Microsoft 365 outage raises concerns over weakened security controls and increased phishing risks

Zensec is urging businesses to review their cyber security measures following a global Microsoft 365 outage affecting email, collaboration tools and several services used to protect businesses against cyber threats.

A widespread Microsoft 365 outage, which began at approximately 18:00 UTC on 12 November 2026, has disrupted services used by organisations and individuals worldwide.

The disruption has affected Exchange Online and a range of connected Microsoft 365 services, including Outlook, Teams calendar functionality, Copilot, Planner, To Do and parts of SharePoint.

More significantly, several security services have also reported degradation, raising concerns about organisations’ ability to prevent, detect and respond to cyber threats while the incident continues.

Microsoft’s public service status page has reported service degradation affecting Microsoft 365 business and enterprise services, as well as consumer products. Microsoft Azure, meanwhile, is reporting no issues.

Microsoft has stated that it is not aware of any malicious activity causing the incident. Its investigation has identified a large number of servers becoming unexpectedly unavailable, with recent configuration changes being considered as a potential contributing factor.

However, while the incident is not currently believed to be a cyber attack, its consequences create additional security risks for affected organisations.

Security controls affected by the disruption

The outage has affected several Microsoft services that organisations depend on to maintain their security. Microsoft Defender for Office 365, which provides protection against malicious emails, links and attachments, has reported issues affecting Safe Links, Safe Attachments, quarantine, Threat Explorer and email remediation capabilities.

This could reduce organisations’ ability to identify, investigate and remove malicious messages.

Microsoft Defender XDR has also experienced disruption, with some portal pages and solution tabs failing to load. This could limit security teams’ visibility of potential threats and slow incident response.

Microsoft Purview, which supports data protection and compliance, has reported issues affecting Data Loss Prevention (DLP), Information Protection labelling, audit searches and eDiscovery. This raises concerns about the enforcement of data protection policies and the availability of audit evidence during the outage.

Other affected services include Microsoft Intune, where device enrolment, check-in and compliance policies have experienced intermittent issues, and Microsoft Graph, where requests accessing Exchange data may time out.

For organisations relying on these services, the disruption could mean security controls are not operating as expected, monitoring information is incomplete or access decisions are being made using outdated device compliance information.

Organisations should therefore treat the outage period as one of reduced security assurance until their controls have been tested and confirmed as fully operational.

The risk of insecure workarounds

Operational disruption inevitably creates pressure to keep business activities moving. However, when employees cannot access familiar systems, there is a risk that they will turn to alternative methods of communication and file sharing that introduce additional security vulnerabilities.

These may include using personal email accounts, consumer messaging applications, unapproved cloud storage or setting up automatic forwarding rules to external email addresses.

Temporary changes to security policies, mail routing and access controls can also introduce weaknesses if they are not properly documented and reversed. Organisations should record any workarounds, exceptions or configuration changes introduced during the outage and ensure these are reviewed once services return to normal.

Cybercriminals may exploit the disruption

Although Microsoft has stated that it is not aware of malicious activity causing the outage, organisations should also prepare for the possibility of criminals exploiting the situation.

High-profile service disruptions provide opportunities for attackers to target businesses and individuals who may be distracted, frustrated or uncertain about how to restore access to their systems.

Potential phishing and fraud attempts include:

• Fake Microsoft or IT support emails asking employees to verify accounts, reactivate mailboxes or recover undelivered messages.
• Fraudulent notifications claiming messages have been quarantined or held, encouraging users to click links to release them.
• Impersonation calls or messages from individuals posing as IT support, requesting passwords, authentication codes or remote access.
• Unexpected multi-factor authentication prompts designed to coincide with fake service restoration notifications.
• Counterfeit Microsoft status pages, technical fixes, software downloads and post-incident reports.
• Invoice and payment fraud, including requests to use new email addresses or updated bank details.
• Fake offers of refunds or service credits requiring users to provide account or payment information.

These threats may continue beyond the immediate outage, particularly as organisations begin restoring services and working through delayed communications.

Employees should be reminded to treat unexpected messages about the outage with caution, avoid clicking unfamiliar links and never share passwords or one-time authentication codes. Microsoft’s genuine public service status page is available at status.cloud.microsoft.

What should organisations do now?

While the disruption continues, IT and security teams should monitor Microsoft’s service updates and communicate with employees through alternative channels where necessary.

Organisations should also:

• Issue staff guidance warning about outage-related phishing and impersonation attempts.
• Monitor identity and sign-in alerts where available, particularly unusual login activity and repeated authentication requests.
• Discourage the use of personal email and unapproved file-sharing services.
• Maintain a record of temporary workarounds, policy exceptions and configuration changes.
• Ensure employees know how to report suspicious activity if normal communication channels are unavailable.

Security checks to prioritise once services return

Service restoration should not automatically be treated as confirmation that all security controls are functioning correctly. Once services are restored, organisations should undertake a series of checks to establish whether their security posture has returned to normal.

These should include:

• Confirming that Safe Links, Safe Attachments, anti-phishing and Data Loss Prevention policies are operating correctly.
• Reviewing delayed emails as they are delivered and investigating suspicious messages.
• Checking for unexpected inbox rules, external forwarding arrangements, changes to mail flow and newly granted application permissions.
• Reapplying any sensitivity labels removed as temporary workarounds.
• Confirming that Intune device compliance information is current.
• Checking that security monitoring, backup and automation tools using Microsoft Graph have recovered and that any missing data has been identified.
• Reviewing audit records for the outage period once audit search functionality becomes available.
• Reversing temporary workarounds and security exceptions introduced during the incident.

Organisations should also review Microsoft’s eventual post-incident report and consider whether their business continuity arrangements provide sufficient resilience against similar disruptions.

Service availability is not the same as security resilience

The Microsoft 365 outage highlights how heavily organisations depend on interconnected cloud services, not just for everyday business operations but also for maintaining their security.

Even when an incident is not caused by malicious activity, disruption to the systems responsible for protecting an organisation can create opportunities for attackers and expose weaknesses in business continuity arrangements.

The priority for organisations should therefore extend beyond restoring access to services. They must also ensure that security controls are functioning correctly, temporary workarounds have been removed and any gaps in monitoring or audit records have been addressed.

The key message is simple: getting back online is only part of the recovery process. Organisations must also make sure they are secure.