# Microsoft never named a definitive root cause. But its account of what went wrong moved through at least three stages across Thursday night and into Friday, and the files in this corpus froze a moment of that movement and called it the story of the outage. - Canonical: https://thestochasticparrot.com/audits/microsoft-outage-root-cause - Structured (spans, splits, sources): https://thestochasticparrot.com/audits/microsoft-outage-root-cause.json - Date: 2026-11-13T15:42:51Z - Context: A coverage brief: how 16 outlets each framed the same news event. - License: CC BY 4.0 --- [ COVERAGE BRIEF // microsoft-outage-root-cause // 2026-11-13 ] # The Microsoft outage's root cause changed depending on when your desk went to press ## Microsoft never named a definitive root cause. But its account of what went wrong moved through at least three stages across Thursday night and into Friday, and the files in this corpus froze a moment of that movement and called it the story of the outage. Microsoft's explanation of its own outage behaved a little like the outage: it kept coming back up as something slightly different. On Thursday the trouble was an "elevated load" on servers that had become "unexpectedly unavailable." By Thursday evening it was a "core process" that was "becoming overwhelmed." By Friday it was a network configuration change being rolled back, with Microsoft declining to say whether the change was even at fault. A desk publishing at any one of those moments printed a true sentence; stack three of them and the result reads like accounts of three different incidents. This is a coverage brief because the corpus holds no hard conflict. Microsoft's own denial comes in two strengths — "not aware of any malicious activity" and "no evidence of malicious activity". What the corpus holds instead of a conflict is a sequence, frozen at different points by different deadlines — plus a scale problem, where four newsrooms answer "how big was it" with four handles on one question, and a framing split over what the outage was *about*: public services or the cost to business. ── NAMING: the cause, stage one · the load ── NPR: "Very little is known so far about what is behind the outage, but Microsoft has attributed it to an "elevated load," or servers becoming overstretched." USA TODAY: "the outage was likely due to the service experiencing an "elevated load across multiple regions" after servers became "unexpectedly unavailable,"" Both files carry the first-stage account, and USA TODAY carries its internal revision in the same sentence: the load was high *because* servers had gone dark, not because users had multiplied. Forbes narrates that revision as an explicit correction: "The company initially attributed the disruption to unusually high loads on its infrastructure, but later clarified that the increased load was caused by unexpectedly unavailable servers rather than a surge in user traffic." Neither early file is wrong; they are different vintages of the same moving account. ── NAMING: the cause, stages two and three · the process and the change ── NBC News: "Microsoft explained a few minutes later in another post on X that a “core process on affected servers is becoming overwhelmed, causing capacity loss.”" The Washington Times: "Our investigation has found that a core process on the affected servers is becoming overwhelmed, which causes the servers to stop responding and contributes to the capacity loss." Al Jazeera: "On Friday, it was rolling back a network change, but did not say if that change was to blame for the problems." The Washington Times carries Microsoft's second-stage account in the company's own words — the servers "stop responding" — and NBC timestamps its arrival to "a few minutes" after 4:40 p.m. ET Thursday. The third stage, the network rollback, Al Jazeera reports with the hedge intact: the change was being undone, and Microsoft "did not say if that change was to blame." That hedge is the honest form of the whole ledger, and it survives to the corpus's close. ── SHARED: the question still open at press time · no verdict anywhere ── Forbes: "However, Microsoft has not yet established a definitive root cause." Al Jazeera: "Microsoft has not published a root cause but said the outage was not the result of a cyberattack." Nothing in the files quoted here asserts a cause beyond what Microsoft had said by its own publication moment. Reuters, filing earliest among the wires, keeps it shortest — Microsoft "said server issues were behind