DEV Community: epifive

Claude for Manufacturing: Setup and the Microsoft 365 Connector

epifive — Sat, 14 Nov 2026 17:36:45 +0000

Anthropic launched Claude for Manufacturing on November 12, 2026: a plugin for Claude with 17 skills and four connectors (Autodesk Fusion, Infor, Microsoft 365 and Oracle NetSuite) that drafts quotes, quality reports and supplier requests from a plant's own records. It is available on Claude Team and Enterprise plans; you install the plugin, then tell Claude "Set us up," and a person approves every draft before it reaches a customer or supplier.

This guide is for IT admins and Microsoft 365 administrators at small and mid-sized manufacturers who have been asked to "turn on the Claude manufacturing thing." It covers what Anthropic has actually documented: what the plugin does, who it fits, the setup steps, what you need to prepare in Microsoft Entra ID and SharePoint for the Microsoft 365 connector, security questions to settle before rollout, the limits, and a factual comparison with Microsoft 365 Copilot. Where Anthropic hasn't published a detail, this guide says so instead of guessing.

What Claude for Manufacturing is

Claude for Manufacturing is a plugin, not a separate app or a new model. A plugin bundles skills (written instructions for specific tasks) and connectors (links to business systems) so Claude can carry out a workflow inside the Claude apps your users already have. Anthropic describes the scope as everything "from pricing a new job to diagnosing a stopped machine."

The 17 skills span sales, quality, operations, supply chain, design and setup. Some do one task; others chain several steps and stop when a person needs to review. Anthropic's announcement and product page describe these workflows:

Workflow	What Claude does	Who signs off
Quoting a new job	Reads the customer's request, flags missing information and drawing gaps, compares costs on similar past jobs and drafts the quote	The estimator releases the quote
Failed inspection to 8D	Documents the failure, searches earlier nonconformance reports (NCRs) for the same issue, ranks likely causes and drafts the corrective action report (8D)	The quality engineer verifies the fix
Machine down	Reviews sensor exports, repair notes, photos and the OEM manual and ranks probable causes	The technician decides what to check
Sourcing from another supplier	Prepares the request for quotes and compares the bids that come back	The buyer
Comparing designs in Autodesk Fusion	Creates variations of an existing model, scores them against the engineer's targets and drafts a decision memo	The engineer
Morning production report	Combines output versus target, downtime and the cost of downtime and missed output into one report	The plant manager

The full list of 17 skill names is not published on the announcement, the product page or the Manufacturing Dive report we read. The plugin's directory listing on claude.ai requires a Claude sign-in, so we could not check it. Anthropic says the skills are starting templates that you can customize to your own forms, and that it will add more skills over time.

The four connectors do different jobs:

Autodesk Fusion: generates design variations so engineers can evaluate more options.
Infor: lets buyers and planners look up purchase orders and stock. This connector only reads records. Infor is releasing its own "Infor in Claude" plugin that can also make changes in Infor after a person approves, and Anthropic says "Claude's access follows the buyer's Infor permissions."
Microsoft 365: finds procedures, supplier emails and exported reports in shared folders and inboxes.
Oracle NetSuite: pulls orders, inventory, production steps and job costs for quote pricing.

For systems without a connector (an older ERP, a quality system or an MES), Anthropic's answer is simple: save regular exports from those systems to Microsoft 365, and Claude works from the files. That makes the Microsoft 365 connector the center of most small-plant deployments, and it is why the IT side of this rollout is mostly a Microsoft 365 project.

Who it is for and availability

Anthropic's product page is direct about fit. The plugin "fits best where each job gets its own quote, drawing, and routing," with quality issues handled through NCRs and 8Ds, which describes a typical job shop or contract manufacturer. Asked whether it suits process manufacturers, Anthropic answers "Partly, today": food, consumer packaged goods, chemicals and steel producers can use the morning report, breakdown diagnosis and supplier skills right away, and can adapt the quoting and quality skills to batch records.

Item	What Anthropic says
Launch date	November 12, 2026
Plans	Claude Team or Enterprise (the product page FAQ says paid plans, including Enterprise bought through AWS Marketplace)
Price	No separate price published; the product page links only to general Claude pricing
Named customers	None named in the announcement
Roles it targets	Estimators, quality engineers, technicians, buyers, planners, engineers and plant managers
Webinar	Technical webinar on November 17, 2026, at 11:00 a.m. ET

Anthropic's case for the product rests on one statistic it cites: in a 2025 Manufacturing Leadership Council survey, 79% of manufacturers said they enter data manually. Lauren Collett, Anthropic's enterprise go-to-market leader, told Manufacturing Dive the goal is to cut the "internal toil" of gathering information from different systems, while "making sure a person is signing off on every draft."

Requirements

Before you start, confirm these on both the Claude side and the Microsoft side:

A Claude Team or Enterprise plan, and an Owner or Primary Owner who can change organization settings. On Enterprise, a custom role that can manage the organization's libraries can also manage plugins. Anthropic's help center notes that the role labeled Admin in the members list does not include the plugins page.
Cowork and Skills turned on for the organization. Anthropic's plugin management article says both must be enabled before you can use plugin marketplaces.
A Microsoft Entra Global Administrator for the one-time tenant-wide consent of the Microsoft 365 connector. Users need work or school accounts in an Entra tenant with an active Microsoft 365 license.
Accounts for the other systems you plan to connect: Oracle NetSuite, Infor or Autodesk Fusion, with the permissions each user should have. Anthropic says connectors typically respect each user's existing permissions.
A decision on where exports will live in SharePoint or OneDrive if you have systems without a connector (see the Microsoft 365 section below).

How to set up Claude for Manufacturing, step by step

Anthropic's announcement gives three steps, and its plugin and connector help articles fill in the admin side. Steps below come from those pages; menu names are quoted as Anthropic writes them.

1. Make the plugin available to your users (Claude owner)

Confirm Cowork and Skills are enabled for the organization.
Install the plugin from Anthropic's plugin directory. The announcement's "Install the plugin" link opens the Claude for Manufacturing page in the directory, and the product page FAQ says admins install it from there.
Choose who gets it in Organization settings > Plugins & skills. On the Inventory tab, open the plugin's row menu, choose Default access and pick an install preference: "Installed by default", "Available to install", "Required" or "Not available". Changes take effect on each member's next session or plugin refresh.
On Enterprise, you can target a group instead: row menu > Group access… > Add groups next to Install targeting. Groups can be created manually or synced from your identity provider through SCIM. If a person is in several groups, the most permissive setting wins, so Anthropic's advice for a limited pilot is to set the organization-wide preference to "Not available" and grant access only to the pilot group.

Members who were given "Available to install" find the plugin on the Discover tab in Customize > Plugins.

2. Add the connectors (Claude owner and Entra admin)

For the Microsoft 365 connector on Team and Enterprise, a Claude owner goes to Organization settings > Connectors, clicks + Add, then All available, finds Microsoft 365 and clicks Add to your team. A Global Administrator then grants the tenant-wide consent described in the next section. The other three connectors are added and authorized for their own systems; Anthropic's manufacturing pages don't publish separate setup steps for them.

3. Tell Claude "Set us up"

Any user with access opens Claude and types "Set us up." According to Anthropic, Claude then asks which systems the team uses, tests the connectors and reports which skills can't fully run yet. Treat that report as your gap list: it tells you which exports you still need to schedule into Microsoft 365.

4. Start with one measured process

Anthropic's own guidance is that "one process is enough to start," with quoting or quality as the usual first choice. Pick one, record how long it takes today, and measure the same thing after a few weeks of drafts.

Preparing the Microsoft 365 connector: what IT must do

This is where most of the IT work sits. Everything below comes from Anthropic's "Set up the Microsoft 365 connector" article and its "Microsoft 365 connector security guide" unless marked as our recommendation.

Consent in Microsoft Entra ID

The connector uses delegated permissions only: it acts on behalf of the signed-in user through the OAuth 2.0 on-behalf-of flow, and app-only (service principal) access is not supported. A Global Administrator grants a one-time consent for the tenant in one of two ways:

Through Claude: a Global Admin with a Claude seat goes to Customize > Connectors, finds Microsoft 365, clicks Connect, chooses "Work or school account" if prompted, signs in and ticks the box to consent on behalf of the organization.
Manually in Entra: used when the Global Admin has no Claude account, or for troubleshooting. This adds two service principals, M365 MCP Client for Claude (app ID 08ad6f98-a4f8-4635-bb8d-f1a3044760f0) and M365 MCP Server for Claude (app ID 07c030f6-5743-41b7-ba00-0a6e85f37c17), and grants admin consent for each with the documented URL:

https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=<appId>

After consent, other users in the tenant connect without seeing a consent prompt.

Limit who can connect

In the Entra admin center, open the M365 MCP Server for Claude enterprise application, set Assignment required? to Yes under Properties, and add the permitted users or groups under Users and groups. Repeat for M365 MCP Client for Claude. Anthropic says both apps must be restricted to the same people. For a pilot, use one security group for both apps and for the Claude plugin group above.

Least privilege: what the connector can read

By default the connector is read-only. The read scopes include Mail.Read, Mail.Read.Shared, Calendars.Read, Teams chat and channel read scopes, meeting transcript scopes, Files.Read.All and Sites.Read.All. Write scopes such as Mail.Send, Files.ReadWrite.All and ChatMessage.Send are used only if you enable write tools.

Three details matter for least privilege:

SharePoint search is tenant-wide. Anthropic says restricting search to specific sites isn't supported and site-specific .Selected scopes aren't supported. The boundary is each user's own SharePoint permissions, so anything a user can open, Claude can find for them. If your tenant has broad "Everyone except external users" sharing, fix that first; our Microsoft 365 Copilot oversharing readiness guide covers the same cleanup.
You can revoke individual scopes. In Enterprise applications, open M365 MCP Server for Claude > Permissions > Admin consent tab, select a Microsoft Graph permission and choose Revoke. Revoking Mail.Read blocks Outlook, Sites.Read.All blocks SharePoint and Chat.Read blocks Teams chat. Tools that need a revoked scope fail with "Failed to call tool." Re-running admin consent restores the full default set, including write scopes, so revoke again afterwards.
Shared mailboxes are read-only, and the Online Archive is not searched. Mailbox search covers the primary mailbox and shared mailboxes the user can access, but not the separate In-Place Archive.

Write tools: keep drafts as drafts

If you enable write tools, each one can be set to Always allow, Needs approval or Blocked in Organization settings > Connectors > Microsoft 365. For a manufacturing pilot whose whole point is "a person approves before anything goes out," our recommendation is to leave sending tools (Outlook send and forward, Teams send, post and reply, calendar changes) on Needs approval or Blocked. Anthropic notes that sent emails carry an agent-attribution header, but file, calendar and Teams writes are not tagged, attachments are rejected, and calendar changes notify attendees automatically. For organizations that added the connector before November 9, 2026, 11 sending and calendar tools move to Needs approval on or after December 9, 2026, unless you set them otherwise.

Where to keep the exports

Anthropic says only that teams can save regular exports to Microsoft 365. It doesn't prescribe a location. Our recommendation, based on how the connector's permissions work:

Create a dedicated SharePoint site (for example, Plant Exports) whose members are only the people in the pilot group, rather than dropping exports into a broad team site or someone's OneDrive.
Use file types the connector can read: Word, Excel, PowerPoint (including legacy formats), PDF, .txt, .md and .csv. OneNote and other formats can't be read.
Name exports by system, report and date (for example, ERP_open-orders_2026-11-14.csv) and keep one folder per source system, so Claude and reviewers can trace figures back to a file.
Apply a retention label or policy to the library so old exports don't pile up, and keep supplier pricing and customer drawings in sites with the narrowest membership.

