What the 13 November Microsoft 365 outage means for Australian businesses

Microsoft 365 email failed for businesses across Australia and overseas before dawn today. Microsoft says the trouble started about 5:15am AEDT (4:15am in Queensland). Microsoft names Exchange Online, its email service, as the main casualty and lists Teams and SharePoint as affected too. The ABC reports disruption to NSW government services and medical workers. As of mid-morning Microsoft had restored some servers and had published no root cause. The company says it has no indication of a cyber attack.

Clients rang our service desk when they could not reach their mailboxes. We kept answering them because our own mail has a second path.

The third outage this year

This is the third major Microsoft 365 outage of 2026, and Exchange Online failed in all three. On 22 January the service was down for nine to ten hours. On 31 August an outage ran for days, and Microsoft traced it to a core authentication setting. The third began before dawn today.

We recommend Microsoft 365 to most small businesses and will keep doing so. Microsoft runs millions of mailboxes on shared systems, so one fault cuts off a large share of customers at once. Attackers go after those systems too: Microsoft disclosed breaches of its own systems in 2023 (Storm-0558) and 2024 (Midnight Blizzard). Stay on Microsoft 365, and make your business more robust around it.

ASD’s three-month test for critical infrastructure

The Australian Signals Directorate published its CI Fortify guidance in October 2025 for operators of critical infrastructure such as power and water. ASD asks those operators to build the ability to isolate their vital operational systems from the internet and other networks for three months while they keep critical services running.

ASD wrote CI Fortify for critical infrastructure, and a 20-person accounting firm sits outside its scope. We think a small business should ask a smaller version of the same question. Power and water operators plan for three months cut off. You can plan for one day without Microsoft 365, then one week.

Trading for a day, then a week

Run six checks on your business:

1. A written outage policy. You have a one-page policy for how staff talk to each other when email and Teams are down and what you tell clients. Print it, because you cannot open a policy stored in SharePoint while SharePoint is down.
2. A second way to send and receive. You can get mail or messages to your clients while Microsoft 365 is down.
3. Contacts kept outside Microsoft 365. You hold phone numbers for key clients and suppliers somewhere other than Outlook and Teams.
4. Critical files available offline. You can open this week’s essential documents without SharePoint or OneDrive.
5. A named person who makes the call. One person decides to switch to plan B and tells staff and clients.
6. A staff alert channel. You message your team through a group on Signal, Telegram or WhatsApp to say an outage is under way and what to do next.

Options for a second path

You have three main options, and you pay for each in money or effort.

• Hybrid Exchange. You keep some mailboxes on a server you control, alongside Exchange Online, and you can reach them during a cloud outage. You also take on patching and securing that server, and attackers target Exchange servers.
• An email continuity service. A provider holds your incoming mail during an outage and gives staff a web inbox to keep working. You pay a monthly fee per mailbox.
• A second channel. A phone tree or a messaging group costs little and keeps people talking while mail is down. It carries no email.

Ask whether your second path needs a Microsoft login. August’s outage came from a fault in Microsoft’s sign-in systems, so a path that needs that login would have failed with it. You can keep hybrid Exchange working through that kind of failure if you run sign-in servers both on site and in the cloud.

Test it before the next one

After three outages in ten months, we expect a fourth. Pick a quiet afternoon and pretend Microsoft 365 is down, then count how many of the six checks your business passes.

We can run that exercise with you. Our continuity review takes 30 minutes and costs nothing, and you leave knowing where a day or a week without Microsoft 365 would hurt your business. Call us on 1300 585 850 or message us on Facebook to book.