Office 365 Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Office 365 Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Microsoft Threat Intelligence (@MsftSecIntel) reported 1 minute ago

  Microsoft Threat Intelligence has identified a cluster of compromised websites displaying ClickFix lures and using EtherHiding, a technique associated with the ClearFake campaign. An injected Base64-encoded JavaScript contacts a BNB Smart Chain RPC gateway to query a smart contract previously reported in connection with ClearFake to fetch next-stage instructions. Content stored in a smart contract is resistant to conventional takedown or sinkholing because only the owner of the cryptocurrency wallet that deployed it can make changes. Users are presented with a fake CAPTCHA that instructs them to open the Windows Run dialog, paste clipboard content, and press Enter to execute an attacker-supplied command under the guise of verification. We’re seeing multiple forms of command obfuscation and living-off-the-land abuse, including conhost, cmd, PowerShell, pcalua, mshta, rundll32, msiexec, curl, WMI, WebDAV, and scheduled tasks. Carets split keywords, environment variables hide interpreters, and Windows run headlessly or minimized. TerminalFix lures apply the same technique but direct users to Windows Terminal or PowerShell instead of the Run dialog. This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique. Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages. Numerous actors use the technique to deliver Lumma Stealer and other infostealers, RATs such as Xworm and AsyncRAT, loaders including MintsLoader, and remote management tools. A single successful execution can expose credentials, establish persistence, enable lateral movement, and create a path to human-operated ransomware and potential domain compromise. Microsoft recommends that organizations enable Microsoft Defender network, web, and cloud-delivered protection; restrict Run and command-line tools where not required; enable PowerShell script-block logging; and implement application control. Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt. Microsoft Defender XDR provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Suspicious command in RunMRU registry”, “Possible ClickFix activity”, “Possible initial access from an emerging threat”. Microsoft Defender Antivirus blocks malicious command execution using detections such as Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*. Treat these alerts as evidence of a potential initial access incident: isolate affected devices, investigate credential exposure and persistence, and hunt for related activity.

• 
  Glenn 🇺🇲⚓️ (@gcanderson57) reported 4 minutes ago

  It's been a stereotypical Monday. Was awake most of the night. Good news is I didn't have to get up at a certain time for anything. Woke enough to coherent at 1100 am. Text messages from a IT customer about hacked email. Determined that last week he got an email saying to check out this file. It was a PDF stored somewhere else. It grabbed his email password. 😒🫤 Logged in & changed his password. Waited for him to get into office so I could clean his PC remotely. Then reset email password again and give him new one. Meanwhile my van which I bought for $4000 "as is" in February 2001 has decided it's time for the ABS module to fail! 😐 It's a 2009 VW Routan (aka rebadged Chrysler Minivan). I've accepted the fact that I got 5 years and I probably need to just replace it. 😕 Cost of repairs probably around $2500-$3000. And then Finally just saw MS is having issues with Exchange email and parts of the Office 365 product suite. Hopefully everyone else is having a good day.

• 
  The 5th Estate (@The_5thEstate) reported 5 minutes ago

  @clnuponaisle5 Most cloud services let you upload encrypted data to. I use OneDrive because the Office 365 subscription gives 1tb of storage space and integrates with the Windows OS really well. I encrypt my files before uploading and it has no problems.

• 
  Adrien Barr (@AdrienBarr73223) reported 8 minutes ago

  Microsoft Azure is not responding to trouble ticket @AzureSupport 2604020010004795. It was opened 4/2/2026 and there hasn't been a technician assigned yet. Users cannot logon to Azure /Entra accounts including Office 365 business premium

• 
  DFIR Lab (@DFIR_Lab) reported 8 minutes ago

  🎣 DFIR Suite API Spotlight: CheckPhish URL Scan You're triaging a suspected phishing email. The URL looks clean in VirusTotal. No hits in your threat intel feeds. But something feels off. This is where POST /phishing/checkphish earns its keep. It scans URLs in real-time using CheckPhish's detection engine — purpose-built to catch live phishing pages, tech support scams, and brand impersonation attempts that haven't made it into static blacklists yet. What you get back: disposition (clean/suspicious/phishing), the brand being targeted (Microsoft, PayPal, etc.), and a screenshot of the rendered page. That screenshot alone can confirm what logs can't — whether it's a convincing Office 365 login clone or a legitimate site. Practical scenario: User forwards you a "verify your account" email with a shortened link. You expand it, run it through /phishing/checkphish, and within seconds you have a verdict and visual proof. No need to spin up a sandboxed browser or wait for threat intel to catch up. Costs 2 credits per request. Available on all plans at hXXps://platform[.]dfir-lab[.]ch It's a fast, reliable check for the URLs that don't trigger your existing defenses — but probably should. #DFIR #ThreatIntel

• 
  HectorE (@HectorE88315654) reported 14 minutes ago

  @BrianRoemmele And now they’re blocking the installation of Claude extension for their Office 365 products, there are reported issues this weekend of problems with this, I tried to install it and it marked an error , and investigating online I saw many users reported this issue.

