Starting at 1:26 PM ET on November 12, 2026, Microsoft 365 went down for a large share of users across the country. Exchange Online and Outlook were hit hardest, with Teams, Microsoft 365 Copilot, SharePoint Online, Intune, Defender for Office 365 and close to a dozen other hosted services also affected. The disruption began in the Americas and spread. More than twenty hours later, Microsoft was still working through a backlog of delayed email, with meaningful improvement reported across North America and much of Europe by the afternoon of November 13.
As of this writing, Microsoft has not identified what triggered the initial failures. According to the company's own incident notes, Exchange Online servers began failing automated health checks and dropping out of rotation, which pushed a cascading overload onto the servers that remained. Microsoft's engineering leadership, including executive Charles Lamanna, said the company's teams are "reviewing what happened and how we can prevent similar issues going forward." Microsoft has stated it has no indication of malicious activity, but it has not published a root-cause finding, and the event was formally logged as a service degradation rather than a security incident. We are not reporting this as a confirmed cyberattack, because it has not been confirmed as one — and that uncertainty is itself the point. For a day and a half, hundreds of millions of people and a large share of corporate America had no way to know for certain which it was.
That same week, a separate and unrelated event — Friday's nationwide FAA ground stop — disrupted travel across the country for reasons that, as of this writing, are also still being investigated. We've written about what that means for travel planning in a companion piece. Nothing we have seen connects the two events. Treat them as what they appear to be: two serious, independent disruptions landing in the same week, each one a useful test of readiness in its own right.
Why this matters beyond IT
Most executive protection conversations focus on the physical world — a residence, a vehicle, a venue. Protective planning has always rested on a quieter assumption: that the principal, the detail lead, the executive assistant and the family office can reach each other. Email, calendar invites, secure messaging and the scheduling platforms that coordinate a principal's movements run, in most organizations, through exactly the services that went dark this week.
When that layer drops, the effects are not hypothetical:
- Scheduling coordination stalls. If the principal's calendar, the detail's shift notes and the family office's communications all live in the same affected platform, a changed pickup time or an added stop may not reach the people who need it.
- Verification gets harder. Protective teams routinely confirm identity and instructions over email or chat — a wire instruction, a changed itinerary, a request from "the office." When the primary channel is down, people reach for whatever is available, which is exactly when a spoofed call or a fraudulent request is hardest to catch.
- Household and staff communication has no backup. Many families coordinate staff schedules, deliveries and access through the same Microsoft 365 tenant used for business. A multi-hour outage with no fallback plan leaves a residence as exposed to confusion as a corporate office.
- "Always on" platforms are a single point of failure precisely because everyone assumes they aren't one. The outage did not need to be an attack to prove the point: a widely used, well-run platform can still fail, and when it does, every process quietly built on top of it fails with it.
What a digital continuity plan actually covers
A digital continuity plan is the communications equivalent of an evacuation plan: rarely used, written down in advance, and useless if it's invented in the moment. For a principal, a household or an executive team, the core pieces are straightforward.
A verified secondary channel. A pre-agreed, pre-tested way to reach the principal, the detail lead and key household staff that does not depend on the same vendor as the primary channel — a different provider for voice or messaging, not just a second device logged into the same ecosystem.
A verbal verification protocol. Any instruction involving money, a schedule change, or access to the principal or a residence should have a pre-agreed verification step that doesn't rely on the channel the instruction arrived on. This is standard anti-fraud practice during normal operations; it becomes essential during an outage, when urgency and confusion both spike and impersonation attempts increase.
A known fallback for scheduling. The detail lead, the principal's assistant and the family office should know, in advance, what the backup process is for confirming a day's schedule if the primary calendar platform is unreachable — even if the backup is simply "call, don't message."
A documented decision chain. When normal channels are down, someone still has to be reachable and authorized to make calls — approve a changed route, confirm a pickup, decide whether an event proceeds as planned. Outages are a bad time to discover that authority was never clearly assigned.
A test, not just a document. A continuity plan that has never been exercised is a plan on paper. A short, scheduled test — even a single afternoon simulating "email and Teams are down" — surfaces the gaps before a real outage does.
What we are telling our own clients this week
This outage, whatever its cause turns out to be, is a low-cost opportunity to find out where a continuity plan has gaps, without having had to find out the hard way. We are recommending three concrete steps to the executives and family offices we work with:
- Confirm the secondary contact method actually works. Not "we have a backup number on file" — actually place the call and confirm it reaches the right person.
- Walk through the verification protocol for financial and schedule instructions. If there isn't one, this week is the reason to build one.
- Ask who in the household or office is authorized to make a call when the usual channels are down. If the honest answer is "we'd figure it out," that's the gap to close first.
None of this requires assuming the worst about what caused this week's outage. It requires assuming only what is already true: the platforms coordinating a protective program are not infallible, and the plan for when they fail should not be written for the first time during the failure.
Frequently Asked Questions
Was the Microsoft 365 outage confirmed to be a cyberattack?
No. As of this writing, Microsoft has said it has no indication of malicious activity, but it has also not published a confirmed root cause. The company's own account points to a cascading technical failure in Exchange Online. We are treating the cause as unresolved rather than asserting either explanation.
Is this outage connected to Friday's FAA nationwide ground stop?
We have seen no source connecting the two. They are two separate disruptions that happened to land in the same week. Each is worth taking seriously on its own terms.
What's the single most useful thing a family office can do this week?
Test the secondary contact method for the principal, the detail lead and key staff — not just confirm one exists. An untested backup channel is not a backup channel.
Does AMERINE provide digital continuity planning?
Digital continuity and communications resilience are part of the protective-intelligence and program-design work we do with clients, in coordination with their own IT and cybersecurity teams. See Executive Cybersecurity and Protective Intelligence.
Request a Private Consultation
If this week's outage raised a question about how your household, office or detail would coordinate if your primary communications platform went down, that's a reasonable question to act on now rather than after the next outage.
Request a Private Consultation · (281) 799-1877 · scott@amerineexecutivelogistics.com
Related Reading
AMERINE Executive Logistics is licensed by the Texas Department of Public Safety, License No. C31012001. This article reflects publicly reported information available as of November 14, 2026, and will be updated if the companies involved publish further findings.
