Microsoft 365 down for more than a day: what a non-malicious failure means for cyber underwriters

Since 12 November 2026 a server failure at Microsoft 365 has stopped Outlook, Exchange Online and other services in at least 74 countries, with no sign of an attack. The analysis: why many cyber policies do not trigger, waiting periods and quantification, aggregation on a single supplier and questions for renewals.

Analysis of 13 November 2026, with the outage still ongoing · by cybercoverinsurance

On Thursday 12 November 2026, at around 17:30 London time, Outlook, Exchange Online and other Microsoft 365 services stopped working for millions of users, first in the Americas and then in other regions. On 13 November recovery was under way but not complete: Microsoft reported improvements in North America and Europe and warned that intermittent issues could continue. According to Microsoft there is no sign of malicious activity.

For the insurance market the case is another non-malicious failure of a major supplier, a little over two years after CrowdStrike. Morningstar DBRS's first estimate puts global insured losses at 300 to 500 million dollars. The question for cyber underwriters is which policies actually respond to downtime that does not come from an attack, and how much the dependency on a single email and collaboration provider weighs.

What is known

The start. According to TechRadar, Downdetector reports climbed at around 12:30 US Eastern time on 12 November, with more than 131,000 reports for Outlook at the peak. The outage reached at least 74 countries. Microsoft logged incidents EX1550543 and MO1550821 in the Microsoft 365 admin center (TechRadar).

The stated cause. Microsoft attributed the problem to elevated load across several regions, caused by a large number of servers becoming unexpectedly unavailable rather than by higher traffic. It paused all deployments, shifted traffic, restarted affected servers and said some actions had not provided the expected relief (ABC News). According to ABC Australia, Microsoft later pointed to a core server process that was being overwhelmed and reverted a recent network configuration change it believed might be linked (ABC Australia).

The services. Microsoft's status page listed Exchange Online, Teams, SharePoint Online, Copilot for Microsoft 365 and Defender XDR (TechRadar). ABC Australia also reports Planner, To Do, Intune, Purview, Power BI, Power Apps and Universal Print, with direct SharePoint file access still working.

The effects. New York City's Emergency Management Department warned of possible delays in city agencies' online services (ABC News). In Australia those affected included the Federal Police, the New South Wales online bail court and Canberra Health Services, with no known clinical impact; the Australian government activated an agreement with Microsoft to obtain priority support (ABC Australia). In the UK, councils and police forces asked people to phone instead of email (TechRadar). In Toronto, St. Michael's Hospital declared a "code grey", the internal alert for infrastructure failure (Insurance Business).

The recovery. On 13 November Microsoft reported "encouraging recovery progress", with capacity not yet back to normal and traffic being reintroduced carefully. It extended the email timeout window to 48 hours so that delayed messages are not lost (TechRadar).

What is not known. The total duration, the final cause and the number of organisations affected are not yet known.

Cyber policies that do not trigger

An attack, or at least a suspicion, is needed. Joe Hershewe, claims practice leader at Bellrock Advisory in Sydney, notes that most cyber wordings need an actual or suspected breach to respond, and doubts that affected insureds will meet that threshold (Insurance Business). A supplier failure without intrusion stays outside the main insuring agreement.

System failure is an extension, not the rule. Some policies also cover interruption from non-malicious failure, the insured's own or a supplier's. Hershewe notes that cover for widespread events exists, with its own criteria, but is not standard in mid-market wordings (same source). For underwriters, the Microsoft case is the moment to check how many insureds actually have this extension and with what limits.

The supplier must be included. Dependent business interruption covers a supplier's downtime, but often only for named suppliers or specific categories, such as IT service providers. A cloud email and collaboration service usually falls within the definition, but the wording must be read: some policies exclude failures of public infrastructure or of large cloud providers.

The waiting period and quantification

Hours matter. Business interruption cover has a waiting period, set in hours by the policy, before downtime becomes indemnifiable. Morningstar DBRS points out that waiting periods, deductibles and sublimits will decide claim outcomes (Actuarial Post). An outage of more than a day exceeds many waiting periods; a patchy recovery, region by region, makes it hard to establish when the downtime ended.

Partial downtime is hard to measure. Losing email does not necessarily stop the business: many companies kept working by phone and with shared files. For loss of income, the insured has to show a fall in revenue or an increase in costs linked to the outage. For professional firms the impact can be high: a consultant quoted by ABC Australia estimates more than 100,000 dollars an hour for professional services firms, an unverified estimate (ABC Australia).

Extra costs. Easier to document are extraordinary costs: staff overtime, alternative tools, communications to customers. Many policies cover them as costs to reduce the loss, even when loss of income is disputed.

Aggregation on a single supplier

A cautious estimate. Morningstar DBRS estimates global insured losses at 300 to 500 million dollars, below CyberCube's 400 million to 1.5 billion range for CrowdStrike in 2024. The difference is due to exclusions for non-malicious technology failures. According to the same source, if the outage lasted several days the event could become as serious as CrowdStrike or worse (Actuarial Post).

Concentration on Microsoft 365. Email, calendar, file storage, authentication and endpoint security often come from the same provider. A failure in a shared component stops several functions at once. The services affected included Defender XDR (TechRadar): when the security tool goes down, the insured is less protected just as fraudsters exploit the event.

The scam that follows the failure. ING warned customers about scammers offering to "fix" the outage (ABC Australia). A non-malicious failure can generate malicious claims: phishing, payment fraud, access by fake technicians. These claims do fall within ordinary cyber cover.

Data leaving the perimeter. Ali Yavari, associate professor at Swinburne University of Technology, flags the risk of employees using personal accounts to move data during the outage (Insurance Business, US edition). It is a data exposure that may surface weeks later, as a confidentiality breach.

What to bring to renewals

Impact for insurersHigh

A non-malicious Microsoft 365 failure, lasting more than a day across several regions, tests system failure and dependent business interruption cover across the portfolio, with a first estimate of 300 to 500 million dollars in insured losses.

On the portfolio side, the case suggests counting how many insureds have the system failure extension for cloud providers and with what waiting periods, and including in aggregation tests a scenario of 24 to 72 hours without Microsoft 365, separating losses from pure failure from those from the fraud and phishing that follow. The final estimate will depend on the duration, which is still open.