Full Report
Microsoft is investigating an ongoing Outlook.com outage that is causing intermittent signing issues and preventing customers from accessing their mailboxes. [...]
Analysis Summary
# Incident Report: Outlook.com Service Degradation and Sign-in Failures
## Executive Summary
Microsoft is currently investigating a widespread service degradation affecting Outlook.com, characterized by intermittent sign-in failures and "too many requests" errors. The incident has resulted in thousands of users being unable to access their mailboxes or being unexpectedly signed out. Microsoft is currently analyzing service component interactions to identify the root cause and restore full functionality.
## Incident Details
- **Discovery Date:** April 27, 2026
- **Incident Date:** April 27, 2026
- **Affected Organization:** Microsoft (Outlook.com)
- **Sector:** Technology / Cloud Services
- **Geography:** Global (Intermittent)
## Timeline of Events
### Initial Access
- **Date/Time:** Approximately 05:00 AM (based on "three hours ago" report at 08:03 AM)
- **Vector:** N/A (Service Instability/Potential Misconfiguration)
- **Details:** Users began reporting "too many requests" errors and forced sign-outs when attempting to access Outlook.com.
### Lateral Movement
- **Details:** Not applicable; this appears to be a service availability/authentication issue rather than a coordinated network intrusion.
### Data Exfiltration/Impact
- **Details:** No evidence of data exfiltration. Impact is limited to service availability and session persistence.
### Detection & Response
- **How it was discovered:** User reports on Downdetector (thousands of entries) and internal Microsoft monitoring tools.
- **Response actions taken:** Microsoft updated the Service Health Status page, categorized the event as "Service Degradation," and initiated a validation of interactions across service components.
## Attack Methodology
*Note: Current evidence points toward a service configuration or load-balancing issue rather than a malicious attack.*
- **Initial Access:** N/A
- **Persistence:** N/A
- **Privilege Escalation:** N/A
- **Defense Evasion:** N/A
- **Credential Access:** N/A
- **Discovery:** N/A
- **Lateral Movement:** N/A
- **Collection:** N/A
- **Exfiltration:** N/A
- **Impact:** [Resource Exhaustion/Service Interruption] - Users encounter "too many requests" errors (HTTP 429), indicating potential rate-limiting malfunctions or backend service bottlenecks.
## Impact Assessment
- **Financial:** Undetermined; potential loss of productivity for enterprise users relying on personal Outlook accounts.
- **Data Breach:** None reported.
- **Operational:** Significant disruption to email access; users unable to maintain active sessions.
- **Reputational:** Moderate; follows a pattern of recent Exchange Online and Microsoft 365 outages mentioned in the report history.
## Indicators of Compromise
- **Network indicators:** N/A
- **File indicators:** N/A
- **Behavioral indicators:**
- High frequency of HTTP 429 (Too Many Requests) responses.
- Unexpected session termination (forced sign-outs).
- Latency in client sign-in scenarios.
## Response Actions
- **Containment measures:** Isolation of problematic service components for validation.
- **Eradication steps:** (In Progress) Investigation of client sign-in interactions and backend synchronization.
- **Recovery actions:** Monitoring service health page for restoration of "Service Healthy" status.
## Lessons Learned
- **Key takeaways:** Dependencies between service components in large-scale cloud environments can lead to cascading authentication failures.
- **What could have been done better:** While the report is ongoing, the frequency of similar outages (Exchange Online, Copilot) suggests a need for more robust regression testing for authentication service updates.
## Recommendations
- **Prevention measures:** Implement more granular failover mechanisms for authentication proxies to prevent "Too Many Requests" loops.
- **Infrastructure:** Review recent changes to client sign-in protocols or load-balancing algorithms that may have triggered the degradation.