• 
  Bad **** (@TeaseTech) reported 15 minutes ago

  @nicochristie HTML attachments are one of the most abused vectors for phishing, fake login pages, and credential-harvesting scripts. Because of this: Microsoft 365 / Exchange Online Policies: Most IT administrators enable Defender for Office 365 filters

• 
  Luke Parrish (@lsparrish) reported 20 minutes ago

  @esrtweet I think Excel is the grand bottleneck, or was last I checked. Imagine trying to switch a bank, say your local credit union, over to LibreOffice or any of the StarOffice lineage. Doable in principle, but realistically all the macros are broken (the version of BASIC differs from Excel) and the median banker doesn't have muscle memory for the new keyboard shortcuts anyway. You can obviously use Office 365 from a browser, but you lose access to some features (again, last I checked) and it's still Microsoft. Linux is absolutely fine for everything I use it for. The problem is mostly just lack of attention on things that people who have already adopted it don't themselves need. Window Manager wise, there are several where it's hard to tell the difference between that and Windows or MacOS (or the difference is ~entirely good things).

• 
  chris (@xH4ngEm) reported 22 minutes ago

  There's a question I get asked constantly by investors building individual accounts: how much of a single name is too much? Been sitting with this in the context of the Revere Gro and Rair exposure framework circulating around $MSFT positions. The model tries to map concentration risk across growth-rate sensitivity and rate-cycle sensitivity - not a bad starting structure. But I think it locates the problem slightly wrong. For a long-horizon value investor, risk management is not primarily about volatility. It's about permanent capital impairment. Those are genuinely different things, and conflating them leads to genuinely different mistakes. MSFT at current prices trades around 32-33x forward earnings. P/B north of 13. EV/EBITDA in the high 20s depending on the quarter. Not cheap multiples by historical standards - even for a business generating the FCF that Microsoft does. And the FCF is real: Azure margin expansion, Office 365 recurring, Activision slowly integrating. The capital allocation story holds up - disciplined buybacks, a growing dividend, R&D spend that's actually productive rather than defensive. ROIC consistently above cost of capital. The moat is not in question. But here's the thing about exposure management in individual accounts specifically: when you hold a concentrated position in a company priced for near-perfection, your margin of safety becomes structural rather than mathematical. You can't just point at the balance sheet and call it hedged. The Rair framing - rate-adjusted intrinsic return - is useful because it forces the right question: if the 10-year rises another 100bps from here, does this company's intrinsic value hold? For MSFT, probably yes. The business doesn't need cheap debt to function. It generates cash in almost any macro environment. The moat doesn't erode with rates. But position sizing is where individual investors chronically underperform. Institutions manage downside scenarios as a daily operational function. Individual investors size based on conviction - and conviction is not risk management. Conviction is the justification for taking risk. Risk management is the system of rules that governs how much risk you actually accept. Practical framework, after holding through multiple cycles: - If you can articulate the bear case (multiple compression, Azure growth deceleration, AI capex overhang not yet reflected in FCF) and still sleep at night at 10-12% allocation, that's probably the rational ceiling for a concentrated individual book. - If a 20% drawdown in this one name would materially alter your financial situation, you've crossed from investing into speculating on management quality and multiple expansion. The Revere Gro side of the concept is really just another way of saying: don't let a great company become a great risk by virtue of how much of your book it occupies. The business quality and the position size are separate questions that individual investors routinely collapse into one. Balance sheet analysis matters. FCF trajectory matters. They're inputs into a position-sizing decision - not substitutes for one. That distinction is the actual heart of risk management in individual accounts, and most frameworks bury it. Long MSFT. Have been for years. Never let it exceed 12% of the book regardless of how strongly I believe in the thesis. That ceiling is a feature.

• 
  Matt Diebolt (@mdiebolt) reported 23 minutes ago

  @domster @bradgessler Our biggest are by far the ones that support our PowerPoint for Office 365 add-in. Places where you have a JavaScript API where it’s impossible for it to be managed on the server.