One troubleshooting note from Anthropic: Claude adds isDocument=true to every SharePoint search, so files your index doesn't mark as documents are skipped silently. If an export never shows up in answers, compare the Graph /search/query results with and without that filter.

Security and privacy questions to settle before rollout

Use this as a checklist with your security lead. The answers in brackets are what Anthropic's documentation says today.

Does Claude see more than the user can? [No. The connector mirrors each user's Microsoft 365 permissions and can't bypass SharePoint sharing or read other users' private mail or files.]
Where is Microsoft 365 data stored? [Anthropic says the connector works as a proxy, fetches content only during active queries and does not cache file content. However, tool results that are part of stored chats are retained in Claude.] Ask Anthropic how long chats are retained on your plan and how to export or delete them.
Is our data used for training? [Anthropic's privacy center says inputs and outputs from commercial products such as Claude for Work are not used for training by default, unless you send feedback (thumbs up or down) or otherwise opt in. Owners can turn off the Rate chats option under Organization settings > Data and Privacy.]
What shows up in our audit logs? [Every Graph call is recorded in your Microsoft 365 audit log with timestamp, user, operation and resource; Anthropic also logs authentication and tool-execution events.]
Will Conditional Access break it? [MFA and group assignment are supported. Device-compliance policies are checked against the device used to connect. Location and sign-in frequency policies are not supported, because later requests come from Anthropic's outbound IP addresses; the documented fix is a named location with Anthropic's IP ranges excluded from those policies, and Anthropic warns not to use that exclusion for device-compliance policies.] Test any change in report-only mode first; see our guide to Conditional Access report-only mode.
What about sensitivity labels and encryption? [Anthropic's security guide says delegated access respects Microsoft 365 DLP policies; we did not find a statement on files encrypted with sensitivity labels.] Test with a labelled file before you rely on it.
How do we turn it off fast? [Users can disconnect in Customize > Connectors, owners can disable the connector organization-wide, and admins can revoke permissions in Entra, which applies immediately.]
What about the other three connectors? Ask Anthropic and each vendor the same questions for NetSuite, Infor and Fusion; Anthropic's manufacturing pages say connectors "typically" respect each user's existing permissions.

Limitations

It does not run machines. Anthropic says the plugin doesn't operate equipment, doesn't run production control and doesn't write to systems of record. The Model Hardware Standard, a shared specification for AI agents to operate physical devices safely, is a limited research preview with research labs and advanced manufacturers, separate from the plugin.
The Infor connector only looks up records. Changes in Infor need Infor's own plugin.
Process manufacturing is a partial fit today, by Anthropic's own description.
No full skills list, no price and no named customers were published at launch.
Exports are only as fresh as your schedule. For systems without a connector, Claude works from the last file saved to Microsoft 365.
Drafts need review. Anthropic's own demo of an 8D draft marks the root cause "not validated" and leaves owners and dates blank; that review step is the design, not a bug.
Microsoft 365 search can't be narrowed to specific sites, as covered above.

How it compares with Microsoft 365 Copilot

Many small manufacturers already pay for Microsoft 365, so the obvious question is whether Microsoft 365 Copilot does the same job. The differences below come only from Anthropic's and Microsoft's own documentation.

	Claude for Manufacturing	Microsoft 365 Copilot
Vendor	Anthropic	Microsoft
Manufacturing workflows	Ships 17 manufacturing skills (quotes, NCR and 8D, production report, breakdown diagnosis, sourcing, design)	General assistant; you build manufacturing workflows with prompts or agents
ERP and CAD access	Built-in connectors for Oracle NetSuite, Infor (look-up) and Autodesk Fusion	Microsoft Graph connectors or agents, which you set up for each external system
How it reads Microsoft 365	Delegated Microsoft Graph calls through Anthropic's connector, with each user's permissions	Microsoft Graph and the Semantic Index inside Microsoft 365, with each user's permissions
Where prompts and responses are stored	In Claude; tool results in stored chats are retained	Stored with your other Microsoft 365 content; retention and search through Microsoft Purview
Training on your data	Not by default for commercial plans, except feedback	Prompts, responses and Graph data aren't used to train foundation models
Encrypted (labelled) files	Not addressed in Anthropic's connector security guide	Microsoft says Copilot honors the usage rights granted to the user
Licensing	Claude Team or Enterprise; no separate plugin price	Paid per-user Copilot license on top of Microsoft 365

In short: Claude for Manufacturing arrives with manufacturing-specific workflows and ERP connectors, while Copilot keeps the data and the interaction history inside Microsoft 365 and its Purview tools. Some plants will run both. For Copilot pricing, see our Microsoft 365 Copilot Business price guide.

Rollout checklist

Confirm a Team or Enterprise plan, an Owner, and that Cowork and Skills are on.
Fix SharePoint oversharing before connecting Microsoft 365.
Create one pilot security group; use it for plugin access and for Assignment required on both Entra enterprise apps.
Grant the Global Admin consent and record the date.
Decide which write tools stay Blocked or Needs approval.
Create the exports site, schedule exports in readable formats, and add a retention policy.
Run "Set us up" and work through the gap list it reports.
Pick one process, measure it before and after, and review the Microsoft 365 audit log in the first week.

What we checked

Read Anthropic's announcement "Introducing Claude for Manufacturing" on claude.com on 2026-11-14 and confirmed the date (November 12, 2026), 17 skills, the four connectors, the exports-to-Microsoft-365 advice, the Team or Enterprise availability, the "Set us up" step and the November 17, 11:00 a.m. ET webinar.
Cross-checked the connectors, the human sign-off and "doesn't operate equipment" against the Claude for Manufacturing product page and Manufacturing Dive's November 12 report; the product page also supplied the "Partly, today" answer for process manufacturers.
Looked for a published list of the 17 skill names on the announcement, the product page, Manufacturing Dive and Anthropic's public plugins repository on GitHub on 2026-11-14 and did not find one; the claude.ai directory listing needs a sign-in.
Read Anthropic's "Set up the Microsoft 365 connector" and "Microsoft 365 connector security guide" help articles on 2026-11-14 for the consent options, the two app IDs, Assignment required, the scope list, the tenant-wide SharePoint search, write-tool settings and Conditional Access support.
Read Anthropic's "Manage plugins for your organization" article for the Organization settings > Plugins & skills path, install preferences and Enterprise group targeting, and the privacy center article on model training.
Compared Copilot statements against Microsoft Learn's "Data, Privacy, and Security for Microsoft Copilot" page (updated 2026-11-04).
Did not use coverage that contradicts Anthropic's pages, such as claims about PLC or SCADA connectors, air-gapped deployment or pilot results.
Not tested on a live Claude Team tenant or Microsoft 365 tenant; steps follow Anthropic's and Microsoft's documentation as of 2026-11-14, and screen labels may change.

Last tested: 2026-11-14

References

Anthropic: Introducing Claude for Manufacturing (November 12, 2026) - https://claude.com/resources/articles/claude-for-manufacturing
Anthropic: Claude for Manufacturing product page - https://claude.com/solutions/manufacturing
Anthropic: Claude for Manufacturing technical webinar - https://claude.com/resources/webinars/claude-for-manufacturing-put-your-plants-know-how-to-work
Anthropic: The Model Hardware Standard, a research preview - https://www.anthropic.com/news/model-hardware-standard-research-preview
Claude Help Center: Set up the Microsoft 365 connector - https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector
Claude Help Center: Microsoft 365 connector security guide - https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide
Claude Help Center: Manage plugins for your organization - https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization
Anthropic Privacy Center: Is my data used for model training? - https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training
Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot - https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
Manufacturing Dive: Anthropic launches 'Claude for Manufacturing' (November 12, 2026) - https://www.manufacturingdive.com/news/anthropic-launches-claude-for-manufacturing/874303/
AdvancedManufacturing.org: Anthropic debuts Claude for Manufacturing (November 13, 2026) - https://www.advancedmanufacturing.org/news-desk/anthropic-debuts-claude-for-manufacturing/article_dfbe4d5b-cf4e-491f-86c4-90d57e818097.html

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Outlook stuck on "Loading Profile" or not responding: step-by-step fixes

epifive — Sat, 14 Nov 2026 05:14:50 +0000

If classic Outlook freezes on the "Loading Profile" splash screen or turns white with "Not Responding" in the title bar, work through four checks in order: start Outlook in safe mode, disable COM add-ins, repair Office, and test a new profile. These follow Microsoft's published troubleshooting steps for Outlook that hangs or crashes with Microsoft 365. Most hangs end at one of the first three steps, and none of them touches your mail.

Who this is for and what you will have at the end

This guide is for anyone using classic Outlook for Windows, the version that has File > Options > Add-ins and a Mail item in Control Panel, on Windows 11 with a Microsoft 365 or Exchange account. It also suits the person who gets the call when a colleague's Outlook will not open. The steps are written for a single PC; admin-level fixes such as policy changes are out of scope.

By the end you will know whether the cause is an add-in, damaged Office files, a damaged profile or a damaged data file, and you will have Outlook opening again with your mail intact. If you use the new Outlook for Windows (the app with a toggle in the corner), these steps do not apply; read New Outlook for Windows admin controls instead.

What "Loading Profile" actually means

Outlook shows the Loading Profile dialog while it opens your mail profile, loads add-ins and opens the data files for your accounts. If any of those stalls, the dialog never closes. Microsoft's own page for this symptom describes it as the program hanging or stopping "when the Loading Profile dialog appears".

Because three different things happen during that moment, the fix is a process of elimination rather than one magic setting. Each step below removes one suspect.

Suspect	Test that isolates it	Fix
A COM add-in	Start in safe mode	Disable add-ins, re-enable one by one
Damaged Office files	Quick Repair or Online Repair	Repair Office
Damaged or confused profile	Add a new profile and start with it	Use the new profile
Damaged data file (.pst or .ost)	Inbox Repair Tool	Repair, or recreate the .ost
Graphics hardware acceleration	Hang disappears in safe mode but add-ins are clean	Update the video driver

Before you start

Close Outlook completely. In Task Manager (Ctrl+Shift+Esc), if Outlook is listed as "Not responding", select it and choose End task, so the next start begins clean.
Install pending updates. Microsoft's Outlook troubleshooting page says to "Check for Microsoft 365 or Office updates as well as Windows updates", and to include optional updates. A restart after updating is often enough on its own.
Note whether you use a local .pst file. Outlook shows them under File > Account Settings > Account Settings > Data Files if it will open at all. If you cannot open Outlook, search File Explorer for *.pst and copy any files you find to another folder before you change anything.

Step 1: Start Outlook in safe mode

Safe mode starts Outlook without its COM add-ins, so it separates add-in problems from everything else.

Press the Windows logo key + R to open the Run box.
Type the following and select OK.

outlook.exe /safe

If a Choose Profile box appears, accept the default and select OK. Enter your password if prompted.

What the result means:

Outlook opens in safe mode. An add-in, or a setting that safe mode bypasses, is the likely cause. Go to Step 2.
Outlook still hangs in safe mode. Add-ins are probably not the cause. Skip to Step 3 (repair Office).

These instructions apply to classic Outlook only.

Step 2: Find the add-in that causes the hang

With Outlook open in safe mode, disable the add-ins, then bring them back one at a time.

