Microsoft experienced one of its biggest global outages on Thursday, with thousands of clients worldwide reporting that they couldn't connect to services such as Outlook, Microsoft 365, and Teams.
While the company hasn’t issued a final resolution, and the problem reached Asia-Pacific on Friday, most experts ruled out the possibility that the incident was the result of a cyberattack.
According to official Microsoft statements, the company was investigating a possible internal error that prompted the accounts to be disconnected from the North American servers, and a domino-like effect after those accounts were moved to other servers around the world.
According to initial estimates, the surge in traffic to those servers caused delays and further outages, and some companies had to send employees home early because of the persistent connection issue.
In technical terms, the first assessment indicates that some of its servers failed a health check, prompting the connection disruption and the redistribution of users to servers in other parts of the world.
Experts indicate that because the issue was not a cyberattack, Microsoft will likely have to identify the exact server that failed the health check and triggered the massive outage.
Why wasn’t it a cyberattack against Microsoft?
While it won’t be possible to establish the real incident until Microsoft issues a public status report and completes an internal investigation, three facts push the cyberattack theory aside.
Firstly, Microsoft's assessment describes the solutions it's implementing as an internal investigation into issues from its own servers rather than a cyberattack from outside.
Second, no spike in users indicated the company suffered a Distributed Denial-of-Service (DDoS) attack, with most reports showing normal user levels.
Third, no hacker group announced it had attacked Microsoft, even after service was down for several hours and thousands of people reported disruptions worldwide.
Outage reaches Israel, with reports in Haifa, Tel Aviv, Jerusalem
According to Downdetector, the Microsoft incident reached servers in Israel, with disruptions detected in Tel Aviv, Jerusalem, and Haifa.
The incident also affected Outlook, while Microsoft 365 services and Copilot, Microsoft's AI assistant, also faced similar disruptions.
The incident has been active for over 12 hours worldwide, with the latest reports on Friday indicating that users in the Asia-Pacific region also started to report disruptions in the services.
Similar incidents reported recently
Back in January, a similar outage, on a much smaller scale, lasted almost nine hours, with about 3,000 reports on Downdetector.
In that case, the public assessment was that disruptions were triggered when one of the data centers in Cheyenne, Wyoming, was taken down for maintenance, with a cascading effect similar to the most recent one.
Last year, in October 2025, a massive disruption of Amazon Web Services (AWS) knocked out thousands of websites along with some of the world's most popular apps - Snapchat and Reddit - and disrupted businesses globally.
That incident was also described as an internal error rather than a cyberattack, with Junade Ali, a software engineer, cyber expert, and Fellow at the Institution of Engineering and Technology, telling Reuters that the issue appeared to involve one of the networking systems AWS uses to control a database product.
"As this issue can usually be resolved centrally ... unless there are further issues identified, the issue should be able to be mitigated over the coming hours," he said.
The turmoil marked the largest internet disruption since last year's CrowdStrike malfunction hobbled technology systems in hospitals, banks and airports, and highlights the vulnerability of the world's interconnected technologies.
Reuters and James Genn contributed to this report.