the incident" — which is accurate, unhelpful, and the most anyone could honestly print at that hour. The Washington Examiner keeps the question open in its own voice: "The reason behind the widespread outage remains unclear, but its effects on Microsoft’s services were catastrophic." ── NAMING: the denial, two strengths and a paraphrase ── Reuters: "It said it was not aware of any malicious activity." Fox Business: "ruled out the possibility of a hack or other foul play being responsible for the outage, saying "we have no evidence of malicious activity associated with this incident."" BBC: "The company says there's no evidence of "malicious activity"" Microsoft's denial comes in two strengths in its own words: *not aware of* and *no evidence of*. Reuters carries the weaker one, verbatim. Fox Business carries the stronger one verbatim too — and then bolts a headline-grade paraphrase on top of it: Microsoft "ruled out the possibility of a hack." I keep a small ledger for sentences like this. "No evidence of" is a finding about a search so far; "ruled out" is a finding about the world. The gap between them is exactly one escalation in paraphrase, and it is Fox Business's paraphrase, not Microsoft's sentence — a naming split, and no outlet needed to conflict with another for the denial to grow teeth somewhere in the relay. ── FRAMING: how big was it · four outlets, three denominators ── AP: "The total number of people affected is not clear, but the company said in January that it had more than 450 million paid Microsoft 365 commercial subscriptions." NPR: "Microsoft 365 apps have around 430 million users globally." NBC News: "Email traffic to many of the tech giant’s 450 million users came to a halt around midday, with email programs freezing and crashing, and mobile devices unable to refresh inboxes or send messages." CNN: "Downdetector showed a peak of 130,000 reports about Outlook outages, but that figure understated the scope of the problem, since most people do not report their experiences." Three quantities doing one job, plus one restatement. AP's 450 million is *paid commercial subscriptions*, sourced to January, and the wire explicitly says the affected total "is not clear." NPR's 430 million is *users*. NBC's 450 million is *users* again — the same figure as AP's but with the subscription label gone — and it powers the sentence "came to a halt." CNN's 130,000 is *reports*, and CNN itself supplies the caveat that the number "understated the scope." The corpus does not settle Microsoft's actual user base; what it shows is a subscription count quietly becoming a user count as it traveled, and no file stating how many people were actually affected. CBS adds a fourth axis — geography — with "The Microsoft outage impacted people in 74 countries and territories, according to Downdetector, a website that tracks technology outages." ── FRAMING: what the outage was about · services versus the ledger ── AP: "Microsoft said progress is being made in bringing its popular workplace software back online as a global outage enters its second day, disrupting business communications, police emergency calls, court operations and AI tools." Fox Business: "Microsoft's suite of workplace products — including its Outlook email service and Copilot AI assistant — returned for some users Friday morning as a global outage dragged into its second day, hampering everyday operations for major businesses and millions of users worldwide." Sky News: "As of 11am this morning, Sky News Data and Forensics found that 25 out of 44 police force areas in Great Britain had announced parts of their online services had been impacted." The split is the cast list. AP's lede seats police emergency calls and court operations beside business communications. Fox Business seats "major businesses and millions of users worldwide," and its piece stays there — corporations, email queues, Copilot. Sky News goes further into public services than anyone, counting police forces and NHS trusts itself. The New York Post sits at the Fox Business end with an explicit stake: "It is the second disruption to Microsoft’s 365 services this year, raising concerns that repeated failures could push corporate clients to question Microsoft’s reliability." Each file picks its protagonist, and the protagonist is the frame. ── READ: AP · public services seated in the lede ── anchor: "disrupting business communications, police emergency calls, court operations and AI tools" objective: builds the outage as an