In Outlook, open the File menu, select Options, and then select Add-ins.
At the bottom, next to Manage, choose COM Add-ins and select Go.
Write down the names of the add-ins that are ticked. Do not select Remove; Microsoft's page says to disable add-ins rather than remove them.
Clear all the check boxes in the list and select OK.
Close Outlook and start it normally from the Start menu.
If Outlook now opens without hanging, return to File > Options > Add-ins > COM Add-ins > Go, tick one add-in, select OK, and restart Outlook. Repeat until the hang returns. The last add-in you ticked is the cause.

Once you know the add-in, update it from the vendor, or leave it disabled if you do not need it. If the COM Add-ins list is empty and the hang continues, move on to Step 3.

Step 3: Repair Microsoft 365 Apps

A damaged Office installation can stall Outlook before any add-in loads. Repair runs for the whole suite, even if only Outlook misbehaves.

Right-click the Start button and select Installed apps.
Find your Microsoft 365 or Office product, select the ellipsis (...) next to it, and select Modify.
In the window asking how you would like to repair your programs, choose Quick Repair first. Microsoft describes it as the faster option that detects only corrupted files and replaces them.
Follow the on-screen instructions, then try Outlook again.
If the hang remains, repeat and choose Online Repair, then Repair. This is the more thorough option and takes longer. You might need to restart the PC afterward.

Save open work in other Office apps first, because Office apps close during repair.

Step 4: Test with a new Outlook profile

A profile stores which accounts Outlook opens and where their data files are. If the profile is damaged, Outlook can hang while loading it. Adding a second profile tests that without deleting anything.

Close Outlook. Open Control Panel and select Mail.
Select Show Profiles.
Select Add.
In the Profile Name box, type a name, for example Test.
Enter the user name, the primary SMTP address (for example admin@contoso.com) and the password, then select Next.
If you see "Allow this website to configure alias@domain server settings?", tick Don't ask me about this website again and select Allow.
Enter your credentials if asked, select OK, then select Finish when setup completes.

To open Outlook with the new profile without changing the default, close Outlook, hold Shift while you start it, and pick the new profile in the Choose Profile box. Microsoft's guidance is that if the new profile works, the original profile is likely corrupt.

Then decide:

If the new profile works, you can make it the default from the Mail dialog. Wait until you have confirmed that all your mail, calendar and any .pst files are available before removing the old profile.
Removing a profile also removes its associated data files, according to Microsoft. If you are not sure that those files are backed up or stored on a server, do not remove the profile.

Step 5: Check the data files

If Outlook hangs only with certain accounts, a data file may be damaged. Outlook stores mail in .pst and .ost data files.

Repair a .pst file with the Inbox Repair Tool

Back up the .pst file first. Microsoft recommends backing up your existing data file before you start the tool.
Close Outlook and open the Office16 folder. Microsoft's page lists C:\Program Files (x86)\Microsoft Office\root\Office16 for Outlook 2019 and 2016; on other builds the location can differ, so search for SCANPST.EXE if it is not there.
Open SCANPST.EXE, select Browse and choose the .pst file. Select Start to scan.
If errors are found, select Repair. The tool creates a .bak backup beside the original file.
Start Outlook with the profile that uses that data file.

Permanently deleted or badly damaged items may not be recoverable, so treat repair as a last step for local-only mail.

Recreate the .ost for an Exchange or Microsoft 365 account

For Exchange accounts, Microsoft says you can delete the offline .ost file and Outlook recreates it the next time it opens. The mailbox itself stays on the server. Download time depends on mailbox size and your connection.

Step 6: Run Microsoft's diagnostic tools

If the manual steps do not fix it, Microsoft's crash and hang article lists two Windows tools.

The Classic Outlook Connectivity troubleshooter, which Microsoft says works only on the PC where classic Outlook is installed and on Windows 10 or later.
The Microsoft Support and Recovery Assistant. On the first screen select Outlook, then Next, and choose "Outlook keeps hanging or freezing". It runs checks and suggests fixes.

The Classic Outlook Advanced Diagnostics troubleshooter creates a detailed configuration report if you need to hand details to a support engineer. None of these tools work in new Outlook for Windows.

Step 7: Consider the graphics driver

Microsoft's display-issues page says hardware acceleration is turned off automatically in safe mode, and that Office relies on up-to-date, compatible display drivers. So if Outlook opens in safe mode but all add-ins check out clean and a repair did not help, graphics are worth a look.

Open Settings > Windows Update and select Check for updates.
Select Advanced options > Optional updates and install any display driver update that is offered. If none is offered, check your PC or graphics card manufacturer's support site.
If the hang continues, in Outlook choose File > Options > Advanced and look for the Disable hardware graphics acceleration option in the Display group, then restart Outlook.

An archived Microsoft article about Outlook 2013 documents this exact symptom: a hang at Loading Profile on PCs with two video cards where the Disable hardware graphics acceleration option was not selected. It is not a current Microsoft 365 article, so treat it as a clue for unusual hardware rather than a likely cause on a typical PC. That article's registry workaround targets Office 2013 and is not repeated here.

Verification

After each step, confirm that Outlook is really healthy rather than just open:

Outlook starts from the Start menu without safe mode, and the Loading Profile dialog closes by itself.
The title bar does not show "Not Responding" while you switch folders.
Send and receive a test message to your own address.
Check Data Files under File > Account Settings and confirm every data file you expect is listed.
If you removed add-ins, confirm that the tools you need still work.

Troubleshooting common outcomes

What you see	Likely meaning	What to do
Opens in safe mode, hangs normally	Add-in or hardware acceleration	Step 2, then Step 7
Hangs in safe mode too	Office files or profile	Step 3, then Step 4
Works with new profile only	Old profile damaged	Move to the new profile, keep the old until verified
Hangs only with one account	Data file for that account	Step 5
Hang returns after a few days	An add-in updated, or a pending Office update	Check updates and re-test add-ins

Closing checklist

Close any frozen Outlook process and install Windows and Office updates.
Run outlook.exe /safe.
Disable COM add-ins and re-enable them one at a time.
Run Quick Repair, then Online Repair if needed.
Add a new profile and test it with Shift at startup.
Back up, then check the data files.
Run Support and Recovery Assistant if nothing has worked.
Update the display driver if safe mode works but nothing else explains the hang.

If Outlook opens but keeps asking you to sign in, read Outlook keeps asking for password. If it opens but cannot reach the mailbox, see Outlook Autodiscover troubleshooting for Microsoft 365.

What we checked

Opened Microsoft's "Troubleshoot Outlook for Windows issues" page on support.microsoft.com on 2026-11-14 and copied the exact wording for safe mode (outlook.exe /safe), the File > Options > Add-ins > COM Add-ins > Go path, and the instruction to disable rather than remove add-ins.
Opened the learn.microsoft.com article "Outlook crash or stop responding when used with Microsoft 365" on 2026-11-14 (page dated 2024-01-24) and cross-checked its safe mode, COM add-in and new-profile steps against the support.microsoft.com page. The two agree; the Learn page adds the Control Panel > Mail > Show Profiles > Add path and the Support and Recovery Assistant option "Outlook keeps hanging or freezing".
Opened the archived Learn article for KB 2957336 on 2026-11-14 to confirm what Microsoft documents for the Loading Profile symptom. It applies to Outlook 2013 and a graphics-hardware cause only, so we did not present its registry change as a fix.
Opened Microsoft's "Display issues in Office client applications" page on 2026-11-14 and confirmed that hardware acceleration is disabled when an app starts in safe mode.
Opened Microsoft's "Repair an Office application" page on 2026-11-14 and quoted the Windows 11 path: Installed apps > ellipsis > Modify > Quick Repair or Online Repair.
Opened Microsoft's "Repair Outlook data files (.pst and .ost)" page on 2026-11-14 and confirmed the SCANPST.EXE path listed for Outlook 2019 and 2016, the Browse, Start and Repair buttons, and the .bak backup behavior.
Not tested on a live PC or tenant; steps follow Microsoft's documentation as of 2026-11-14. The Settings > Windows Update > Advanced options > Optional updates path and the Disable hardware graphics acceleration location in Outlook options (File > Options > Advanced > Display) were not opened on a current Microsoft page in this run, so confirm the labels on your build.

Last tested: 2026-11-14

References

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

GitHub Copilot Model Deprecations on Dec 14, 2026: What to Switch To

epifive — Sat, 14 Nov 2026 05:14:14 +0000

GitHub announced on November 13, 2026 that it will deprecate six models across all GitHub Copilot experiences on December 14, 2026: Claude Fable 5, Claude Haiku 4.5, Gemini 3.8 Flash, Gemini 4 Argon, Grok 4.6 and Kimi K3. That is 30 days from today (November 14, 2026). To get ready, open the model picker in your editor, switch to a supported model, and, if you manage an organization, review its Copilot model policies.

What the Copilot model deprecation is

GitHub's changelog post, "Upcoming deprecation of selected GitHub Copilot models in December", says the six models will be deprecated "across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions)" on December 14, 2026. After that date the models are no longer available to choose in those experiences.

This is not a change to Copilot itself. Copilot keeps working; only the list of selectable models shrinks. The practical risk is anything that depends on a specific model: a model you picked by habit in the chat picker, a team convention ("use this model for agent mode"), or documentation and scripts that name one.

GitHub's suggested alternatives, as listed in the announcement:

Deprecated model	Deprecation date	Suggested alternative
Claude Fable 5	2026-12-14	Claude Fable 5.2
Claude Haiku 4.5	2026-12-14	Claude Haiku 5.5
Gemini 3.8 Flash	2026-12-14	Gemini 4 Hydrogen
Gemini 4 Argon	2026-12-14	Gemini 4 Carbon
Grok 4.6	2026-12-14	Grok 4.7
Kimi K3	2026-12-14	To be announced

Who it affects and availability

The announcement says the deprecation covers all Copilot experiences, so it is not limited to one editor or one feature. Which models you can see today still depends on your plan and where you use Copilot, as GitHub's documentation on changing the chat model notes ("such as GitHub.com or an IDE"). If you never selected one of the six models, you will probably not notice anything.

Who	What GitHub says
Individual Copilot subscribers on annual plans	Claude Haiku 4.5 is the exception: the deprecation does not apply to these subscribers for that model. The announcement does not list a similar exception for the other five models.
Everyone else	The six models are deprecated on December 14, 2026.
Copilot Business and Enterprise organizations	Suggested alternatives are enabled automatically under default model enablement, unless an administrator has turned off the global default or disabled the model.
Enterprise customers with questions	GitHub points them to their account team.

The announcement does not mention regional differences, and the changelog post gives no prices. We did not find a separate price change tied to this deprecation on the pages we opened.

Requirements

A GitHub Copilot subscription (individual, Business or Enterprise).
For individuals: access to the model picker in the Copilot Chat client you use.
For Copilot Business: GitHub's documentation says your organization must allow members to switch models.
For admins: organization owner rights to open Settings for the organization and manage Copilot model policies. If an enterprise owner has already set a model policy, GitHub's documentation says you "cannot override that setting at the organization level".

How to move off a deprecated model, step by step

GitHub's announcement asks users to update workflows and integrations to supported models before the deprecation date. The steps below come from GitHub's documentation page on changing the chat model, opened on November 14, 2026.

Users: change the model in your editor

In Visual Studio Code:

Click the chat icon in the title bar.
At the bottom of the chat view, click the CURRENT-MODEL dropdown, then click the AI model you want.

In Visual Studio:

In the menu bar, click View, then GitHub Copilot Chat.
In the bottom right of the chat view, click the CURRENT-MODEL dropdown, then click the AI model you want.

