Do you want to reduce your dependency on Microsoft 365 without switching everything at once? WZ-IT operates open-source applications for files, chat, video and mail in German data centres: Managed Open Source. If the selection is still open, the selection consulting for collaboration helps. View Managed Open Source · Book an initial consultation (free and non-binding)
Since 12 November 2026, Microsoft 365 services have been disrupted worldwide, according to Microsoft's notices mainly access to mailboxes in Exchange Online. This article is not an outage ticker. It uses the incident as an occasion for three questions that outlast the disruption: where exactly does the dependency on Microsoft 365 lie, what does the contract cover, and what ways are there to reduce it, from contingency preparation to open-source alternatives in your own operation.
The details of the incident come from Microsoft's own status messages and are as of 13 November 2026, 4:00 pm CET. Which components can replace Microsoft 365 in detail is covered at length in the article Microsoft 365 alternative for companies.
Table of Contents
- In brief
- What happened during the outage?
- Where does the dependency on Microsoft 365 lie?
- What does Microsoft's SLA cover?
- How dependent are German companies?
- Three strategies against the dependency
- Which open-source alternatives exist for each function?
- What does the legal framework say about outage preparedness?
- Which assumptions do not stand up to scrutiny?
- Status and methodology
- Our approach at WZ-IT
- Further guides
- Sources
In brief
- The outage began on 12 November 2026 and had not been reported as resolved on 13 November 2026 at 4:00 pm CET. Microsoft has not yet published the cause.
- Mainly access to mailboxes was affected. Because calendars, meeting invitations, Copilot and interfaces depend on the mailbox, further functions failed with it.
- Microsoft's SLA names availability thresholds and provides for a service credit on request where they are not met, capped at the monthly fee of the service.
- Those who have a second path become more independent. That starts with an emergency mailbox and an independent chat and extends to operating your own open-source components.
- Open source is no protection against disruptions. The gain is that components operated separately do not all have to fail at the same time and that the operator itself decides on fallback system and restart.
What happened during the outage?
The table summarises what Microsoft itself reported. Times in CET.
| Item | Statement | Source |
|---|---|---|
| Identifiers | EX1550543 (Exchange Online), MO1550821 (Microsoft 365) | Microsoft 365 Status, follow-up message |
| First public report | 12 November 2026, 6:54 pm, initially for North and South America | Microsoft 365 Status |
| Expansion | 7:07 pm: users in any region may be affected | Microsoft 365 Status |
| Mechanism | Increased load, according to Microsoft, not caused by more traffic but by servers that are unexpectedly unavailable | Microsoft 365 Status |
| Finding overnight | A core process on affected servers is overloaded; measures so far did not bring the expected relief | Microsoft 365 Status |
| Setback | Servers brought back online stop responding again under load | Microsoft 365 Status |
| Mail delivery | Window for delayed mail extended to 48 hours | Microsoft 365 Status |
| As of 13 November 2026, 4:00 pm | Service degradation; according to Microsoft, intermittent connectivity issues and delayed email delivery still possible | Microsoft status page |
| Cause | Not published, report announced once the incident is closed | Microsoft status page |
By its own statement, Microsoft sees no indications of malicious activity. A faulty update as the cause is circulating in the press. According to tagesschau.de, this statement comes from the Australian home affairs minister, not from Microsoft. On the evening of 12 November, Microsoft initially reported having found no change that coincides with the start.
On the scale: according to Reuters, the outage-tracking platform Downdetector counted 138,058 reports about Outlook at its peak. These are user reports, not a count of those affected.
Where does the dependency on Microsoft 365 lie?
