User impact: Users may be unable to access or use some Microsoft 365 services and features.

More info: The impacted services and their impact scenarios were as follows:

Exchange Online
– Users may have been unable to access using the following impacted connection methods: Outlook on the web, Outlook desktop client, Representational State Transfer (REST), Exchange ActiveSync (EAS)
– Users may have experienced mail transport delays.

Microsoft Teams
– Users may have been unable to create or update Virtual Events, including webinars and Town Halls.
– Users may have been unable to access or modify their calendar in Microsoft Teams. This would include loading the calendar, viewing meetings, creating/updating meetings and joining meetings.
– Users may have been unable to create chat, add users and create or edited meetings.
– Users may have been unable to create or modify new teams and channels.
– Users may have been unable to update presence.
– Users may have been unable to use the search function.
– Users may not have seen an updated list of files and links failing to load within the Chat shared tab.

Microsoft Purview
– Users may have been unable to access the Purview Portal, or Purview Solutions.
– Users may have experienced delays in policy stamping and with Adaptive Scope Evaluations.

Microsoft Fabric
– Users may have been unable to export content or set and view labels.
– Some Microsoft Fabric users with Purview Information Protection Policies with sensitivity labels enabled, may have been unable to use interactive operations on Power BI Desktop format files and reports, including export operations on Fabric artifacts with Sensitivity labels applied.

SharePoint Online
– Users may have been unable to use the search feature.

Microsoft Defender for Office365 and the XDR portal
– Users may have been unable to create simulations, simulation payloads or end user notifications.
– Users may have experienced issues with delivery for end user notifications and simulation messages.
– Some users may have experienced failures in manual or AIR approved Remediation Actions submitted through ThreatExplorer, Advanced Hunting or the Action Center.
– Users may have experienced issues with viewing simulation reports, and content.
– Users may have received a “You can’t access this section” error when accessing sections of the Defender XDR portal, such as the Incidents and Alerts pages, that include affected Defender for Office 365 shared components.

Universal Print
– Users may have been unable to Print via Universal Print.
– Users may have been unable to list Printers/Printer Shares on the Azure Portal Universal Print blade.
– Users may have been unable to Register Printers via Universal Print.

Power Automate for Desktop
– Users may have experienced errors when running flows that utilize cloud connectors.
Microsoft Bookings
– Users may have been unable to access their bookings.

Microsoft Viva Engage
– Users may have been unable to load topics in feeds and threads.
– Users may have seen searches or autocomplete fail for topic experiences.
– Users’ Microsoft Teams Q&A experiences may not have shown user names.
– Users may not have been able to load their home feeds.

Microsoft Copilot
– Users may have been unable to use the personal Copilot panel in meetings and post meetings.
– Users may have been unable to see historic Copilot conversation history in meetings and post meetings.
– Users may have been unable to load Copilot experiences within the Viva Engage service.
– Users may have been unable to submit queries to Copilot within OneNote through the chat pane and context menu. Users may have received an apology or “at capacity” message.

Final Status: After a period of extended monitoring, we’ve confirmed through customer reports and service health telemetry that the issue is resolved.

Scope of impact: This issue could have impacted any user hosted globally; however, users experienced varying degrees of impact depending on how they were routed through the affected infrastructure and what action they were trying to perform. Impacted users who attempted to use the functionalities outlined in the More info section of this communication may have been affected by this event

Start time: Sunday, November 25, 2024, at 1:20 AM UTC

End time: Tuesday, November 26, 2024, at 11:00 AM UTC

Preliminary root cause: Due to a recent change that decommissioned a backend service, requests were directed to an incorrect endpoint. This resulted in request handling issues and affected servers’ processing capabilities, which led to impact.

Next steps:
– We’re examining the parameters required to decommission backend services so we can better anticipate, test for, and avoid or prevent similar scenarios.
– We’re assessing monitoring optimizations we can better detect and more quickly remediate router service issues.

We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.