In JetBrains IDEs:

Click the Copilot icon in the status bar.
In the popup menu, click Open GitHub Copilot Chat.
In the bottom right of the chat view, click the CURRENT-MODEL dropdown, then click the AI model you want.
Optional: for a reasoning model that supports it, hover over the model and select an effort level in the Thinking Effort submenu.

In Eclipse IDE:

Click the Copilot icon in the status bar.
In the popup menu, click Open Chat.
In the bottom right of the chat panel, click the current model, then select another model from the popup menu.

In Xcode (Multi-model Chat requires the GitHub Copilot for Xcode extension):

In the menu bar, click Editor, then Copilot, then Open Chat. Chat opens in a new window.
In the bottom right of the chat view, click the CURRENT-MODEL dropdown, then click the AI model you want.

As of November 14, 2026, the documentation page we opened did not give steps for choosing a model on GitHub.com. It says only that available models depend on your plan and where you use Copilot. We have left those steps out rather than guess menu names.

Admins: review model policies

GitHub's documentation gives this path for an organization owner:

Click your profile picture in the upper-right corner of GitHub, then choose Organizations.
Click the organization you want to manage.
Under the organization name, open Settings. If you do not see it, use the More (three-dot) menu and select Settings there.
In the sidebar, under "Code, planning, and automation," click Copilot, then click Models.
For each model policy you want to set, open its dropdown and select an enforcement option.

The documentation does not list the enforcement option names, so read the dropdown on screen. It also notes that model policies beyond the basic models may incur additional costs.

The announcement explains what happens automatically. For Enterprise and Business customers, the suggested alternatives are enabled "under default model enablement", unless an administrator has turned off the global default or disabled the model. If the global default is off, admins can enable the alternatives through model policies in Copilot settings. So if your organization turned the default off, the replacement models will not appear on their own, and users may be left with fewer choices after December 14, 2026.

Suggested order of work

List which of the six models your team actually uses. Ask in chat or check shared documentation, since the announcement does not describe a usage report.
Pick the suggested alternative for each, or another supported model from GitHub's supported models page.
Update team conventions, onboarding notes and any integrations that name a deprecated model.
Admins: confirm the replacement models are allowed in the organization's model policies, and check for an enterprise-level policy that overrides it.
Revisit on or after December 14, 2026 to confirm the picker shows only supported models.

Limitations

GitHub has not named a replacement for Kimi K3. The announcement says "to be announced"; pick another supported model for now.
The Claude Haiku 4.5 exception is only for individual subscribers on annual plans. Monthly individual plans, Business and Enterprise are not covered by it, according to the announcement.
The announcement does not say whether one replacement behaves like the model it replaces. Quality, speed and cost can differ, so test your own prompts on the suggested model.
Whether a replacement counts the same against any usage limits or premium request allowances is not stated in the changelog post. Check your plan's documentation.
We could not read the deprecation sections of GitHub's long supported models reference page in this run (it is very large and our fetch covered only part of it), so we rely on the changelog post for the list and dates.

Privacy and admin notes

The announcement says nothing about data use or training for these models, and this guide does not make any claims about it. Model providers differ, so admins who restrict models for compliance reasons should review each replacement model before allowing it in their organization's model policies.

For governance, the key control is the organization Settings > Copilot > Models page described above. Because the automatic enablement of alternatives depends on default model enablement and on whether a model was disabled, an organization that deliberately disabled specific models keeps that choice. Replacement models that were never enabled will not be enabled for you in that case.

What we checked

Opened the GitHub Changelog announcement on 2026-11-14 and confirmed the six models, the shared deprecation date of December 14, 2026, and the suggested alternatives.
Confirmed the Claude Haiku 4.5 exception for individual annual subscribers and the Business and Enterprise default-enablement wording in the same announcement.
Opened GitHub's "change the chat model" documentation on 2026-11-14 and copied the VS Code, Visual Studio, JetBrains, Eclipse and Xcode steps and labels from it.
Opened GitHub's documentation on managing Copilot model policies for an organization on 2026-11-14 and copied the Settings > Copilot > Models path.
Counted the days from 2026-11-14 to 2026-12-14: 30 days.
Not verified: steps for choosing a model on GitHub.com, the enforcement option names in the model policy dropdown, and whether each suggested model is available on every plan. Not tested on a live Copilot account.

Last tested: 2026-11-14

Sources

GitHub Changelog, "Upcoming deprecation of selected GitHub Copilot models in December" (November 13, 2026): https://github.blog/changelog/2026-11-13-upcoming-deprecation-of-selected-github-copilot-models-in-december
GitHub Docs, supported AI models in Copilot: https://docs.github.com/copilot/reference/ai-models/supported-models
GitHub Docs, change the chat model: https://docs.github.com/en/copilot/how-tos/use-ai-models/change-the-chat-model
GitHub Docs, manage Copilot policies for an organization: https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-organization/manage-policies

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

AI Ad Creatives for a Small Business: AdCreative.ai vs Canva vs ChatGPT Images (2026)

epifive — Sat, 14 Nov 2026 05:13:39 +0000

Disclosure: This article contains affiliate links. If you buy through them, EpiFive may earn a commission at no extra cost to you. Details.

AdCreative.ai, Canva and ChatGPT can all help a small business make ad images, but they solve different problems. AdCreative.ai is a paid tool built for one job: producing many ad variants in standard sizes from your brand details. Canva is a design tool with templates and AI features, with a useful free plan. ChatGPT makes and edits images from a conversation, which is good for ideas and backgrounds but leaves layout and exact text to you. If you already have decent product photos and need a handful of ads a month, the free options are often enough. This guide shows how to make a first set with each tool, what each costs as of 14 November 2026, what the licensing terms say, and the Meta and Google rules on AI content.

Who this is for and what you will have

This is for small-business owners, office managers and the one person in the company who "does the marketing", mostly running Facebook, Instagram and Google ads with a small budget. By the end you will know which tool fits your situation, have a step-by-step plan to produce a first set of ad images in each, and know what to check before an AI image goes into a paid ad.

Nothing here is a product test: EpiFive did not run campaigns with these tools or measure their results. Features, prices and terms come from each vendor's own pages, which are listed in the References.

What each tool does

	AdCreative.ai	Canva	ChatGPT
Main job	Generates ad creatives, ad copy and product visuals from a brand profile	General design: templates, editing, resizing, AI image tools	Chat assistant that also creates and edits images
Starting point	Your website URL, logo, colors and brand description	A template or a blank design at your chosen size	A text prompt, optionally with your own photo
Ad sizes	Picks sizes per project	Templates per format; Magic Resize on paid plans	You ask for an aspect ratio; final layout is up to you
Ad copy	Built-in text generator	Magic Write	Yes, through chat
Connects to ad accounts	Meta, Google, LinkedIn, Pinterest and others	Not covered in this guide	No
Free option	7-day trial only	Canva Free plan	ChatGPT Free, with limited image creation

AdCreative.ai also lists product photoshoots, fashion and product videos, stock images from iStock, a "Creative Scoring" feature that predicts performance, competitor insights and a compliance checker. Its homepage claims are marketing claims; this guide does not repeat its conversion figures because they could not be checked independently. The company is part of the Appier group, according to its terms.

Canva's AI tools come in three tiers (Standard, Premium and Ultra), and every plan has a monthly AI allowance. On paid plans, Standard tools such as Magic Write and Translate do not count against it.

ChatGPT's pricing page lists "Limited image creation" on Free, more on Go, "more complex and accurate image creation" on Plus, and "Unlimited and faster image creation" on Pro, within OpenAI's abuse guardrails. OpenAI does not publish a fixed number of images per plan.

Prices and free trials (checked 14 November 2026)

Prices change often, and two of these vendors show prices by location, so confirm on the vendor's page before you buy.

Tool	Free option	Paid plans (USD)	Trial terms
AdCreative.ai	None beyond the trial	Starter $39/month (20 credits, 1 brand, 1 user); Professional $249/month (300 credits, 10 users); Ultimate $999/month (300 credits, 25 brands, 20 users); Enterprise on request	7 days; card required at sign-up; the homepage said 20 credits on 14 November 2026, while a Black Friday promotion was running
Canva	Canva Free	Pro and Business (per person); Canva's page shows the price for your location	Free trial of Pro or Business, once per account and once per payment method; trial AI allowance is the same as Canva Free
ChatGPT	ChatGPT Free	Go, Plus, Business, and Pro "from" $100/month; the page shows the price for your location	No trial is needed to try image creation, because Free includes some

Notes on the AdCreative.ai figures:

Credits are used when you download a creative; generating previews is unlimited, according to its FAQ. Unused credits do not carry over to the next month, according to its terms.
Larger credit packs cost more: Starter goes up to 120 credits for $189 a month. The page showed 50% off quarterly and yearly billing as a Black Friday promotion, for example Starter at $20 a month billed quarterly.
The Professional card listed "10 Brands" in its price options and "Brand Limit: 3" in its summary on the same page. Ask before you rely on either number.
The trial renews into a paid plan unless you cancel. The help center says you can cancel at any time, and that if you forget and are charged it offers a refund within 7 days of the charge on monthly plans and 30 days on yearly plans. The FAQ adds the condition that the platform has not been used, and the terms describe refunds as at the company's discretion.

For Canva, the pricing page loads its prices by location, and from where it was checked it showed a non-US currency. Independent price trackers reported Canva's US prices in late October 2026 as $18 a month or $144 a year for Pro, and $25 a month or $250 a year per person for Business; treat those as a guide only. For ChatGPT, the pricing page data showed Pro "from" $100 a month; check chatgpt.com/pricing for Go and Plus in your country.

Independent feedback is worth a look before any trial that needs a card. On 13 November 2026 AdCreative.ai's Trustpilot page showed a TrustScore of 3.5 from 4,659 reviews, with 56% five-star and 32% one-star ratings. The most common complaint was a trial that rolled into a paid plan, and many positive reviews praised support staff for sorting out charges. The company has claimed its profile and invites reviews, so read a sample yourself.

Make a first set of ad creatives with AdCreative.ai

These steps follow AdCreative.ai's help center.

Start the 7-day trial at AdCreative.ai (affiliate link). Before you enter a card, put a reminder in your calendar a day or two before the trial ends.
Create a brand: select Brands in the left menu, then Create a Brand. Enter your website URL and select Scan My Website so it reads your name, logo and description, then correct anything it got wrong. The app picks three colors from your logo; add a short brand description so the copy fits your business.
Decide whether to connect ad accounts under Advanced Setup. Connecting Meta or Google gives AdCreative.ai access to your ad account data, and its terms allow it to use your account data to improve its AI. You can evaluate the tool without connecting anything.
Create a project: open Projects, choose to create a new project, select Generate, then pick the feature you want (for example ad creatives). Choose the size, write your headline or let the AI suggest text, pick a background image from the stock library or upload your own product photo, then select Generate.
Review the results. Previews can look blurred when servers are busy; the help center says downloads are in full resolution.
Tick the creatives you like and download them, or push them to a connected ad account. Each download uses credits, so download only the ones you will actually run.
If you do not want to continue, go to Settings, then the Account tab, select Cancel My Subscription, fill in the form and type CONFIRM. Cancellation takes effect at the end of the current billing period. Keep a screenshot of the confirmation.

