Microsoft has resolved the global failure of Outlook, Teams and Word 365 after more than 24 hours, and has given an account of what happened that confirms the sequence analysts had inferred.
The timeline
The outage began on Thursday at 11:32pm Bangladesh time. Microsoft acknowledged it at 11:54pm, and about thirteen minutes later warned that users in any region could be affected.
Services began returning late on Friday night, starting in Asia-Pacific, followed by Europe and North America.
What Microsoft says broke
A new technical problem arose during a network capacity upgrade. Several servers failed an automated functionality check and went offline. Their workload shifted to healthy servers, which then overloaded. A process handling secure connections failed under the strain, and the servers stopped accepting requests.
Microsoft repeated that this was not a cyber-attack and was unrelated to AI.
What this adds to yesterday's account
We published the inferred failure loop yesterday: health checks fail, load shifts, recovery adds more load. Microsoft's account matches it, which is worth saying plainly because inferred explanations are often wrong.
The genuinely new detail is the last link. It was not simply that the remaining servers were busy — a specific component, the process handling secure connections, gave way under the extra load, and once that failed the servers could not accept requests at all.
That explains something the symptom list implied but did not state: why messaging and meetings largely survived while anything requiring a fresh authenticated session did not. If the part that establishes secure connections is down, existing sessions continue and new ones cannot start.
How they got it back
Engineers limited the types of traffic reaching the affected infrastructure, rolled some servers back to earlier configurations, applied patches to authentication and routing components, and added virtual machines. Services were restored in phases with stability checked at each step.
"Considering the scale of demand, we restored the services step by step," Microsoft said.
That phased approach is the direct answer to the rejoin loop. Bringing everything back at once would have repeated the original failure.
The structural point
Govinda Ramamurthy, chief executive and managing director of eScan, said the cause was an internal process failure rather than a cyber-attack, and noted that dependence on a single provider allows a configuration error or network change to spread worldwide very quickly.
In Bangladesh
Outlook, Microsoft Teams and Word 365 online were unavailable here and have since been restored. Calendar features relying on Exchange Online took longer to come back than Teams chat and meetings — which is the same split, seen from a desk in Dhaka.
Why the recovery order matters
Services came back Asia-Pacific first, then Europe, then North America. That is not a courtesy to any region — it is load management. Restoring the smallest active demand first lets engineers watch whether the repaired path holds before the heaviest traffic arrives, and if it does not, the failure is contained to the quietest region rather than the busiest.
What is still owed
Microsoft has named the trigger and described the sequence. What has not been published is the post-incident review: why an automated health check removed enough servers to matter, why the secure-connection process had no headroom for the redistributed load, and what changes prevent the same cascade next time. That document is where a vendor either earns back trust or quietly does not, and it usually appears days or weeks after the event.