The incident shows how many functions depend on a single component. According to Microsoft, access to mailboxes was disrupted. As a result, functions that users do not associate with email also failed.
| Function | Behaviour according to Microsoft | Reason |
|---|---|---|
| Outlook on the web, Outlook desktop, mobile synchronisation | Mailboxes unreachable or reachable only intermittently | Access via Exchange Online |
| Teams | Most core functions such as calls, meetings and chats not affected; calendar and invitations disrupted | The calendar sits in the mailbox |
| Microsoft 365 Copilot | Chat partly failed to load, access to work data such as mail and calendar disrupted | Mail and calendar sit in Exchange Online |
| Microsoft Graph | Queries for mail, calendar and contacts ran into timeouts | Interface to the same data |
| Admin Center | Pages partly failed to load | Administration on the same platform |
| SharePoint Online | Files directly in SharePoint remained accessible | Separate service, external sharing disrupted |
This yields four points at which a company depends on a provider:
- Communication outward and inward. Mail and calendar sit in the same service, and meeting invitations depend on it. If it fails, so does the channel through which customers and employees would be informed about the disruption.
- Sign-in. Through Microsoft Entra ID, employees can also be signed in to third-party applications; according to Microsoft, the application gallery contains thousands of pre-integrated applications. Entra ID was not on Microsoft's list of affected services in this incident. The dependency exists regardless, and Microsoft itself recommends emergency access accounts against lockout.
- Interfaces and automation. Ticketing systems, CRM, scanners and scripts that work through Graph or the mailbox may stop as well, depending on how they handle errors and waiting times.
- Administration. If pages of the Admin Center do not load, administration during the incident is made harder. Other paths such as Exchange Online PowerShell exist, but their availability during an incident is not assured. Forwarding and fallback rules should therefore be in place beforehand.
One practical detail: classic Outlook keeps a local copy of the mailbox in cached mode; Microsoft names twelve months as the default value, and less, depending on the device and setting. Mail that has already been synchronised stays readable. According to Microsoft, the new Outlook for Windows has no cached mode for Exchange.
What does Microsoft's SLA cover?
Reporting mentions a 99.9 percent guarantee. The Service Level Agreement for Microsoft Online Services in the version of 1 October 2026 provides something narrower.
| Rule | Content |
|---|---|
| Credit, Exchange Online | below 99.9% monthly availability 25%, below 99% 50%, below 95% 100% |
| What counts as an outage | For Exchange Online: any period of time when users are unable to send or receive email with Outlook Web Access |
| Calculation | In user minutes, i.e. duration times affected users in your own tenant |
| Claim | Only on request to support, by the end of the following month, for November 2026 by 31 December 2026 |
| Cap | At most the monthly fee of the affected service |
| Legal effect | Under the SLA, the credit is the "sole and exclusive remedy"; statutory claims are not assessed here |
To put the thresholds in context, our own calculation for a month of 30 days: 99.9 percent corresponds to 43.2 minutes of downtime, 99 percent to 7.2 hours, 95 percent to 36 hours. Which level a company reaches depends on how long the service was down for its own users as defined in the SLA.
Microsoft publishes the global availability of Microsoft 365 quarterly:
| Year | Q1 | Q2 | Q3 | Q4 |
|---|---|---|---|---|
| 2024 | 99.97% | 99.99% | 99.977% | 99.927% |
| 2025 | 99.988% | 99.995% | 99.991% | 99.954% |
| 2026 | 99.526% | 99.994% | not yet published | not yet published |
The values are high, and Microsoft reports them worldwide, excluding the US government environments DoD and GCC High. For planning, the other side counts: a single incident can cost a working day, and the SLA provides for a credit of up to the monthly fee for it.
How dependent are German companies?
We did not find a reliable figure for how many German companies use Microsoft 365. What is documented are Bitkom figures on dependence on US providers overall:
- 88 percent of the companies that import digital technologies or services obtain them from the USA; 73 percent are concerned about dependence on the USA (2024: 38 percent). Source: Bitkom, 19 October 2026, 602 companies with 20 or more employees.
- 85 percent consider Germany too dependent on US cloud providers. 71 percent of the companies that use, plan or discuss cloud obtain services from US providers; 8 percent of those for whom the country of origin matters would prefer this. Source: Bitkom Cloud Report 2026, 603 companies.