Make a first set with Canva

Search Canva's templates for the placement you need, such as a Facebook ad, an Instagram post or a story, or create a blank design at the size your ad platform asks for in its current ad specs.
Add your brand: upload your logo, set your colors and fonts. Paid plans add Brand Kits, which keep logos, colors and fonts in one place for the team.
Use your own product photos where you can. Background Remover is included with paid plans. To create imagery, use Magic Media or Canva AI; each use draws on your monthly AI allowance.
Write the headline and offer yourself, or draft them with Magic Write, then check every word, price and date by hand.
Make the other sizes: on paid plans, Magic Resize copies the design into several formats at once, and each use counts against the AI allowance. On Canva Free, duplicate the design and adjust it manually.
Download PNG or JPG files for upload. Canva's help notes that Background Remover on its own does not add Canva's AI-generated content metadata, so it should not by itself get a design labelled "AI content" on platforms such as Instagram. Designs made with Canva's generative tools may carry that metadata and get the label.

Make a first set with ChatGPT images

Describe the image you need in one message: the product, the setting, the audience, the style, the aspect ratio, and where to leave empty space for a headline. Ask for no text in the image; you will add text later where you can edit it exactly.
To keep your real product in the picture, upload a product photo and ask ChatGPT to change only the background or setting. Check that the product, label and colors are unchanged, because an altered product in an ad can mislead buyers.
Ask for two or three variations, then pick one and refine it with specific changes ("warmer light", "more space on the left").
Ask ChatGPT for five headline and body-text options in your brand voice, then edit them yourself.
Put the image and final text together in Canva or another design tool, and make each size there.
Keep the original downloaded file. OpenAI adds C2PA Content Credentials and a SynthID watermark to images from ChatGPT, and says metadata can be stripped by resizing, format changes or screenshots. You can check a file at openai.com/verify.

Licensing and commercial use

The background is in AI image generation for business: licensing and copyright basics: vendor ownership terms, indemnities and copyright protection are three separate questions. Here is what each vendor's current terms say.

AdCreative.ai (Terms of Service for Online Subscribers, updated 19 December 2025): you keep your rights in what you upload, and you warrant that you have the rights to it, including any photos of people. The terms say generated designs "may not be unique" and other users may get similar results. They do not contain a clause that expressly assigns ownership of the generated creatives to you, while the Enterprise plan is advertised with "Complete Asset IP Rights". Stock images come from iStock and are excluded from AdCreative.ai's own IP clause. The terms also give AdCreative.ai a license to use your logo and company name in its own marketing unless you agree otherwise in writing, offer no indemnity, and make you responsible for third-party claims about your content. If ownership matters to you, ask the company in writing before you build a brand campaign on its output.
Canva (AI Product Terms, effective 26 June 2026): you own your output, except output that modifies or incorporates Canva library content, which is licensed to you. Outputs may not be unique. The terms forbid using AI output to mislead anyone that it is human-made and forbid removing provenance metadata such as C2PA.
ChatGPT (OpenAI Terms of Use): you keep ownership of your input and own the output, and OpenAI assigns to you any rights it has in the output. OpenAI's business terms add that output may not be unique.

For any AI image you use in an ad, keep a simple record: tool, plan, date, prompt, source photos and what you edited by hand. If you write an internal AI policy, the AI usage policy template for small businesses has a section for this.

Brand safety and ad platform rules

Meta (Facebook and Instagram)

Meta labels ads made or significantly edited with its own generative AI features with "AI info". If the AI adds a photorealistic person, the label appears next to "Sponsored"; otherwise it can sit behind the three-dot menu. Since 1 June 2026, Meta says it automatically detects ads made or edited with third-party AI tools through industry-standard signals and adds the "AI info" label in "About this ad". You do not have to disclose AI use yourself for an ordinary product ad, but expect the label.

Ads about social issues, elections or politics are different. Meta requires the advertiser to disclose photorealistic images, video or realistic audio created or edited with third-party generative AI tools that show a real person saying or doing something they did not, a realistic-looking person or event that does not exist, or a realistic event that is not a true recording. If Meta finds an undisclosed ad, it rejects it, and repeated failures can lead to penalties against the advertiser.

Google

For election ads, Google requires you to tick the "Altered or synthetic content" checkbox in campaign settings when an ad contains synthetic content that inauthentically shows real or realistic-looking people or events. Google adds the label automatically on some formats; on the rest you must add a clear label yourself.

If you run Shopping ads, Google Merchant Center requires AI-generated product images to keep metadata showing they are AI-generated, such as the IPTC DigitalSourceType value TrainedAlgorithmicMedia, and tells you not to remove it. AI-written titles and descriptions go in the structured_title and structured_description attributes.

General brand-safety checks

Do not invent customers. The FTC's rule on consumer reviews and testimonials (announced August 2024) bans fake reviews and testimonials, including ones attributed to people who do not exist, such as AI-generated reviewers. An AI "customer" holding your product with a quote is a risk.
Show the product as it is. An AI background is fine; an AI-improved product that buyers will not receive is misleading.
Keep other brands, logos, celebrities and recognizable people out of prompts and uploads unless you have permission.
Proofread every word in the image: prices, dates, phone numbers and spelling.
Keep the provenance metadata in the files you upload, and do not try to remove it. Canva's terms forbid removing it, and Google's Merchant Center rules require it for AI product images.

Which tool should you pick?

You run a few ads a month and have good product photos: start with Canva Free and your own photos, and add ChatGPT Free for backgrounds and copy ideas. Spend money on the ads, not the tools.
You advertise on Google or Meta and want to stay inside one account: try the free generative tools already in the ad platforms first. Google Ads has an image editor that can generate images, replace backgrounds and create the sizes needed for Performance Max and Demand Gen, and Meta has generative AI creative features in its ads tools.
You make designs every week and need consistent branding across sizes: Canva Pro or Business is the practical upgrade, mainly for Brand Kits, Background Remover, Magic Resize and the larger AI allowance.
You need dozens of variants per campaign for A/B testing, across several brands or clients: this is where AdCreative.ai fits. Use the 7-day trial with a real campaign brief, download only what you would run, compare the results with what you can make in Canva, and decide before the trial ends. Check the licensing points above first if you plan to use the creatives in long-running brand campaigns.
You only need ad copy: ChatGPT Free or the text tools built into the ad platforms are enough.

What we checked

Read AdCreative.ai's homepage pricing section on 13 and 14 November 2026: the plan prices, credits, brand and user limits, the Black Friday banner, the 7-day trial and the "20 credits" trial wording quoted above, including the Professional card that shows both "10 Brands" and "Brand Limit: 3".
Read AdCreative.ai's Terms of Service for Online Subscribers (updated 19 December 2025) in full, including clauses 3.2 (similar results), 4.2 and 4.6 to 4.7 (renewal, credits, refunds), 6 (your content), 7 (intellectual property), 10.1 (use of account data) and 12.2 (use of your logo).
Opened the AdCreative.ai help center articles on the credit card at sign-up, cancelling, adding a brand, creating a project, downloading and blurred previews; the steps above use their menu labels.
Read Canva's help pages on upgrading, AI usage, Magic Resize, Background Remover and Brand Kits, and the Canva AI Product Terms effective 26 June 2026. Canva's pricing page loaded prices in a non-US currency from our location, so its US prices could not be confirmed first-hand.
Read the ChatGPT pricing page on 13 November 2026 for the per-plan image wording and the Pro "from $100" label; other plan prices were shown in local currency.
Checked Meta's newsroom post on generative AI transparency in ads (updated 1 June 2026), Meta's policy on ads about social issues, elections or politics, Google's political content policy section on synthetic content, Google Merchant Center's AI-generated content page and the FTC's August 2024 announcement on fake reviews.
OpenAI's terms and help pages refused automated access, so the ownership and provenance wording for ChatGPT comes from the indexed text of those pages; confirm it on the pages themselves.
Read AdCreative.ai's Trustpilot page on 13 November 2026 for the score, review count and star split.
Not tested: no trial was started with any of the three tools, and no ads were generated or run, so output quality and ad results are not assessed.

Last tested: 2026-11-14

References

AdCreative.ai homepage, pricing and FAQ: https://www.adcreative.ai/
AdCreative.ai Terms of Service for Online Subscribers: https://www.adcreative.ai/legal/en/terms-of-service-for-online-subscribers
AdCreative.ai help, credit card at sign-up: https://help.adcreative.ai/en/articles/5714055-why-does-adcreative-ai-ask-for-my-credit-card-details
AdCreative.ai help, cancel your account: https://help.adcreative.ai/en/articles/5713780-how-can-i-cancel-my-account
AdCreative.ai help, add a brand: https://help.adcreative.ai/en/articles/5713533-how-to-add-a-brand
AdCreative.ai help, create a new project: https://help.adcreative.ai/en/articles/5713794-how-to-create-a-new-project
AdCreative.ai help, download generated posts: https://help.adcreative.ai/en/articles/5716990-how-can-i-download-generated-posts
AdCreative.ai on Trustpilot: https://www.trustpilot.com/review/adcreative.ai
Canva pricing: https://www.canva.com/pricing/
Canva help, upgrade to Canva Pro or Canva Business: https://www.canva.com/help/upgrade-to-canva-pro-or-business/
Canva help, understanding your AI usage: https://www.canva.com/help/ai-access/
Canva help, resize designs: https://www.canva.com/help/resize/
Canva help, remove backgrounds: https://www.canva.com/help/background-remover/
Canva AI Product Terms: https://www.canva.com/policies/ai-product-terms/
ChatGPT pricing: https://chatgpt.com/pricing
OpenAI Terms of Use: https://openai.com/policies/row-terms-of-use/
OpenAI help, provenance signals in OpenAI-generated content: https://help.openai.com/en/articles/8912793-provenance-signals-in-openai-generated-content
Meta, expanding generative AI transparency for ads: https://about.fb.com/news/2025/02/gen-ai-transparency-metas-ads-products/
Meta Transparency Center, ads about social issues, elections or politics: https://transparency.meta.com/policies/ad-standards/SIEP-advertising/SIEP/
Google Ads, political content policy: https://support.google.com/adspolicy/answer/6014595
Google Ads, generate and edit images with Google AI: https://support.google.com/google-ads/answer/14210318
Google Merchant Center, AI-generated content: https://support.google.com/merchants/answer/14743464
FTC, final rule banning fake reviews and testimonials: https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Microsoft 365 Outage (Nov 2026): What We Know About the Root Cause and What IT Admins Should Learn

epifive — Fri, 13 Nov 2026 16:17:06 +0000

Microsoft has not yet published the root cause of the Microsoft 365 outage that began on 12 November 2026 (EX1550543 for Exchange Online, MO1550821 for multiple Microsoft 365 services). What it has said so far points at servers that became unavailable, an overwhelmed secure-connection process and a recent network configuration change that correlates with the start of impact; the full explanation is promised in a Post-Incident Report (PIR) after mitigation. This guide collects Microsoft's own statements with their timestamps and turns the outage into practical lessons for enterprise IT teams.

Status as of 20:26 IST, 13 November 2026 (14:56 UTC; 9:56 a.m. ET): Microsoft's public status page still lists "Service degradation". Microsoft says it is "observing sustained improvements in service availability" but "some users may still experience intermittent connectivity issues or delayed email delivery", and that it will share the PIR "after mitigation is complete". No PIR has been published. For live status, workarounds and SLA terms, see the main guide: Microsoft 365 outage: Outlook down, status and what to do.

Who this guide is for

IT administrators, IT managers and small-business owners who run on Microsoft 365 and want to be better prepared next time: faster detection, clearer communication, and a plan for working while Outlook and Teams calendars are unavailable. EpiFive is not affiliated with Microsoft. Every statement about the cause below is quoted from Microsoft's Service health posts; nothing is guessed.

