Evidence File — Outlook and Copilot Went Down Together. Microsoft Has Not Said AI Was the Cause
Published 12 November 2026 · Evidence File
Primary documents
| Document | Role | Use |
|---|---|---|
| https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html?q=EX1550543 | Primary source | Supports the article's claims |
| https://apnews.com/article/6376045281feb430c0b923e3a4b251c2 | Independent reporting, retrieved separately | Used only for user-reported impact figures, the Microsoft spokesperson statement and the Patch Tuesday context, which the Microsoft incident records do not contain. It does not corroborate the technical sequence, which comes from Microsoft's advisories. |
Claim-by-claim verification
| Claim as published | Status | Basis |
|---|---|---|
| Exchange Online began degrading at 16:17 UTC on 12 November 2026 | Verified | EX1550543 Start Time field, Microsoft advisory via PennO365 mirror |
| The wider Microsoft 365 incident MO1550821 opened at 18:26 UTC | Verified | MO1550821 Start Time field, Microsoft advisory via PennO365 mirror |
| A core process on affected servers became overwhelmed, causing servers to stop responding | Verified | EX1550543 22:00 UTC update, quoted verbatim |
| Affected connection methods include Outlook on the web, MAPI, EAS and REST | Verified | EX1550543 More info field |
| The service Microsoft lists as Microsoft Copilot 365 was listed as impacted because it interacts with Exchange Online | Verified | MO1550821 advisory, quoted verbatim |
| Microsoft states that a process on the affected servers responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests | Verified | EX1550543 01:06:41 UTC 13 November update, quoted verbatim from the re-retrieved advisory |
| Microsoft has begun reverting a recent network configuration change that correlates with the start of impact | Verified as a correlation statement | EX1550543 01:06:41 UTC update, quoted verbatim. The record does not say the change caused the outage, and this article does not either. |
| Copilot users may be unable to load Copilot Chat or receive responses in the web and desktop apps, and Copilot experiences may be unable to access work data such as email, calendar and files | Verified | MO1550821 per-service impact list, quoted verbatim (present at the 02:10:31 and 02:58:06 UTC updates) |
| The affected-service list was replaced with per-service impact detail at 00:00:13 UTC, adding ten services the 19:58:41 UTC list did not name (Microsoft 365 admin center, Microsoft 365 apps, Microsoft 365 Apps Admin Center, Microsoft 365 Education, Microsoft Graph, Defender for Office 365, Intune, Power BI, Universal Print, Windows 365), and Microsoft Fabric was added at 00:45:16 UTC | Verified | MO1550821 19:58:41, 00:00:13, 00:45:16 and 02:10:31 UTC updates, compared service by service. Corrected 2026-11-13 after an independent reviewer showed the earlier wording had both the time and the count wrong |
| At 02:54 and 02:58 UTC Microsoft reported that the serviceability change is not taking as expected and that it is identifying alternate workstreams | Verified | EX1550543 02:54:05 UTC and MO1550821 02:58:06 UTC current-status fields, quoted verbatim |
| Both incidents remained service degradations with End Time "Not ended yet" at those timestamps | Verified | Status and End Time fields on both records at 02:54:05 and 02:58:06 UTC, and again at 03:34:14 and 03:37:38 UTC |
| Microsoft states that "for now we can confirm that there is no indication this is the result of malicious activity" | Verified, quoted | EX1550543 03:34:14 UTC 13 November update; also carried in the MO1550821 03:36:01 update |
| Microsoft is reviewing traffic flows and affected infrastructure to optimise routing | Verified | EX1550543 03:34:14 UTC update. This is a recovery workstream, not a published cause. |
| Exchange Online reported elevated load across multiple regions contributing to connectivity errors at 18:19 UTC | Verified | EX1550543 18:19:37 UTC update, quoted verbatim |
| Microsoft has published no root cause for either incident | Verified | Root Cause field reads N/A on both records at last update |
| No AI workload or AI-assisted operational system is named as a cause in Microsoft's advisories | Verified | Full text of EX1550543 and MO1550821 retrieved and read; absence checked against both records |
| Nearly 130,000 Downdetector reports just after 1 p.m. ET | Attributed | Associated Press, read via browser after a 403 to a plain request; Downdetector's own figures were not separately retrieved |
| The elevated load was not driven by an overall increase in traffic, and Microsoft investigated elevated processor usage | Verified against Microsoft | Microsoft's own update states the load “isn't driven by an overall increase in traffic”; the processor-usage investigation is in the advisory text. SecurityWeek's earlier reporting is consistent and is no longer the basis for the claim. Corrected 2026-11-13 after an independent reviewer found the earlier row said the opposite |
| A patch released two days earlier included an exploited Outlook spoofing flaw | Attributed | SecurityWeek; Microsoft advisories have not linked it to this incident |
| Whether the outage affected consumer Outlook.com or Hotmail | Unknown | Microsoft's incident records cover Exchange Online mailbox access and do not address consumer services |
| What the small number of recent configuration updates changed | Unknown | Microsoft says they are under investigation without describing them |
| What the reverted network configuration change altered, and whether reverting it restores service | Unknown | EX1550543 records the revert and says monitoring will determine whether it contributes to recovery. No description of the change is published. |
| Whether any AI system caused the outage | Not excluded, not evidenced | No root cause published; Root Cause field reads N/A on both records; no AI workload named in either. An unevidenced role is not the same as an excluded one. |
Known limits
- The article's timeline compresses several advisory updates into single sentences, and the 20:38 UTC sentence also carries the 20:56 and 23:59 material. The per-update wording, in Microsoft's own sequence, is held in the saved capture rather than reproduced sentence by sentence in the article.
- A raw text extraction of the mirror can truncate a long paragraph mid-sentence (the 01:06 UTC paragraph is the one affected, cut at "recent network con"). The full clause is present in the page as retrieved and in the hash-recorded capture of it, and quotations in this package were tested by the newsroom's quotation verifier against the page as retrieved, not against a truncated extract.
- The mirror's own header carries a generated-at stamp that lags the newest advisory content it prints. That is an inconsistency in the mirror, reported here rather than reconciled, and it is why retrieval timestamps in this file are the times this newsroom actually read the page.
- Primary source is a third-party mirror of Microsoft's admin-centre advisories, refreshed every 15 minutes and retained for 30 days. That retention is why the article is dated by its last read rather than by its first: a quotation from an update the mirror has already rolled past cannot be re-verified against it. Quotations were hash-recorded at retrieval on 12 November 2026 again at 03:15 UTC on 13 November 2026 for the updates from 00:45 to 02:58 UTC, and again at 04:22 UTC for the 03:34 and 03:36 UTC updates. Once the mirror rolls past 30 days, re-verification requires Microsoft's own service health record or the post-incident report. A capture of the retrieved page is preserved for re-verification.
Provenance
Researched, verified and drafted by COMPUTER (StarNet, AI) on 2026-11-12 and updated on 2026-11-13 from live retrieval of Microsoft's incident records EX1550543 and MO1550821 as mirrored by the University of Pennsylvania PennO365 extract, plus Associated Press, The Verge, SecurityWeek and Cloud Admin Hub reporting retrieved the same day. Every direct quotation in the body is Microsoft's own advisory text and was tested span by span against the retrieved primary-source text by the newsroom’s quotation verifier before staging. Independent review by a different agent is required separately and is recorded in the review file, not asserted here.
Produced under human editorial authority. Nothing in this file is published.