[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvyifVuQMymHKNe8zB-jOoFr8ogbeMI8-jb-CQsUqWmk":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"bc24a166-24d5-4875-bce0-e9842c51b987","Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive","microsoft-365-massive-outage-fixes-fail-as-restored-servers-keep-going-unrespons-873bde","Microsoft has yet to find a fix that holds for the global Microsoft 365 outage, which has now run for more than 10 hours. Servers that engineers bring back online are falling over again as soon as user traffic reaches them. The outage began on November 12, 2026, and continued through November 13. As we […] The post Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive appeared first on Cyber Security News.","A global Microsoft 365 outage, beginning on November 12, 2026, has impacted services including Exchange Online, Outlook, Teams, SharePoint, Copilot, and Microsoft Defender XDR. Engineers are struggling to restore server stability, as restarted servers become unresponsive again under user traffic. Microsoft is implementing traffic limiting, server rebuilds on previous configurations, and traffic rerouting as fallback measures, with partial recovery observed in some regions.","Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.","https:\u002F\u002Fcybersecuritynews.com\u002Fmicrosoft-365-massive-outage-fixes-fail-as-restored-servers-keep-going-unresponsive\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMicrosoft-365-Outage-Disrupts.webp","2026-11-13T06:52:50+00:00","2026-11-13T08:00:28.2642+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Exchange Online",{"name":23,"type":19},"Outlook",{"name":25,"type":19},"Teams",{"name":27,"type":19},"SharePoint",{"name":29,"type":19},"Copilot","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18,21,27],{"controls":51,"vendors":133},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"databahn","DataBahn","\u002Fvendor-logos\u002Fdatabahn.png","databahn-data-pipeline","DataBahn Data Pipeline","https:\u002F\u002Fwww.databahn.ai\u002Fproducts\u002Fdata-pipeline","Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",{"slug":82,"name":83,"problem":84,"products":85},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"slug":111,"name":112,"problem":113,"products":114},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[115,120,125],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":116,"product_name":117,"url":118,"description":119},"mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":121,"product_name":122,"url":123,"description":124},"unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[134],{"slug":95,"name":96,"logo_path":97,"roles":135},[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":146},"microsoft-365-global-outage-exposes-gaps-in-resilience-and-configuration-recovery","Microsoft 365 Global Outage Exposes Gaps in Resilience and Configuration Recovery","A widespread Microsoft 365 outage demonstrated how cascading server instability can defeat standard recovery procedures when restored systems repeatedly fail under real traffic load. The core problem appears rooted in a flawed configuration state that persists through restarts, meaning engineers could not simply reboot their way to stability. This matters because millions of organizations depend on Microsoft 365 for mission-critical communications, collaboration, and security tooling, making prolonged unavailability a significant operational and business risk. The incident highlights that cloud providers and their enterprise customers both need robust fallback plans, including pre-tested alternative workflows, when primary SaaS platforms become unavailable.",[142,143,144,145],"NIST CSF 2.0 RC.RP-01: Recovery Plan Execution","NIST SP 800-53 CP-10: System Recovery and Reconstitution","NIS2 Article 21(2)(c)","CIS Control 11: Data Recovery",{"NIS2 Article 21(2)(c)":147,"CIS Control 11: Data Recovery":148,"NIST CSF 2.0 RC.RP-01: Recovery Plan Execution":149,"NIST SP 800-53 CP-10: System Recovery and Reconstitution":150},"This point mandates business continuity and crisis management measures, which organizations relying on Microsoft 365 needed to invoke when the provider's own recovery repeatedly failed over an extended period.","CIS Control 11 asks organizations to establish and test recovery capabilities; a prolonged, multi-region SaaS outage is precisely the scenario where pre-tested recovery and continuity procedures must be ready to execute immediately.","This category requires organizations to execute recovery plans during disruptions; the outage revealed that Microsoft's own recovery procedures (server restarts, traffic limiting) were insufficient and that customers lacked tested plans for extended cloud provider unavailability.","CP-10 requires that systems be recoverable to a known secure state after disruption; the repeated failure of restarted servers under traffic load indicates the target configuration state was not stable or validated before restoration."]