Microsoft has not announced a root cause. It has said no cyber-attack was involved, that it was working to roll back a network change or update without confirming that the change caused the problem, that it was checking whether security patches were behaving as expected after infrastructure reboots, and that it was assessing server health and ways to add capacity.
From those symptoms, analysts have described a failure sequence that fits.
The loop
- Some servers failed automated health checks and were taken out of service.
- Their traffic shifted to the remaining servers, which came under heavy load.
- The offline servers tried to rejoin and sync files, overloading the others again — and the cycle repeated.
Step three is the one that turns an incident into an outage. Recovery is not free: a machine coming back has to catch up on everything it missed, and it pulls that data from the servers already struggling to carry the extra traffic. The act of healing adds load at precisely the moment there is none to spare.
What the analysts said
Walter Pasquarelli, an AI expert affiliated with Cambridge University, said the evidence so far points to a technical failure — possible causes being cable damage, inefficiency, or an automated system error. He found no evidence that AI workloads caused the overload, and compared the failure to a four-lane highway suddenly narrowing to two.
Rupert Goodwins, a technology analyst, said server overload usually comes from one of two things: an external attack, or a faulty internal update pushed through the administration network. A bad update, he said, can cause servers to reset or lose communication with each other.
He also offered a more contested view — that Microsoft's heavy focus on AI may have contributed indirectly, because email and Teams have received less investment. The article further notes that the departure of experienced engineers has left a gap in institutional knowledge, without attributing that point to a named expert.
Those last two claims should be held more loosely than the technical sequence. They are plausible and unprovable from outside, and they are the kind of explanation that is satisfying precisely because it cannot be checked.
The timeline
Services went down at 11:32pm Thursday, Bangladesh time. Within about an hour Downdetector had logged problems from 74 countries. By 7am GMT Friday it had received around 43,000 Outlook complaints from users in 72 countries. The outage ran more than 18 hours without a full fix.
Why the official cause will take time
Microsoft has since named a network capacity upgrade as the source. That is a cause, not an explanation: it says where the change came from, not why the system responded to it this way.
The useful document will be the post-incident review, which normally appears days or weeks later and says what was being upgraded, why the health checks cascaded, and what will stop the rejoin loop next time. Until then, the sequence above is the best available reading of the symptoms, offered as that rather than as fact.