- 40 percent of the companies with digital imports, according to the same Bitkom survey from October, are preparing to be able to replace important providers and systems if necessary.
According to t-online, the BSI advises securing business-critical services with alternative solutions where possible. According to a BSI spokesperson quoted by tagesschau.de, the federal administration was able to work and was essentially not affected. The FAZ points out that many federal authorities work with a uniform workplace from ITZ Bund, whose applications run on federal networks, in many cases in its own operation.
Schleswig-Holstein shows that a switch on a large scale is possible: according to the state government, the state administration switched its email completely from Exchange and Outlook to Open-Xchange and Thunderbird on 2 October 2025, with more than 40,000 mailboxes.
Three strategies against the dependency
Between "everything stays" and "everything goes" there are levels. Each can reduce the risk on its own.
| Level | What changes | What stays | Suited for |
|---|---|---|---|
| 1. Outage-ready on Microsoft 365 | Second path for mail and communication, own backup, emergency accounts, practised procedure | Working environment at Microsoft | Every company that uses Microsoft 365 |
| 2. Decouple individual components | Chat and video, files or sign-in run in your own operation | Mail and Office at Microsoft | Companies that do not want to answer an outage with a standstill |
| 3. Switch over completely | Mail, calendar, files, Office, chat and sign-in on open source | Individual line-of-business applications | Companies with requirements on data sovereignty or vendor independence |
Level 1: stay with Microsoft 365 and become outage-ready
- Second mail path. An upstream mail service accepts incoming messages and holds them. Microsoft documents how a third-party service can be placed in front of Exchange Online. The emergency mailbox for the duration of the outage is a service of the respective provider and is usually called email continuity; providers include, for example, Hornetsecurity and Retarus. Retarus names emergency mailboxes set up in advance as a prerequisite.
- Independent communication channel. A chat and video service outside Microsoft 365 that all employees know and can sign in to without a Microsoft account.
- Own backup. With software as a service, data and identities remain the customer's responsibility under Microsoft's shared responsibility model. A backup outside the platform reduces the risk of data loss if its scope and restoration have been tested. It does not replace a running service on its own.
- Emergency accounts and emergency rules. Access that does not depend on the same sign-in, and forwarding rules that are set up in advance.
- Procedure on paper. Who informs whom through which channel, which phone numbers apply, who decides. The procedure is not stored only in SharePoint.
Level 2: decouple individual components
The most common first step is an own chat and video service, because it covers the emergency channel and everyday use at the same time. The second is files in your own operation. Both can be introduced in parallel to Microsoft 365 and connected through a separate sign-in with Keycloak or authentik. At this level, mail stays at Microsoft.
Level 3: switch over completely
Here mail changes as well. It is the component with the most dependencies: Outlook connection, calendar sharing, mobile devices, deliverability and the migration of mailboxes. The effort lies less in the software than in changing habits and in the operation afterwards. Details are in the comparison Mailcow, Stalwart or Mailu.
Which open-source alternatives exist for each function?
The table names, for each function, common components, the licence according to the repository and the limit that matters in the selection. Licence information as of 13 November 2026.
