Intune, Defender and Copilot affected: what the outage means for security and management
The Microsoft 365 outage of November 2026 is not just about email. Copilot, device enrolment in Intune, Safe Links and the quarantine in Defender, as well as parts of Purview, are also affected. For administrators that raises questions: is our environment now less well protected, and what should we check? Here you can read what Microsoft reports and what to do about it as an administrator.
Microsoft is not aware of any malicious activity as the cause. However, security and management features that depend on Exchange Online are working less well. Postpone changes, be extra alert to phishing, and review the quarantine and logs after recovery.
Below, per component, you can see what was affected, what that means and what to check once service has been restored. Status as of Friday 13 November 2026, 10:15.
Is it an attack?
- Microsoft is not aware of any malicious activity causing the outage.
- Safe Links may not always be able to check links in email; clicking a rewritten link may fail.
- Releasing items from the Defender for Office 365 quarantine may fail.
- Device enrolment, check-ins and compliance policies in Intune were intermittently affected.
- Copilot cannot access email, calendar and files and may not respond.
An outage of this scale immediately makes many people wonder whether an attack is behind it. Microsoft states on the Microsoft status page that it is not aware of any malicious activity causing the incident. According to Microsoft, a number of servers became unexpectedly unavailable, which overloaded the rest of the infrastructure (@MSFT365Status on X). No evidence of an attack has been published.
It helps to keep those two things separate. According to Microsoft, the cause of the outage is technical. But the consequences do affect your security: a number of controls work less well for as long as the outage lasts. And scammers know it. Around major outages, phishing messages that play on the news increase.
What is affected, per component
Security and admin components according to Microsoft, status as of 13 November 2026, 10:15
| Component | What Microsoft reports | What it means for you |
|---|---|---|
| Defender for Office 365 | Safe Links, Safe Attachments, quarantine, Threat Explorer and alerts may fail; opening rewritten links fails | Less visibility of threats in email; releasing from quarantine may have to wait |
| Defender XDR | Pages in the Defender portal may not load | Investigation and follow-up are slower |
| Intune | Enrolment, check-ins and compliance policies were intermittently affected | Set up new devices later; compliance may be temporarily inaccurate |
| Purview | Labels, data loss prevention, eDiscovery and audits, among others, affected | Opening or creating protected content may fail |
| Copilot | Copilot Chat may not load and cannot access email, calendar and files | Work without Copilot or postpone it |
| Admin centre | Some pages do not load | Also use the public status page |
A few notices stand out for administrators. Microsoft states that users who click a link rewritten by Safe Links cannot reach the page, because Safe Links cannot process the link. That is inconvenient, but it does protect you: a link is never let through without being checked. In addition, changes to the allowed and blocked sender lists may take effect with a delay.
For Intune, Microsoft reports that enrolment, check-ins and compliance policies were intermittently affected. A device that cannot check in may show as non-compliant in reports, which can carry over into conditional access. Keep that in mind before drawing conclusions from a dashboard.
What you should do now as an administrator
- Postpone changes
No new policies, no major changes in Intune or Defender, and no provisioning of new devices until service is restored. Changes that were only partly applied are hard to verify afterwards.
- Warn about phishing
Let employees know that messages are circulating that exploit the outage, and that they should never sign in via a link in such a message.
- Apply emergency measures deliberately
Do not switch off security to keep work going, even if Safe Links or compliance is getting in the way. Record every exception.
- Document what you see
Timestamps, error messages, affected users and devices. You will need this for the review afterwards and for any claim.
During an outage the temptation is strong to temporarily disable conditional access or link checking. That is precisely when attackers are active. Keep security on and accept that some things will not work for a while.
After recovery: what to check
Once the services are back, go through the components that did not work properly during the outage. Check the Defender for Office 365 quarantine for messages waiting to be released, and whether user reports of suspicious email have come through. Verify that changes to the allowed and blocked sender lists have been applied.
In Intune, check whether devices are checking in normally again and whether compliance is correct. In Purview, check whether labels and data loss prevention policies are being applied again, and whether audits and eDiscovery jobs that were running during the outage need to be rerun. Finally, read the report Microsoft has promised after recovery, and see whether the root cause says anything about your own setup.
If your organisation runs software that talks to Intune, Teams or email via Microsoft Graph, check that as well. What the outage means for integrations is covered in the article on Microsoft Graph integrations. For the timeline, read the outage overview.
security and management components in the table above that Microsoft lists as affected.
services and components that Microsoft lists as affected on Friday morning, 13 November.
things you do as an administrator during the outage, from postponing changes to documenting what you see.
Frequently asked questions
About security and management during the Microsoft 365 outage of November 2026.
Is the Microsoft outage a cyberattack?
Microsoft says it is not aware of any malicious activity causing the outage. According to Microsoft, a number of servers became unexpectedly unavailable. No evidence of an attack has been published.
Does Defender work during the outage?
Partly. Microsoft reports that Safe Links, Safe Attachments, the quarantine and the Defender portal may fail. Clicking a link that Safe Links has rewritten may fail.
Does Intune work during the outage?
Microsoft reports that enrolment, check-ins and compliance policies were intermittently affected. Postpone provisioning new devices and be careful about drawing conclusions from compliance reports.
Why is Copilot not working?
Copilot may fail to load and may be unable to access email, calendar and files, because these depend on Exchange Online. Microsoft reports that Copilot Chat in the web and desktop apps is affected.
Should I temporarily switch off security?
No. Attackers are particularly active with phishing during an outage. Keep security switched on and document any exception you do make.
What should I check after recovery?
The quarantine and alerts in Defender, changes to the allowed and blocked sender lists, check-ins and compliance in Intune, and labels and policies in Purview.
Further reading
Management and security that don't grind to a halt during an outage?
Appfront builds custom software and integrations with Microsoft 365, including Entra ID and Intune. Want to know how your own systems cope when sign-in or management goes down? Book a call with a developer.