Office 365 Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Office 365 Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Mr Brute (@BuddyNoLove) reported 5 minutes ago

  Is there an office365 outage? I can’t authenticate to Teams or Outlook 🫠

• 
  Jelly_Babe (@jelly_beyb) reported 6 minutes ago

  Office 365 not working in android devices

• 
  Spicy Ice (@SpicyIce7) reported 7 minutes ago

  @EvaAnanova Bro i remember I got put on a migration from a file server to office 365 and share point and this was a key reason I left IT. My manager refused to listen to anyone and forced us to go ahead with this just before Christmas. It didn't work 90% of the machines had 4gb ram

• 
  Shane (@Shane_L) reported 12 minutes ago

  @adahstwt Just deployed a small app for one of my company’s franchisees to use. Deployed on Azure because we use Office 365 and I could rely on existing MS accounts for auth. Never again… terrible experience. Azure is so disjointed…

• 
  Microsoft Threat Intelligence (@MsftSecIntel) reported 13 minutes ago

  Microsoft Threat Intelligence has identified a cluster of compromised websites displaying ClickFix lures and using EtherHiding, a technique associated with the ClearFake campaign. An injected Base64-encoded JavaScript contacts a BNB Smart Chain RPC gateway to query a smart contract previously reported in connection with ClearFake to fetch next-stage instructions. Content stored in a smart contract is resistant to conventional takedown or sinkholing because only the owner of the cryptocurrency wallet that deployed it can make changes. Users are presented with a fake CAPTCHA that instructs them to open the Windows Run dialog, paste clipboard content, and press Enter to execute an attacker-supplied command under the guise of verification. We’re seeing multiple forms of command obfuscation and living-off-the-land abuse, including conhost, cmd, PowerShell, pcalua, mshta, rundll32, msiexec, curl, WMI, WebDAV, and scheduled tasks. Carets split keywords, environment variables hide interpreters, and Windows run headlessly or minimized. TerminalFix lures apply the same technique but direct users to Windows Terminal or PowerShell instead of the Run dialog. This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique. Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages. Numerous actors use the technique to deliver Lumma Stealer and other infostealers, RATs such as Xworm and AsyncRAT, loaders including MintsLoader, and remote management tools. A single successful execution can expose credentials, establish persistence, enable lateral movement, and create a path to human-operated ransomware and potential domain compromise. Microsoft recommends that organizations enable Microsoft Defender network, web, and cloud-delivered protection; restrict Run and command-line tools where not required; enable PowerShell script-block logging; and implement application control. Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt. Microsoft Defender XDR provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Suspicious command in RunMRU registry”, “Possible ClickFix activity”, “Possible initial access from an emerging threat”. Microsoft Defender Antivirus blocks malicious command execution using detections such as Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*. Treat these alerts as evidence of a potential initial access incident: isolate affected devices, investigate credential exposure and persistence, and hunt for related activity.

• 
  🇵🇭Homoludens Pro Deluxe🏳️‍🌈🌏 (@a_space_alien) reported 14 minutes ago

  Yep this is what I’ve always known. Problem is that Microsoft keeps treating XBox as if it were Windows, Azure, Office 365 and all its other business & productivity products & services, where there’s no respect for games as entertainment, experience and as an art form. #HearYou

• 
  HectorE (@HectorE88315654) reported 15 minutes ago

  @BrianRoemmele And now they’re blocking the installation of Claude extension for their Office 365 products, there are reported issues this weekend of problems with this, I tried to install it and it marked an error , and investigating online I saw many users reported this issue.

• 
  purana (@purana) reported 16 minutes ago

  Noticed Microsoft is still shoving stuff down our throats. I have Office 365 without the AI stuff, and noticed the app now has a diamond in the top right corner on apps which is where they push to you AI upgrades.. Just give me the app without all the extra pushed crap.

• 
  Eric Sauvageau (@RMerlinDev) reported 18 minutes ago

  @Diss0lution For many years now, the Office 365 installer is broken in French, instead of showing something like "90% complété" in the system notification icon, it says "90lformat error! complété" - incorrectly parsing the percent sign as a parameter. Trillon dollars company at work.

• 
  DFIR Radar (@DFIR_Radar) reported 20 minutes ago

  Silk Typhoon (HAFNIUM), a Chinese 🇨🇳 state APT, has evolved from on-prem Exchange exploitation to cloud-native supply chain attacks, most recently abusing CVE-2025-3928 in Commvault's Azure-hosted M365 backup SaaS to pivot into downstream customer tenants. - Initial access spans three vectors: CVE-2025-3928 (zero-day in Commvault Web Server, T1190), stolen API keys from privileged cloud vendors (T1195), and leaked corporate credentials found on public repos like GitHub (T1078.004). The Commvault campaign gave them client secrets for Metallic M365 backups, opening direct paths into customer M365 environments via hijacked service principals. - Lateral movement pivots from on-prem to cloud by targeting Entra Connect servers (T1210, T1078.002), enabling privilege sync between Active Directory and Entra ID. Credential dumping and key vault theft support pass-the-hash moves (T1550.002) into Azure. - Persistence relies on adding passwords to existing consented service principals or creating new Entra ID applications named to mimic legitimate Office 365 services (T1098.001, T1036). Web shells handle C2 on compromised Azure VMs (T1505.003). - Collection targets email via EWS and MSGraph APIs, plus SharePoint (T1213.002) and OneDrive (T1213.003), all through OAuth apps with admin consent, a low-noise, API-native exfiltration path that bypasses many endpoint controls. #DFIR_Radar

• 
  Glich (@Glich) reported 20 minutes ago

  @yonann partly true. I work corp IT. A good part of my users whould be fine with a snapdragon chromebook. But they get tier Ryzen 9 or I7 . All their work in in office365 and chrome. and this year our standard low spec model we issue increased in price 50%.

• 
  BriBiotech (@bribiotech) reported 22 minutes ago

  Unbelievable how @MicrosoftStore is able to proudly sell a product that ls broken out of box. Got office 365 business premium and calender doesn't show teams plugin no meetings can be created with teams invite from outlook and this is not a local issue

• 
  CLONEO.IN (@cloneoapp) reported 28 minutes ago

  The first use case of AI should have been to fix adjusting images on MS WORD @Office365 @Microsoft

• 
  Black Edge (@BlackEdgeFund) reported 28 minutes ago

  Microsoft is starting to show up on deep value screens. This is not a broken company. This is not a melting ice cube. This is the most dominant software business ever built — Office, Azure, Teams, LinkedIn, GitHub, Copilot — and it is sitting significantly off its all time highs. The market spent three years pricing Microsoft as an AI winner at any price. Multiple expansion took valuation to levels that required flawless execution forever. When the AI trade started rolling over, Microsoft got caught in the wreckage — not because the business broke, but because the price was simply too high. Now the price is coming to the business. Azure growth is still compounding. Office 365 pricing power is intact. Free cash flow is a machine. The balance sheet is a fortress. Copilot monetization has barely started. This is what deep value in megacap tech looks like. It does not look like a disaster. It looks like a great business having a bad year in the market. The distinction matters enormously. Great business. Washed out price. The market is handing you an entry into the best software company on earth at a discount it has not offered in years.

• 
  ZBM2 (@zulubravomike2) reported 29 minutes ago

  Assume low data rate and high ping. Now assume you're trying to log in to an Office 365 implementation of some sort. All that said, while astronauts are professionals, they're not IT pros and probably couldn't tell you the difference between outlook and an exchange server.