What happened

Microsoft dates EX1550543 from 16:17 UTC on 12 November 2026 (11:17 a.m. ET; 9:47 p.m. IST). Users in every region could not reliably reach Exchange Online mailboxes through Outlook on the web, Outlook desktop, mobile mail apps or REST, and features in Teams, Copilot, Purview, Defender, Intune, Planner and other services that depend on Exchange Online failed with it. The broader incident, MO1550821, starts at 18:26 UTC. The main guide has the full update-by-update timeline; the table below keeps only the updates that matter for the cause and the recovery.

UTC	ET	IST	Microsoft's update
16:17, 12 Nov	11:17 a.m., 12 Nov	9:47 p.m., 12 Nov	EX1550543 start time
19:06, 12 Nov	2:06 p.m.	12:36 a.m., 13 Nov	Paused "all deployments and configuration changes"
19:18, 12 Nov	2:18 p.m.	12:48 a.m.	Load caused by "a large number of servers being unexpectedly unavailable"
19:57, 12 Nov	2:57 p.m.	1:27 a.m.	"we haven't identified any recent changes that correlate with the start of impact"
01:06, 13 Nov	8:06 p.m., 12 Nov	6:36 a.m.	Secure-connection process "becomes overwhelmed"; reverting a network configuration change
07:25, 13 Nov	2:25 a.m., 13 Nov	12:55 p.m.	"positive results for server stability" after an "upstream authentication/routing configuration component patch"
09:03, 13 Nov	4:03 a.m.	2:33 p.m.	Email timeout window extended to 48 hours (MO1550821)
14:01, 13 Nov	9:01 a.m.	7:31 p.m.	Email queues "approaching normal levels"; PIR "after mitigation is complete"

Times are from the Service health posts for EX1550543 unless marked MO1550821, as published in the University of Pennsylvania's public mirror of the feed. ET is UTC-5 and IST is UTC+5:30.

Root cause: what Microsoft has said so far

Root cause: pending Microsoft's Post-Incident Report. The statements below are Microsoft's own words, in order. They describe symptoms, actions and correlations; Microsoft has not said which of them, if any, is the root cause.

19:06 UTC, 12 November (EX1550543): "As a precaution, we've paused all deployments and configuration changes while we review recent changes for any correlation to this event."
19:18 UTC, 12 November (EX1550543): "We've determined that the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure."
19:43 UTC, 12 November (EX1550543): "We've identified that affected servers are failing automated health checks, which is causing them to become unavailable, and this may be related to a recent change to a component involved in processing those checks."
19:57 UTC, 12 November (EX1550543): "While we haven't identified any recent changes that correlate with the start of impact, our investigation indicates the failed health checks may originate from a specific component on the affected servers that's responsible for processing them."
01:06 UTC, 13 November (EX1550543): "Our investigation has found that a process on the affected servers responsible for establishing secure connections becomes overwhelmed, causing the servers to stop processing requests." In the same update: "In parallel, we've begun reverting a recent network configuration change that correlates with the start of impact and are monitoring to determine whether this contributes to recovery."
03:34 UTC, 13 November (EX1550543): "we can confirm that there is no indication this is the result of malicious activity."
05:43 UTC, 13 November (EX1550543): "As of now, we are not aware of any malicious activity that is causing this incident." And: "Once mitigated, we will provide full details of the root cause, defense-in-depth repair items, and more within a Post-Incident Report."
07:25 UTC, 13 November (EX1550543): "We're seeing positive results for server stability after applying an upstream authentication/routing configuration component patch to a portion of our infrastructure."
14:01 UTC, 13 November (EX1550543 and MO1550821): "At this time, we have no evidence of malicious activity associated with this incident. We will continue to treat this with urgency until full mitigation, and we will share a full Post-Incident Report with root cause and defense-in-depth actions after mitigation is complete."

Two things are worth noticing. First, Microsoft's view of recent changes moved: at 19:57 UTC it had not found a change that correlated with the start, and by 01:06 UTC it was reverting one that did. Second, "correlates with" is not "caused". The incident record still shows "Root Cause: N/A". This article will be updated with Microsoft's stated cause when the PIR is published.

How to check service status automatically

If the first sign of an outage is a user saying Outlook will not connect, monitoring is too slow. Build three independent signals, and make sure none of them depends on the service that is failing.

Service health notifications, sent somewhere that still works

In the Microsoft 365 admin center go to Health > Service health > Customize > Email, select Send me email notifications about service health, and choose incidents and advisories for the services you care about (Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Entra). You can add up to two email addresses. The lesson from this incident: an alert about Exchange Online that is delivered only to an Exchange Online mailbox may arrive late or not at all. Make one of the two addresses a mailbox that is not hosted in your tenant, such as a monitored mailbox with another provider that forwards to SMS or chat.

Also install the Microsoft 365 Admin mobile app on at least two admins' phones and turn on its push notifications, so the alert does not depend on anyone's Outlook.

Poll the Microsoft Graph service communications API

The Service Communications API returns the same incidents and advisories as Service health. It needs the ServiceHealth.Read.All permission, delegated or application, so you can run it unattended with an app registration and a certificate.

GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviews
GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues
GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues/EX1550543/incidentReport

In Microsoft Graph PowerShell, a minimal check that lists unresolved incidents for the services you track looks like this:

Connect-MgGraph -Scopes "ServiceHealth.Read.All"
$watch = 'Exchange Online', 'Microsoft Teams', 'SharePoint Online', 'Microsoft 365 suite'
Get-MgServiceAnnouncementIssue -All |
  Where-Object { -not $_.IsResolved -and $_.Classification -eq 'incident' -and $_.Service -in $watch } |
  Select-Object Id, Service, Status, Title, StartDateTime, LastModifiedDateTime

Run it every 5 to 10 minutes from a scheduler outside your Microsoft 365 tenant, and send new incident IDs to the on-call channel by SMS or a chat tool. Treat a failed API call as an alert too: during this incident Microsoft listed Graph requests that touch Exchange Online data as affected, so a monitor that only alerts on a successful "incident found" response can stay silent when it matters. The incidentReport call returns the PIR once Microsoft publishes it, which makes it easy to collect for your own review.

Watch the public status page and the official account

status.cloud.microsoft is Microsoft's public status page for when you cannot sign in to the admin center, and @MSFT365Status on X posts short versions of major updates. Microsoft does not document an API for the public page, so treat any automated check of it as best effort; a simple uptime or change monitor that opens the page and notifies you when it changes is enough. User-report sites such as Downdetector can warn you early, but they count reports, not confirmed impact.

An escalation runbook

Write down, before the next outage, who does what:

Trigger: a Service health incident for a core service, or more than a handful of user reports in 15 minutes.
First 15 minutes: confirm in Service health or on status.cloud.microsoft that it is Microsoft's incident, not your network or sign-in; note the incident IDs.
First 30 minutes: send the first staff message (template below) through an out-of-band channel; name an incident owner and a next-update time.
Ongoing: follow the incident IDs, update staff at the times you promised, and log business impact with UTC times for an SLA claim.
After recovery: run message traces for critical senders, check Outboxes, collect the PIR, and hold a short internal review.

What admins should do: a communication plan that works without Microsoft 365

The usual internal channels, email and Teams, are the ones most likely to be degraded in a Microsoft 365 outage. Teams chat and meetings mostly kept working this time, but calendars and invites did not, and nobody can count on that pattern next time.

Pick an out-of-band channel now. Options include an SMS broadcast service, a WhatsApp or Signal group for staff (with the same data rules as any other channel), a phone tree, or a simple public or internal status page hosted outside Microsoft 365. A self-hosted page such as Statuszen works if it runs on infrastructure that does not sign in through your tenant. Keep the subscriber list current and test it twice a year.

Staff template (send in the first 30 minutes, then at each promised time):

Microsoft 365 incident - Outlook and some Teams features affected

Microsoft is working on a service incident (ID: <incident ID>). Outlook may
not connect and Teams calendars or invites may fail. This is a Microsoft-side
problem, not a fault on your device.

Please:
- Do not reset your password, reinstall Office or delete your Outlook profile.
- Keep working from mail and files already on your device.
- Ignore any email asking you to sign in "to restore your mailbox".
- For urgent matters, call or message the person directly.

Next update: <time and time zone>. IT on call: <phone number>.

Customer template (for your website, social channels or an auto-reply that does not depend on Microsoft 365):

Service notice - email delays

A global Microsoft 365 incident is delaying some of our email. Messages sent
to us are normally queued and delivered when the service recovers, so there is
no need to resend yet. For anything urgent, please call <phone number> or use
<chat or form link>. We will post an update at <time and time zone>.

Keep both templates, the subscriber lists and the on-call numbers somewhere that does not sit in OneDrive, SharePoint or a mailbox: a printed copy, a password manager with offline access, or a document in another provider's storage.

What users can do during the next outage: business continuity

Most of the continuity that helped in this incident was set up before it began.

Offline mail. Classic Outlook for Windows keeps a local copy of the mailbox in Cached Exchange Mode, so mail already downloaded stays readable. New Outlook for Windows has its own offline mode: Microsoft says it is on by default and saves email, calendar events and people to the device, configurable under Settings > General > Offline, with 30 days of email saved by default (7, 30, 90 or 180 days). Check which client your users have and what it keeps offline.
Offline files. OneDrive Files On-Demand only opens online-only files when the device is connected. For files people need in an emergency (contracts, price lists, rotas), right-click the folder and select Always keep on this device; Microsoft says those files "are always there for you even when you're offline". Known Folder Move with Intune can make sure Desktop and Documents are in OneDrive in the first place (see OneDrive Known Folder Move with Intune).
An emergency meeting bridge. Keep one meeting option that does not depend on Microsoft 365, such as a dial-in conference number from another provider, and share it in advance. Also keep standing Teams meeting links for key meetings in a document outside the mailbox, because calendar invites failed in this incident while joining meetings mostly worked.
Contacts and phone numbers outside Microsoft 365. Key staff, customers, suppliers, your Microsoft partner and your internet provider, kept in a printed list or an offline copy, not only in Outlook contacts.
Break-glass admin accounts, used for the right problem. Microsoft recommends two or more cloud-only emergency access accounts on the *.onmicrosoft.com domain, protected with a phishing-resistant method such as a passkey (FIDO2), excluded from Conditional Access policies that block sign-in, monitored for every sign-in and validated at least every 90 days (see break-glass accounts in Entra ID). They solve lockouts from your own tenant, such as a federation or MFA failure. In a Microsoft-side outage like this one the issue is not your tenant: disabling Conditional Access, resetting passwords or changing mail flow will not bring the service back and can create a second incident.

Change management lessons from "a configuration change correlated with impact"

Microsoft has not confirmed that a configuration change caused this outage. Its 01:06 UTC update says only that it began reverting one that "correlates with the start of impact". But the shape of the incident, with servers failing health checks and load cascading onto the rest, is a reminder that your own changes deserve the same discipline.

Stage every change. Apply Conditional Access policies in report-only mode first (see Conditional Access report-only mode), run mail flow rules in Test without Policy Tips before Enforce (see Exchange Online mail flow rules), and use device update rings and pilot groups in Intune.
Use an early release group. Put IT staff and a few volunteers on an earlier release channel so they meet Microsoft's feature changes before everyone else. Targeted release is being replaced, so plan the move described in Targeted release retirement: Standard, Deferred or Frontier.
Write the rollback before the change. For every change: the exact command or setting to undo it, who can approve the rollback, and what signal triggers it.
Freeze during incidents. Microsoft paused "all deployments and configuration changes" within three hours of the start. Do the same in your tenant while a major incident is open, so you do not mix your change with Microsoft's.
Keep a change log with UTC times. When a vendor says a change "correlates with the start of impact", the first question in your own review will be what changed in your environment at the same time.