| Function | Component | Licence | Notes |
|---|---|---|---|
| Mail and groupware | grommunio | AGPL-3.0 (Gromox, grommunio Web) | Connects Outlook for Windows via MAPI/HTTP according to the vendor; community edition free up to 5 users according to the pricing page, without vendor support |
| Mail and groupware | Stalwart | AGPL-3.0, plus an enterprise licence | IMAP, JMAP, CalDAV; multi-tenancy only in the enterprise edition according to the vendor |
| Mail and groupware | Mailcow | GPL-3.0 | Outlook via IMAP; calendars and contacts in classic Outlook via the CalDav Synchronizer plugin, in the new Outlook not according to the documentation |
| Webmail, calendar | SOGo | GPL-2.0 and LGPL-2.1 | ActiveSync for mobile devices |
| Files | Nextcloud | AGPL-3.0 | Calendars and contacts via CalDAV and CardDAV; Nextcloud Mail is a webmail client, not a mail server |
| Office in the browser | Collabora Online | MPL-2.0 | The free CODE edition is not recommended for production use according to the vendor |
| Office in the browser | ONLYOFFICE Docs | AGPL-3.0 (Community) | Community edition recommended for up to 20 users according to the repository |
| Chat | Matrix with Synapse and Element | Synapse: AGPL-3.0 or commercial | Federation across organisational boundaries possible |
| Chat | Mattermost | Source code AGPL-3.0 or commercial | The free Entry edition belongs, according to the documentation, to the commercially licensed Enterprise Edition and shows 10,000 messages |
| Video | Jitsi Meet | Apache-2.0 | Meetings in the browser; in your own operation, configurable without an account for participants |
| Video | OpenTalk | EUPL-1.2 | In use in the Schleswig-Holstein state administration |
| Sign-in | Keycloak | Apache-2.0 | SAML and OpenID Connect for own and third-party applications |
| Sign-in | authentik | MIT, enterprise directory commercial | Easy to get started, enterprise features licensed separately |
Two points decide the selection more often than the feature list. First, the Outlook question: those who want to keep Outlook as a program have few candidates among the open solutions. Second, the licence limit: several projects are open at the core and keep features such as multi-tenancy, high availability or support in a commercial edition. That belongs on the table before the decision, not after. The comparison of the office components is in Nextcloud Office, Euro-Office, Collabora and ONLYOFFICE.
What does the legal framework say about outage preparedness?
The following references explicitly name availability and outage preparedness. Whether an obligation applies in an individual case depends on the classification of the company.
| Regulation | Reference | Content |
|---|---|---|
| BSI Act (BSIG; implementation of NIS2, in force since 6 December 2025) | Section 30(2) nos. 3, 4 and 10 BSIG | Maintaining operations with backup management, recovery after an emergency and crisis management; supply chain security; where applicable, secured emergency communication systems |
| GDPR | Art. 32(1)(b) and (c) | Ensure the ongoing availability and resilience of systems; restore the availability of personal data promptly after an incident |
| DORA, financial sector | Art. 28(8) and Art. 29 | Exit strategies and concentration risk for ICT third-party service providers |
| BSI Standard 200-4 | Business Continuity Management | Method for emergency preparedness and restart, as a standard and not as a law |
The texts do not prescribe any particular technology or a change of provider. The laws name maintaining operations and recovery as measures, each for its own group of addressees; the BSI standard is a method and does not establish an obligation on its own. How offers labelled "sovereign" should be examined is described in the checklist against sovereignty washing.
Which assumptions do not stand up to scrutiny?
"Microsoft guarantees 99.9 percent." The SLA names 99.9 percent as a threshold and provides for a credit on request where it is not met, capped at the monthly fee of the service and, under the SLA, as the sole remedy.
"Our data is in the EU, so this does not affect us." Microsoft confirmed that users in any region may be affected. The data location does not separate a tenant from the platform.
"We have a backup, so we are prepared." A backup serves to restore data. During an outage, a service is additionally needed over which work can continue.
"In our own operation, nothing fails." Own systems and European providers also have disruptions. The difference is the possible limitation of a disruption to individual components and your own decision on fallback system and restart.
"Open source makes you independent." Open licences secure the right to keep operating the software yourself or with another service provider. Dependencies on the operator and on commercial editions of individual projects remain and belong in the selection.
"Yesterday's emails are gone." Under RFC 5321, sending servers keep temporarily undeliverable mail in the queue and retry; the guideline of the standard is at least four to five days. Microsoft speaks of delayed delivery. We have not found a confirmation in Microsoft's notices so far that nothing was lost.