• 
  Nicholas Harris 🦖 (@_________4women) reported 27 minutes ago

  @DoWhatYouDo6 I thought they: 1. were serious about developing the next-gen XBOX console with AMD which was codenamed Project Magnus under the leadership of Sarah Bond. 2. the cost of RAM and SSDs skyrocketed so its specification was unaffordable and Satya Nadella quietly cancelled Project Magnus, but expected Sarah to lie to the community that they were still manufacturing hardware, to buy their engineers time to work on Windows 12 X and then have OEM bring out PCs that conformed to the Windows 12 X reference specification, that requires the AMD Magnus SoC which does Path Tracing. The initial spec. was 48 GB GDDR7 RAM which was probably for the dev kit, and since they are talking about using Neural Texture compression they might only need 32 GB for retail. However, this PC could cost as much as $4,000 and it would outperform self-builds that are $10,000 so that price, whilst unaffordable for XBOTs, is value for money for a consumer who is wealthy and could afford to buy more software, but realistically will tend to only play a couple of games (e.g. their Microsoft Flight Simulator, or Forza Horizon 6), so Microsoft need to get them through monetisation, although their real concern is to ensure a sale of Windows so that they don't lose customers of their Office 365 GroupWare to Linux business software, which could happen through SteamOS installs and not necessarily the Steam Machine itself. That is why Satya Nadella still bothers with gaming at all, because they need it as a Trojan Horse for their increasingly dog **** Operating System, which you won't notice is literal malware (spyware) because you spend most of your time in XBOX Mode that it lets you boot your computer straight into so the Operating System is kinda moot. Sarah Bond resigned because she had too much integrity to lie to XBOX fans. This pissed them off so she wasn't mentioned in their memo. 3. Asha was brought in by Satya to "acclimate" consumers on XBOX (on a variety of platforms and devices) to Copilot AI via the Gaming Copilot service. That backfired and consumers did not want that. Asha listened and "listening" characterised everything she did including Twitter polls to let fans choose: Xbox or XBOX and have a premature 25 anniversary showcase as they can't wait until 25th November 2026 to do that showcase. Maybe Phil Spencer will show up at an event in November and have a "rose tinted spectacle" nostalgic history of everything good that took place over 25 years (leaving out RRoD and DRM), but I doubt it. So, Asha was renaming Magnus to Helix with the justification it had Gaming Copilot integration, but it has lost that now, so what distinguishes it as a "project". It may be that she is talking about using AI to help port XBOX GDK code to their unified Windows GDK (so developers with PC make their games for Windows and there is no need to port what they make to XBOX or have an XBOX dev kit as the XBOX is a PC because Asha changed Microsoft Gaming to XBOX so all XBOX refers to is their games, services and microtransactions and not necessarily any console hardware at all). You then get the promotion of the AMD partnership at GDC 2026 and their commitment to Cross Progression and it becomes obvious that they are tripling down on encouraging their XBOX users with real money who are good customers who actually buy games (and aren't petulant whiny babies demanding all AAAs are Day One in GAME PASS and don't buy games through this service like Fatal Mephisto but rent everything for as long as it is available), to migrate to Windows 12 X. 4. Asha has said no one wants to pay $2000 for a console, so that led to speculation that they would imitate Google Stadia (only rent all the software/servers) and play on a Samsung TV without need of a console, but that requires an investment in racks of servers that need to be fully utilised to be economic, so unless they do something wild and buy Netflix my bet is on no next-gen XBOX console and expensive Windows 12 X PCs.

• 
  WhiskeySilverball (@WhiskeySlvrBall) reported 28 minutes ago

  @Pirat_Nation I assume this is related to the issue that caused Office 365 email to collapse worldwide earlier this week.

• 
  John Crickett (@johncrickett) reported 34 minutes ago

  @PrimeAeon @Doctorthe113 @DevLeaderCa curious if you are able to comment on the server load of Office 365.

• 
  MT (@mt_t2323) reported 36 minutes ago

  @12Knocksinna @Office365 It has become too complex for Microsoft to manage as proven by the numerous issues they cause every day

• 
  父親的母親們 (@Xenidae) reported 37 minutes ago

  @OneNote In the OneNote app for Office 365 under Windows 10, somebody broke the 'copy link to paragraph' functionality. Intead of pasting a hsort clean link, it pastes the *entire URL'. This is broken, it works in the Windows 10 app btw. (But my notebook does nto work in the Windows 10 app. And the error happens in 'smaller' and 'neater' notebooks as well in the 365 aoo for Win10.)