SLA credits

The SLA terms, credit tiers and claim deadline are in the main guide's SLA credits section; they are not repeated here. What to do now is document impact while it is fresh: which users and sites were affected, from and to what time in UTC, which connection methods failed, the exact error messages, the incident IDs (EX1550543, MO1550821) and screenshots of Service health. For a November incident on a monthly subscription, the claim must reach Microsoft by 31 December 2026. If you buy through a Microsoft partner (CSP), ask the partner how they file the claim.

Post-incident review

As of 20:26 IST, 13 November 2026, Microsoft has not published a post-incident review for EX1550543 or MO1550821; both are still open. Microsoft's service description says that for incidents with "broad and noticeable impact across a large number of organizations", a preliminary PIR is delivered through Service health "within 48 hours of incident resolution, followed by a final PIR within five business days". When it is out, the incident status changes to Post-incident report published, and you can download it from the incident in Service health or with the incidentReport Graph call above.

How to read it. A Microsoft PIR covers user impact, start and end times, a detailed timeline and the root cause analysis, plus the repair items Microsoft calls defense-in-depth. Read it in this order:

Start and end times. Compare them with your own impact log; they drive any SLA claim.
Root cause. Note whether it was a change, a capacity issue, a dependency or a combination, and whether it confirms or contradicts the statements above.
Detection. How long between the start time and Microsoft's first post, and between that post and your first internal alert?
Repair items. What Microsoft will change, and by when.

What to review in your own environment afterward. Did your alerts fire, and through which channel? How long did staff wait for the first message? Which continuity items worked (offline mail, offline files, the meeting bridge) and which did not? Were any of your own changes made during the incident? Update the runbook, templates and checklist below with the answers.

Checklist

[ ] Service health email notifications on, with one address outside your Microsoft 365 tenant.
[ ] Microsoft 365 Admin app with push notifications on two admins' phones.
[ ] Graph service health monitor (ServiceHealth.Read.All) running outside the tenant, alerting by SMS or chat, and alerting on API failure.
[ ] status.cloud.microsoft and @MSFT365Status bookmarked in the runbook.
[ ] Escalation runbook with an incident owner, first-message deadline and update rhythm.
[ ] Out-of-band staff channel (SMS, WhatsApp or a status page) tested this quarter.
[ ] Staff and customer message templates stored outside Microsoft 365.
[ ] Offline mail checked for both classic and new Outlook users.
[ ] Critical folders set to Always keep on this device.
[ ] Emergency meeting bridge and contact list kept outside Microsoft 365.
[ ] Two break-glass accounts, excluded from blocking Conditional Access, sign-in tested within the last 90 days.
[ ] Change freeze rule for major incidents; rollback plan required for every change.
[ ] Impact log template (UTC times, users, errors, incident IDs) ready for SLA claims.
[ ] Calendar reminder to download the PIR for EX1550543 and MO1550821 and hold an internal review.

What we checked

Opened Microsoft's public status page data (status.cloud.microsoft) at 20:30 IST on 13 November 2026: the Microsoft 365 post was last updated 14:56 UTC (20:26 IST), status "Service degradation", with the "sustained improvements" wording and the PIR promise quoted above.
Read the full update history of EX1550543 and MO1550821 in the University of Pennsylvania's public mirror of Microsoft's Service health feed, generated 09:50 a.m. ET (14:50 UTC) on 13 November; every quote and time in the root-cause section comes from it. Both incidents show "Root Cause: N/A" and "End Time: Not ended yet".
Converted each UTC time to ET (UTC-5) and IST (UTC+5:30) and checked them against the timeline in the main guide.
Checked reputable reporting from 13 November for any published root cause or PIR; none was reported.
Read Microsoft Learn for the Graph serviceAnnouncement list-issues API (permission ServiceHealth.Read.All, delegated or application), emergency access accounts (two or more cloud-only accounts, FIDO2 or certificate-based authentication, validate at least every 90 days), and the post-incident review timing; and Microsoft Support for new Outlook offline settings and OneDrive Always keep on this device.
Not verified: the root cause, which Microsoft has not published, and how the monitoring script behaves during a live outage. The PowerShell check uses documented cmdlets and properties but was not run against an affected tenant.

Last tested: 2026-11-13

Sources

Microsoft 365 Service health, EX1550543 and MO1550821, as mirrored by the University of Pennsylvania: https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html
Microsoft 365 status page: https://status.cloud.microsoft
Microsoft 365 Status on X: https://x.com/MSFT365Status
Microsoft Learn, How to check Microsoft 365 service health: https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health
Microsoft Learn, Service health and continuity (post-incident reviews): https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/service-health-and-continuity
Microsoft Learn, Service communications API in Microsoft Graph: https://learn.microsoft.com/en-us/graph/api/resources/service-communications-api-overview
Microsoft Learn, List issues (serviceAnnouncement): https://learn.microsoft.com/en-us/graph/api/serviceannouncement-list-issues
Microsoft Learn, Get incident report: https://learn.microsoft.com/en-us/graph/api/servicehealthissue-incidentreport
Microsoft Learn, Manage emergency access admin accounts: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access
Microsoft Support, Offline in the new Outlook for Windows: https://support.microsoft.com/en-us/office/work-offline-in-outlook-for-windows-f3a1251c-6dd5-4208-aef9-7c8c9522d633
Microsoft Support, Turn on Cached Exchange Mode: https://support.microsoft.com/en-us/office/turn-on-cached-exchange-mode-7885af08-9a60-4ec3-850a-e221c1ed0c1c
Microsoft Support, Save disk space with OneDrive Files On-Demand for Windows: https://support.microsoft.com/en-us/office/save-disk-space-with-onedrive-files-on-demand-for-windows-0e6860d3-d9f3-4971-b321-7092438fb38e
Microsoft, Service Level Agreement for Microsoft Online Services: https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services
Euronews, Microsoft outage explained: https://www.euronews.com/2026/11/13/microsoft-outage-explained-what-went-wrong-and-is-your-data-at-risk
SecurityWeek, Microsoft 365 outage disrupts Outlook, Exchange Online and Teams: https://www.securityweek.com/microsoft-365-outage-disrupts-outlook-exchange-online-and-teams/
BleepingComputer, Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide: https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Microsoft 365 Outage (Nov 12-13, 2026): Outlook Down, Status and What to Do

epifive — Fri, 13 Nov 2026 15:17:41 +0000

Updated 2026-11-13, 11:50 IST: Microsoft's 06:17 UTC update still lists the incident as "Service degradation". It is now evaluating traffic throttling, protocol adjustments and failover routing, says it is "not aware of any malicious activity", and promises a Post-Incident Report "once mitigated". Status, timeline and the PIR section are updated below.

Updated 2026-11-13: Rewritten with Microsoft's full Service health timeline for EX1550543 and MO1550821 (the Exchange incident started at 11:17 a.m. ET, earlier than first reported), the latest status, the cause as Microsoft has described it so far, user workarounds, and the SLA credit terms from Microsoft's November 2026 SLA.

A major Microsoft 365 outage that began on 12 November 2026 is stopping people from opening Outlook mailboxes and is breaking email-dependent features in Teams, Copilot, Defender, Purview, Planner, To Do, Intune and other services, in every region. Microsoft tracks it as EX1550543 (Exchange Online) and MO1550821 (multiple Microsoft 365 services). Status as of 11:47 IST, 13 November 2026 (06:17 UTC; 1:17 a.m. ET): still "Service degradation"; Microsoft is evaluating traffic controls "to increase capacity and stability", recovery is partial and not sustained, and no root cause or post-incident review has been published yet. If Outlook or Teams is failing for you, it is very likely this incident, not your PC.

Who this guide is for

This guide is for IT admins and small-business owners who run on Microsoft 365, and for anyone asking "is Outlook down?" today. It covers what Microsoft has said, with its own timestamps, how to confirm the problem is on Microsoft's side, what users can still do, what admins should do now and after recovery, and how the SLA credit process works. EpiFive is not affiliated with Microsoft; every quote below comes from Microsoft's service health posts or from named news reports.

What happened

Microsoft's service health record for EX1550543 gives the start time as 16:17 UTC on 12 November 2026. That is 11:17 a.m. ET and 9:47 p.m. IST. The broader incident, MO1550821, starts at 18:26 UTC. Microsoft's first admin note said: "We're investigating a potential issue and checking for impact to your organization."

The timeline below uses the times of Microsoft's admin-center posts, as published in a public mirror of the Service health feed that the University of Pennsylvania maintains for its own tenant. Posts on the @MSFT365Status account on X can differ by a few minutes. ET is Eastern Standard Time (UTC-5); IST is UTC+5:30.

ET (12-13 Nov)	IST	What Microsoft said or did
11:17 a.m., 12 Nov	9:47 p.m., 12 Nov	EX1550543 start time: "Users may be unable to connect to their mailboxes in Exchange Online through multiple connection methods"
12:45 p.m.	11:15 p.m.	Connectivity errors on "a portion of Exchange Online infrastructure which receives and processes users' access requests"
shortly before 1 p.m.	about 11:25 p.m.	First public post on @MSFT365Status: "investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas"
about 1:00-1:30 p.m.	about 11:30 p.m.-midnight	Downdetector user reports for Outlook peak (see the note below the table)
1:26 p.m.	11:56 p.m.	MO1550821 opens: "Users may be unable to connect to multiple Microsoft 365 services"
2:06 p.m.	12:36 a.m., 13 Nov	"we've paused all deployments and configuration changes while we review recent changes for any correlation to this event"
2:18 p.m.	12:48 a.m.	"the elevated load isn't driven by an overall increase in traffic, but by a large number of servers being unexpectedly unavailable, which is shifting load onto the remaining infrastructure"
2:57 p.m.	1:27 a.m.	"we haven't identified any recent changes that correlate with the start of impact"; failed health checks may come from "a specific component" on the servers
3:56 p.m.	2:26 a.m.	An "alternative health check method" returned some servers to service; "a small number of configuration updates" under investigation
5:00 p.m.	3:30 a.m.	"our actions taken thus far have not provided the anticipated relief"
5:57 p.m.	4:27 a.m.	Some servers back and stable; "limited recovery in some regions"
6:59 p.m.	5:29 a.m.	Restored servers "can become unresponsive again once they begin receiving traffic"
8:06 p.m.	6:36 a.m.	"a process on the affected servers responsible for establishing secure connections becomes overwhelmed"; Microsoft "begun reverting a recent network configuration change that correlates with the start of impact"
9:54 p.m.	8:24 a.m.	A change applied to improve serviceability "is not taking as expected"
10:34 p.m.	9:04 a.m.	"there is no indication this is the result of malicious activity"
11:10 p.m.	9:40 a.m.	"partial recovery across regions", but "these actions aren't resulting in sustained recovery"
11:57 p.m.	10:27 a.m.	A "surge in outbound call volume" from routing services; scaling up virtual machines; next update due 06:00 UTC (11:30 a.m. IST)
12:46 a.m., 13 Nov	11:16 a.m.	"we are not aware of any malicious activity that is causing this incident"; a Post-Incident Report will follow "once mitigated"
1:17 a.m.	11:47 a.m.	Evaluating "traffic throttling, protocol adjustments, and failover routing"; next update due 07:00 UTC (12:30 p.m. IST)

Downdetector numbers are user reports, not Microsoft data. The Tribune (ANI, citing Reuters) reported a peak of 138,058 Outlook reports around 1 p.m. ET; BleepingComputer reported more than 129,500 around 1:28 p.m. ET. The figures differ because they are snapshots taken at different moments.