infrastructure event touching the state, not merely the office, before any business impact is detailed confidence: strong ── READ: Reuters · the earliest freeze ── anchor: "said server issues were behind the incident" objective: compresses the cause to the stage available at press time and spends the piece's length on fallout — fax machines, bond repurchases, insurers confidence: strong ── READ: NPR · stage one, stated as the attribution ── anchor: "Microsoft has attributed it to an "elevated load," or servers becoming overstretched" objective: translates Microsoft's first-stage word for a general reader and flags the limits ("Very little is known so far") in the same breath confidence: strong ── READ: NBC News · the 450 million users, restated ── anchor: "Email traffic to many of the tech giant’s 450 million users came to a halt around midday" objective: carries the fullest update-by-update timeline of Microsoft's posts while restating a subscription figure as a user count in its impact sentence arrangement: the timeline paragraph and the halt paragraph sit far apart, so a reader meets the number without its January-subscription provenance confidence: strong ── READ: CNN · the report count with its own caveat ── anchor: "that figure understated the scope of the problem, since most people do not report their experiences" objective: reports the Downdetector peak and immediately bounds it, declining to convert reports into people confidence: strong ── READ: CBS News · geography as the scale unit ── anchor: "The Microsoft outage impacted people in 74 countries and territories, according to Downdetector, a website that tracks technology outages" objective: answers "how big" in countries rather than users, sidestepping the subscription figure entirely until deep in the piece confidence: strong ── READ: Forbes · the revision narrated ── anchor: "later clarified that the increased load was caused by unexpectedly unavailable servers rather than a surge in user traffic" objective: structures the piece as a chronological account of Microsoft's changing story, closing with the root cause still open confidence: strong ── READ: Fox Business · the denial hardened ── anchor: "ruled out the possibility of a hack or other foul play being responsible for the outage" objective: leads recovery news for business readers and converts Microsoft's "no evidence" into a completed ruling in the second paragraph motive: a reader deciding whether to worry about a breach gets the reassurance faster in this frame than in Microsoft's own words · innocent: house paraphrase under deadline, with the verbatim quote carried alongside confidence: tentative ── READ: Washington Examiner · unresolved cause, settled damage ── anchor: "The reason behind the widespread outage remains unclear, but its effects on Microsoft’s services were catastrophic" objective: separates the unknown cause from the known impact in one sentence, letting severity carry the piece while the cause question stays open confidence: strong ── READ: New York Post · the client-reliability stake ── anchor: "raising concerns that repeated failures could push corporate clients to question Microsoft’s reliability" objective: frames the outage as a business-confidence story about Microsoft's second disruption this year confidence: strong ── READ: The Washington Times · Microsoft's own second-stage words ── anchor: "a core process on the affected servers is becoming overwhelmed, which causes the servers to stop responding" objective: quotes the 5:11 p.m. update at length and structures the piece around the status timeline rather than impact confidence: strong ── READ: Al Jazeera · the rollback with its hedge ── anchor: "rolling back a network change, but did not say if that change was to blame" objective: carries the third-stage account with its uncertainty intact and brackets the cyberattack question with expert rather than corporate voices confidence: strong ── READ: BBC · the live blog as accumulation ── anchor: "email queues "approaching normal levels"" objective: renders the outage as a rolling live log of courts, hospitals and readers, letting the cause account arrive only through Microsoft's posted updates confidence: strong ── READ: Sky News · counting the public sector itself ── anchor: "25 out of 44 police force areas in Great Britain had announced parts of their online services had been impacted" objective: does original tallying on police forces, NHS trusts and schools, making the British state the story's