Status and methodology
The details of the incident come from the messages of the Microsoft 365 Status account and the Microsoft status page, retrieved on 13 November 2026 up to 4:00 pm CET. At that time, the incident had not been reported as resolved, so duration and cause are not established. Press reports are named where Microsoft itself makes no statement. The SLA was read in the version of 1 October 2026; the threshold values in minutes and hours are our own calculation. Licences come from the licence files of the repositories, information on features and editions from the vendors' documentation. We will add to the article as soon as Microsoft publishes the announced report.
Our approach at WZ-IT
- Take stock. Which functions depend on Microsoft 365: mail, calendar, files, meetings, sign-in, interfaces. Which of them may fail for how long.
- Set the level. Outage readiness, individual components or a complete switch. If the selection is still open, the selection consulting for collaboration provides a decision template.
- Pilot. The first component runs with one user group in parallel to Microsoft 365, with its own sign-in and a documented way back.
- Switch over. Data and users move in stages, not on a single cut-off date.
- Operate. Updates, backups, monitoring and response according to the agreed service level through Managed Open Source, in German data centres or on your own hardware.
Further guides
- Microsoft 365 alternative for companies: the open-source components in detail
- Mailcow, Stalwart or Mailu: running a mail server yourself, compared
- Nextcloud Office, Euro-Office, Collabora and ONLYOFFICE compared
- Spotting sovereignty washing: checklist for cloud procurement
- Managed Open Source at a glance
Do you want to know which level fits your company? In the initial consultation, we take stock of which functions depend on Microsoft 365 and which component makes the biggest difference. Book an initial consultation · View Managed Open Source
Sources
- Microsoft 365 Status: first message on EX1550543, 12 November 2026
- Microsoft 365 Status: MO1550821
- Microsoft 365 Status: users in any region may be affected
- Microsoft 365 Status: servers unexpectedly unavailable
- Microsoft 365 Status: no correlating change found
- Microsoft 365 Status: core process overloaded
- Microsoft 365 Status: servers stop responding again under load
- Microsoft 365 Status: window for mail extended to 48 hours
- Microsoft status page
- Microsoft: Service Level Agreement for Microsoft Online Services, 1 October 2026
- Microsoft Learn: Service health and continuity, global availability per quarter
- Microsoft Learn: Shared responsibility in the cloud
- Microsoft Learn: Backing up email in Exchange Online
- Microsoft Learn: Microsoft 365 Backup
- Microsoft Learn: Manage mail flow using a third-party cloud service
- Microsoft Learn: Emergency access accounts in Microsoft Entra ID
- Microsoft Learn: Microsoft Entra application gallery
- Microsoft Learn: Cached Exchange Mode
- Microsoft Support: Turn on Cached Exchange Mode
- RFC 5321, section 4.5.4.1 Sending Strategy
- tagesschau.de: What is known about the outage of Microsoft services, 13 November 2026 (German)
- Reuters: Microsoft outage drags on for hours
- t-online: Microsoft disruption, new information on the status (German)
- FAZ: Why federal authorities kept working undisturbed (German)
- Bitkom: German companies could survive 16 months without digital imports, 19 October 2026 (German)
- Bitkom: Cloud Report 2026 (PDF, German)
- Schleswig-Holstein state government: switch of the mail system completed, 6 October 2025 (German)
- Gesetze im Internet: Section 30 BSIG (German)
- EUR-Lex: GDPR, Regulation (EU) 2016/679
- EUR-Lex: DORA, Regulation (EU) 2022/2554
- BSI: Standard 200-4 Business Continuity Management (German)
- grommunio: Technology
- grommunio: Pricing
- Stalwart: Comparison of editions
- Mailcow: Outlook connection
- Collabora Online Development Edition (CODE)
- ONLYOFFICE DocumentServer, repository
- Mattermost: Editions and offerings
- Hornetsecurity: Email Continuity Service (German)
- Retarus: Whitepaper Email Continuity (PDF, German)
