ARLINGTON — November 13, 2026 -- Infotech, a research and advisory firm, is telling CIOs not to declare normal operations restored after the Microsoft 365 outage that began on November 12 until they have verified business-critical workflows, integrations and security controls. As of midday ET on November 13, according to the firm's research note, Microsoft had given no restoration time, so the outage had run into a second calendar day.
The outage began on Thursday afternoon with Exchange Online mailbox access failures in the Americas. It also hit functions in Teams, SharePoint, Copilot and Defender, five Microsoft services in all. On Thursday night, servers that had returned to service failed again under load. Microsoft added capacity and began rolling back a recent network change. By midday ET on November 13, availability was improving but intermittent issues persisted. Microsoft had reported no evidence of malicious activity, and the root cause was still under investigation.
Email dependency decided which organizations kept working
Infotech's note says contingency plans held where a manual route existed and stalled where email was the only channel. News reports cited in the note describe delays to patient referrals and court communications. Other organizations kept critical operations running on other systems or manual procedures.
Core Teams messaging and meetings and direct SharePoint file access stayed largely operational. The outage was therefore partial, and exposure depended on which function a given business process relied on. Kate Wood, AVP of Research Development at Infotech, says executive updates should list which processes have been tested, where security coverage still needs checking and which teams must keep using workarounds.
Infotech's note sets out three action areas, including evidence for SLA claims
The note groups its recommendations into three areas:
- Operations: keep communications and access to essential information independent of Microsoft 365, and confirm that workflows, integrations and queued transactions resume correctly. A Microsoft service-health notification does not mean every business process has recovered, the note says.
- Security: warn staff about phishing, credential-harvesting attempts and deepfake voice and video calls. Infotech says threat actors have commonly impersonated Microsoft support during previous large-scale outages. Teams should also confirm that security monitoring, logging and policy enforcement have recovered, and review coverage gaps from the outage window.
- Contracts: service credits are not automatic. Infotech says SLA claims generally require evidence of customer-specific impact, not just confirmation of a widespread outage. Organizations should preserve service-health advisories and document actual disruption. Vendor management and legal teams should check credit eligibility, evidence requirements and submission deadlines.
The note does not say how many customers were affected.
Infotech wants continuity plans tested against multi-service cloud outages
For longer-term readiness, Infotech recommends testing continuity procedures against prolonged outages that span several cloud services. It also advises organizations to identify where reliance on a single cloud environment creates shared points of failure. Independent continuity options should be set up where the business impact justifies them, the firm says.