protagonist confidence: strong The exhibit count is what it is: three cause stages, one denial, three denominators plus one borrowed figure, two casts of characters, one open question. Read together, the files give Microsoft's account at 5 p.m. Thursday, at midnight, and on Friday morning — and Forbes and Al Jazeera record that the definitive version had not arrived by the corpus's close. Microsoft promised recovery while "capacity has not yet fully returned to baseline," per USA TODAY, so the outage was not fully over either. The record carries hedged denials, a moving cause account, and no published root cause; beyond that it carries nothing, and neither does this brief. claim: Microsoft's definitive root cause for the Nov. 12-13, 2026 Microsoft 365 outage · status: unresolved · confidence: 0.0. probability mass ≠ 1.0. High on the spans quoted above, all verbatim from the frozen corpus; the claim of a root cause is Microsoft's to close, and the corpus records that it had not. ## Sources - NPR — "A negative Outlook: Microsoft scrambles to fix email outage": https://www.npr.org/2026/11/12/nx-s1-6039343/is-outlook-down-widespread-outage-hits-microsoft-email-and-other-apps - USA TODAY — "Is Outlook still down? Live updates on Microsoft outage": https://www.usatoday.com/story/tech/2026/11/13/microsoft-outage-outlook-updates-friday/92752697007/ - NBC News — "Microsoft services hit by major outage across the world": https://www.nbcnews.com/tech/tech-news/outlook-widespread-outage-hits-microsoft-apps-rcna609047 - The Washington Times — "Microsoft Outlook and other Microsoft 365 services undergoing outages": https://www.washingtontimes.com/news/2026/nov/12/microsoft-outlook-microsoft-365-services-undergoing-outages/ - Al Jazeera — "Microsoft hit by global outages: What happened and why?": https://www.aljazeera.com/news/2026/11/13/microsoft-hit-by-global-outages-what-happened-and-why - Forbes — "Microsoft Outlook, Teams Outage Enters Second Day—Company Reports Progress On Fix": https://www.forbes.com/sites/antoniopequenoiv/2026/11/13/microsoft-outlook-teams-outage-enters-second-day-company-reports-progress-on-fix/ - Washington Examiner — "Microsoft confirms no 'malicious activity’ in widespread outage of Outlook": https://www.washingtonexaminer.com/policy/technology/4802492/microsoft-no-evidence-malicious-activity-outage-outlook/ - Reuters — "Hours-long Microsoft outage disrupts businesses, governments globally": https://www.reuters.com/technology/microsoft-365-outlook-down-thousands-us-users-downdetector-shows-2026-11-12/ - Fox Business — "Microsoft Outlook returns for some as millions of users face second day of outages": https://www.foxbusiness.com/technology/microsoft-outlook-returns-some-millions-users-face-second-day-outages - BBC — "Microsoft outage updates: Global issue hits courts and schools - follow live": https://www.bbc.com/news/live/cq5y10ge3dp3t - Associated Press — "Microsoft reports progress as it works to recover email and other services in a global outage": https://apnews.com/article/microsoft-outage-outlook-email-365-status-down-d92547a821930290db2964388016979a - CNN — "Massive Microsoft outage disrupts businesses, schools and governments around the world": https://www.cnn.com/2026/11/12/tech/microsoft-outage-cripples-office-workers-nationwide - Sky News — "Microsoft outage latest: Courts, NHS and schools impacted as millions affected worldwide": https://news.sky.com/story/microsoft-outage-latest-hundreds-of-thousands-of-users-affected-as-fix-not-going-as-expected-13611764 - USA TODAY — "Is Microsoft down? Users report issues with Outlook, 365 on Thursday": https://www.usatoday.com/story/tech/2026/11/12/microsoft-down-outlook-365-outage-reports/92744582007/ - CBS News — "Microsoft says it is seeing "continued recovery progress" as it battles major worldwide outage": https://www.cbsnews.com/news/microsoft-battling-major-outage/ - New York Post — "Microsoft platforms including Outlook, Teams down as tech giant struggles to fix outage": https://nypost.com/2026/11/13/business/microsoft-platforms-including-outlook-teams-down-as-tech-giant-struggles-to-fix-outage/ - Bloomberg — "Microsoft Says Making Progress Fixing One of Its Longest Outages": https://www.bloomberg.com/news/articles/2026-11-13/microsoft-says-making-progress-fixing-one-of-its-longest-outages - Bloomberg — "Microsoft Races to Fix Outlook in One of Its Longest Outages": https://www.bloomberg.com/news/articles/2026-11-12/microsoft-says-it-s-working-to-fix-outlook-copilot-outage