Note when you lost access and what you couldn’t do. If a deadline is affected, a written record of the outage and your efforts will matter.

Once Outlook is back:

Sort the backlog by sender and date, looking first for agency and court notices received since Thursday morning.
Check junk mail and quarantine, and ask your IT provider to release any held messages once Microsoft’s quarantine tools are working again.
Ask clients and key contacts to resend anything they sent since Thursday morning, especially attachments.
Check your calendar. Meetings, reminders and deadlines that came in by email or synced from other tools may be missing or duplicated.
Check connected tools such as your case-management system, e-signature service and scanning workflows to make sure they reconnected to Microsoft 365.
Watch Microsoft’s post-incident report. Your IT provider can get it from the Microsoft 365 admin center under the incident number. It will say whether any mail was dropped.

Build a backup before the next outage

This is the second major Exchange Online disruption this fall. A multi-day incident starting August 31 also caused login failures and delayed mail. Firms should plan for outages to happen again.

A workable backup plan doesn’t have to be elaborate:

A second email channel on a different provider. A backup on another Microsoft service won’t help if Microsoft is the problem. Many firms keep a secondary mailbox or domain hosted by a separate provider, ready to use and known to staff.
A ready-made notice for your website and voicemail, so you can tell clients within minutes how to reach you: phone, the alternate email, or a client portal.
Backup contact details on government accounts. Where FLAG, the USCIS account system and court e-filing systems allow it, add a second verification method or a backup email so one outage doesn’t lock you out.
A short contact list for live matters, kept outside Outlook, with phone numbers for clients and HR contacts on cases with pending deadlines.
Confidentiality built in. Lawyers must make reasonable efforts to protect client information (ABA Model Rule 1.6(c) and state equivalents). Set up the backup channel properly, with security settings and a business agreement in place, before you need it, rather than switching to personal accounts in a panic.

Hopefully, once Microsoft stabilizes its servers, the delayed messages will arrive and firms can catch up. But with USCIS deadlines this short, “hopefully” is not a plan. The firms that come through the next outage best will be the ones that set up another way to stay in touch before it happens.

Sources

Vasanth Vaidyanathan, Esq.

Administrator

Vasanth Vaidyanathan is an immigration attorney with over 20 years of experience focused exclusively on U.S. immigration and nationality law. He holds an LL.M. from California Western School of Law, San Diego and advises individuals and businesses on employment and family-based immigration matters, including H-1B, PERM, EB categories, and adjustment of status. He has also been a featured speaker at immigration seminars across the U.S. To reach Vasanth visit: https://www.vnathan.com/

Author's website Author's posts