Outlook's Monday outage left one user unable to receive verification emails, others reporting varied issues

Outlook is a client; mailbox access and delivery come from Exchange Online, which is why CNET says so many people met the failure through Outlook ^[11]. Exchange Online in turn leans on an authentication component that Microsoft said was not being deployed as expected ^[3], and the same component was degrading services outside Exchange Online too ^[4].

One Reddit user quoted by CNET described the sequence from the outside: verification emails stopped arriving first, and then both the app and the browser returned an error code ^[10]. That ordering belongs in a dependency map. A mailbox is where the codes and reset links for other systems land, so when the identity layer stops mail, it also closes the door teams use to get back into everything that is not mail.

Inside one office, users reported that some accounts were completely down while others worked fine ^[9]. That is harder to run a help desk through than a clean failure, because the first stretch of the incident goes on establishing whether there is an incident, and the person checking can still send mail.

The public outage curve understates the length of the incident. Reports peaked above 6,000 at 8:17 a.m. PT ^[1], sat above 4,000 at 1:27 p.m. and above 2,700 at 3:25 p.m. ^[8], which is roughly 55 percent off the morning peak ^[12]. At 3:50 p.m., Microsoft's status page still carried no estimated time for a complete fix and was still testing whether reverting an update would provide relief, seven and a half hours after the peak ^[3][13]. Teams tend to treat the third-party report count as the state of the service, but users don't behave that way: they file one report, tell a colleague, and go find another way to send the invoice. The falling report count measures reporting fatigue, not restored mailboxes.

The artifact worth having is a two-column list, one page long. Left column: every workflow that cannot complete unless a message lands in a mailbox. Customer password resets. One-time links from a vendor portal with no other delivery option. Payroll and PO approvals. On-call escalation to a distribution list. Right column: for each row, the path a help desk can execute while the mail estate is dark, and the name of the person authorised to execute it. A blank right column marks an outage the team has never rehearsed, and the rows where the left column carries a secret rather than a notification are the expensive ones. Microsoft's own account of Monday, recent changes to the service and authentication components that did not deploy as expected ^[3], is the argument for filling those cells in, because a trigger like that arrives on a release schedule your tenant does not see.