Microsoft blames a network capacity upgrade for the outage that cut email to ASIO, the AFP and the courts, but not everyone is back

Australia’s spy agency, its federal police and a NSW bail court started Friday without email, and it took Microsoft about a day to say what had gone wrong: a problem introduced during an earlier upgrade to its network capacity.

The outage began just after 3am AEDT, during Thursday business hours in the United States, and spread across the world. Outlook on the web and desktop, Exchange Online email delivery, Teams calendars and chat creation, Copilot and more than a dozen other Microsoft 365 services were affected. In Australia, Outlook problem reports passed 4,400 by 8.20am AEDT; in the US, reports peaked at more than 130,000 around 1pm Thursday, New York time.

Who has been hit?

ASIO and the AFP confirmed they were affected, as did the ACT, Tasmanian and WA governments. Service NSW said some transactions were unavailable. Courts in South Australia and Victoria acknowledged disruption, and in NSW only five of 13 online bail applications could go ahead because papers for overnight arrests could not be opened.

Charles Sturt and Macquarie universities reported problems with multi-factor sign-in, and the Northern Territory’s Education Department reported technical issues. Canberra Health Services lost email, voicemail and some faxes but reported no known effect on patient care. Services Australia said its customer services and payments were not affected.

What went wrong?

Microsoft said a number of servers had become unexpectedly unavailable, overloading the rest. It said a process that sets up secure connections on the affected servers was overwhelmed, and that it was examining recent configuration changes. Restarted servers kept falling over again once traffic returned: at 2.17pm AEDT it said a change “is not taking as expected”.

By Friday evening Microsoft said a patch applied to part of its infrastructure was producing positive results for server stability, an improvement on the “marginal success” it had reported earlier. Later on Friday, Australian time, it reported “encouraging recovery progress”, with service availability and email delivery performance improving, and said Teams functionality had been restored. It cautioned that some users may still experience intermittent issues while recovery continues, and it has not said when every service will be back.

At about 1am AWST on Saturday, Microsoft gave its first explanation. It said the incident “was introduced by an issue during an earlier network capacity upgrade”, which surfaced after a recent network change, and that it had addressed the underlying issue. It reported “broad recovery and stability across our services” while it continues restoring service to remaining customers and regions.

Microsoft called it a technical issue not related to cyber activity or AI agents; a spokesperson had earlier said there was “no indication” of a cyber attack. It has promised a post-incident report with the full root cause.

Why does it matter so much here?

Australia’s federal and state governments run heavily on Microsoft. In August, Hamish Hansford, the head of national security at Home Affairs, warned that an outage would have a disproportionate impact, and a Home Affairs risk review released on 2 November renewed warnings about relying on a small number of technology providers.

Home Affairs Minister Tony Burke said the government had activated its digital resilience agreement, which requires Microsoft to prioritise Australia’s recovery. He said he had spoken to the National Cyber Security Coordinator, Lieutenant General Michelle McGuinness, and to Microsoft’s Australia and New Zealand president, Jane Livesey. The coordinator is examining the outage. Assistant Treasurer Daniel Mulino said the economic cost would be difficult to quantify; one risk adviser estimated it in the billions of dollars.

VNN will update this story as more is confirmed.