Which services Microsoft lists as affected

MO1550821 says features "that interact with Exchange Online and email services are impacted", while parts that do not depend on Exchange "remain functional". Its latest list includes:

Exchange Online / Outlook: mailbox access through Outlook on the web, Outlook desktop (MAPI), Exchange ActiveSync and REST; "email delivery may be delayed".
Microsoft Teams: joining calls, meetings, group chats and channel messages are "not impacted", but calendar, scheduling, invites, live or virtual event creation and some Copilot features fail.
SharePoint Online: features that depend on Exchange; "Accessing files stored directly in SharePoint Online remains functional".
Copilot, Defender for Office 365 and Defender XDR, Purview, Planner, To Do, Intune, Power BI and Fabric, Graph, Universal Print, Windows 365 (Customer Key), Microsoft 365 Education and both admin centers.

A separate, earlier Teams incident, TM1550488, ran from 9:45 to 10:53 a.m. ET (8:15 to 9:23 p.m. IST) on 12 November, according to BleepingComputer. Microsoft has not said whether the two are related.

What Microsoft has said about the cause, and what it hasn't

Microsoft's explanation has changed during the incident, so read it as work in progress. At 2:57 p.m. ET it said it had not found a recent change that correlated with the start. At 8:06 p.m. ET it said it was reverting "a recent network configuration change that correlates with the start of impact" to see whether that helps. The incident record still shows "Root Cause: N/A". On the security question, ABC News Australia reported that Home Affairs Minister Tony Burke said Microsoft told him a cyberattack was not believed to be the cause, and that Australia's cyber agreement with Microsoft "has in fact been activated today to make sure that we get appropriate prioritisation of Australian interests". This guide does not speculate beyond that. Every cause-related statement Microsoft has made so far, with its timestamp, and the lessons for IT teams are collected in Microsoft 365 outage: what we know about the root cause and what IT admins should learn.

How to check status

Check in this order. The first two are Microsoft's own channels and show the incident IDs.

Microsoft 365 admin center > Health > Service health. Sign in at admin.microsoft.com with an admin account (Microsoft's documentation says Service Support admin and Helpdesk admin roles can view it). Under Active issues Microsoft is working on, open EX1550543 and MO1550821; each has a feed of every update and the next update time.
status.cloud.microsoft. Microsoft's public status page, meant for when you can't sign in to the admin center. During this incident it carried the same "Users may be unable to connect to multiple Microsoft 365 services" post.
@MSFT365Status on X. Microsoft's Learn page points to it "to see information on certain events". It posts shorter versions of the admin-center updates.
Microsoft 365 Admin mobile app. Shows Service health on your phone, with push notifications, which helps if your laptop's Outlook is the thing that's broken.
Downdetector. Useful for a quick "is it just me?", but it only counts user reports. It cannot tell you which tenants are affected, and it often shows spikes for services that merely depend on the one that is down.

If Service health shows no incident and only your organization is affected, the cause is more likely local: sign-in, network or a client problem. Microsoft's page has a Report an issue button for that case.

What users can do now

Try another way in, but don't keep switching. Microsoft lists Outlook on the web, desktop Outlook and mobile mail apps (Exchange ActiveSync) as affected, so no app is guaranteed to work. Because impact varies by server, try outlook.office.com in a browser, then your phone, once each, and then wait.
Read what's already on your PC. Classic Outlook for Windows uses Cached Exchange Mode by default for Microsoft 365, which keeps a copy of your mailbox on your computer. Old mail, contacts and calendar items stay readable even when Outlook can't connect. Microsoft notes that Cached Exchange Mode "is not available in new Outlook for Windows".
Compose and queue. In classic Outlook you can write replies now; they wait in the Outbox and send when the connection comes back. Check the Outbox after recovery (see Outlook email stuck in Outbox).
Use Teams for chat and calls. Microsoft says core Teams chat, channel messages and joining meetings were not affected; calendars, invites and scheduling were. Join meetings from the link in the chat or invite you already have, and try both the Teams desktop app and teams.microsoft.com if one fails.
Don't reset your password, reinstall Office or delete your Outlook profile. None of that fixes a server-side outage, and deleting a profile throws away the local cached copy that is letting you read mail.
Use another channel for urgent mail. Phone, SMS or a personal account for one-off urgent messages, and only for non-confidential content your company allows.
Beware of "Microsoft outage" phishing. Big outages are a common lure: "re-verify your mailbox", "claim outage compensation", "your messages are on hold". Microsoft's updates for this incident list no action for users to take, so treat any email that asks you to sign in through a link "to restore" your mailbox as phishing and report it to IT. During this outage Microsoft also said Safe Links may fail to open wrapped links, so be extra careful with links from unknown senders. See how attackers steal Microsoft 365 sessions.

What admins should do

1. Tell your users, once, with a clear message

Send it through a channel that works (Teams chat, SMS, intranet or a phone tree), not only by email.

Subject: Microsoft 365 outage - Outlook and some Teams features affected

Microsoft is working on a global Microsoft 365 incident (EX1550543 and
MO1550821). Outlook may not connect, and Teams calendars and invites may fail.
Teams chat and joining meetings from existing links mostly work.

Please:
- Do not reset your password, reinstall Office or delete your Outlook profile.
- Classic Outlook still shows mail already on your PC.
- Ignore any email asking you to sign in "to restore your mailbox".
- For urgent matters, call or message the person directly.

We'll update you at <time> or when Microsoft reports recovery.
IT contact: <phone / chat>

2. Follow the incident and turn on notifications

Open EX1550543 and MO1550821 in Service health. To get every update by email, go to Health > Service health > Customize > Email, select Send me email notifications about service health, then choose incidents, advisories and services (up to two addresses per admin). For one incident only, open it and choose Manage notifications for this issue.

For monitoring tools, the Service Communications API in Microsoft Graph returns the same data with the ServiceHealth.Read.All permission (delegated or application):

GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues/EX1550543
GET https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/issues/EX1550543/incidentReport

The second request returns the post-incident review once Microsoft publishes one. In Microsoft Graph PowerShell, the documented cmdlet for the first call is Get-MgServiceAnnouncementIssue -ServiceHealthIssueId EX1550543.

3. Check that mail is delayed, not lost

Microsoft says "email delivery may be delayed". When a receiving system is unavailable, the sending server normally keeps the message and retries: RFC 5321, the SMTP standard, says retries should usually be at least 30 minutes apart and that "the give-up time generally needs to be at least 4-5 days". After recovery, run a message trace for important senders before asking anyone to resend (see message trace in Exchange Online). Microsoft lists message trace and reporting delays in this incident too, so give it time. Watch for non-delivery reports from senders whose servers gave up early. For mail that Microsoft 365 sends to your own servers or partners through a connector, Microsoft documents a different rule: undeliverable messages are queued and retried for 24 hours, then returned to the sender as an NDR (see Exchange Online connectors).

4. Document the business impact now

Write it down while it is happening: which users or sites were affected, from what time to what time (in UTC), which methods failed (OWA, Outlook desktop, mobile, Teams calendar), the exact error messages, and screenshots of Service health. You'll need this for an SLA claim and for your own incident review.

SLA credits

Microsoft's Service Level Agreement for Microsoft Online Services (November 2026 edition, downloaded from Microsoft's licensing site on 13 November 2026) sets these terms.

Exchange Online. Downtime is "any period of time when users are unable to send or receive email with Outlook Web Access". Uptime is measured per month in user-minutes: (User Minutes - Downtime) / User Minutes x 100.

Monthly uptime	Service credit
below 99.9%	25%
below 99%	50%
below 95%	100%

Microsoft Teams uses the same tiers, but its downtime is when users "are unable to conduct instant messaging conversations or initiate online meetings". Microsoft said those core Teams functions were largely not affected here, so a Teams claim may not qualify.

What the numbers mean (our arithmetic from the formula, not a Microsoft estimate). November has 30 days, or 43,200 minutes per user. If every user in a tenant could not use Outlook on the web for 8 hours (480 minutes), uptime is (43,200 - 480) / 43,200 = 98.89%, in the 50% tier. If only a fifth of users were affected for those 8 hours, uptime is 99.78%, in the 25% tier. Microsoft decides the real figure.

How to claim, per the SLA's General Terms:

Submit the claim to Microsoft customer support with: a detailed description of the incident, the time and duration of downtime, affected resource names, the number and locations of affected users, and a description of the errors. Microsoft says missing information "will result in claims being rejected".
Deadline: for services other than Azure, Microsoft must receive the claim "by the end of the Applicable Period following the month in which the Incident occurred". For a monthly subscription and a November incident, that is 31 December 2026.
Microsoft says it typically processes claims within 45 days and applies any credit to fees for that service. Credits are the "sole and exclusive remedy" and never cover lost revenue or other losses.

Two more lines matter. "Microsoft outage communications ... are not a confirmation of missed Service Levels or Service Credits eligibility." And services bought through Open, Open Value and Open Value Subscription agreements get credits as extra service time, not money. If you buy through a Microsoft partner (CSP), ask the partner how they file claims for you.

Post-incident review

Microsoft's service description says that for incidents with "broad and noticeable impact across a large number of organizations", a preliminary post-incident review (PIR) is delivered through Service health "within 48 hours of incident resolution, followed by a final PIR within five business days". A PIR covers user impact, start and end times, a detailed timeline and the root cause analysis. When it is out, the incident's status changes to Post-incident report published. Download it from the incident in Service health (or through the incidentReport call above) and attach it to your claim and your internal review. For this incident, Microsoft wrote at 05:46 UTC on 13 November: "Once mitigated, we will provide full details of the root cause, defense-in-depth repair items, and more within a Post-Incident Report." As of 11:47 IST on 13 November, the incident was not resolved, so no PIR exists yet.

Business continuity lessons

The full lessons, with monitoring scripts, message templates and a checklist, are in the follow-up guide: what IT admins should learn from this outage.

Keep offline access. Classic Outlook in Cached Exchange Mode and locally synced files kept people working with what they already had. If your fleet is moving to the new Outlook, check what offline access it gives your users before the next outage.
Have a backup channel that doesn't run on Microsoft 365. A phone tree, SMS group or second chat tool, with contact numbers stored outside the mailbox.
Monitor status automatically. Service health email alerts, the Admin app on two admins' phones, and a script or tool that polls the Graph service health API.
Keep an outage runbook. Who declares an incident, the user message template above, how to confirm it's Microsoft, and where to log impact for SLA claims.
Know your plan's SLA. Note which services you bought separately; the SLA allows a separate claim per service bought outside a suite.

What we checked

Read the full update history of EX1550543 and MO1550821 in the University of Pennsylvania's public mirror of Microsoft's Service health feed, generated 23:50 ET on 12 November (04:50 UTC, 13 November); all times and quotes in the timeline come from it, converted to ET (UTC-5) and IST (UTC+5:30).
Opened Microsoft's public status page data (status.cloud.microsoft) at 05:01 UTC on 13 November: the post was last updated 04:57 UTC, status "Service degradation", next update by 06:00 UTC. Re-checked after publishing: the 05:46 and 06:17 UTC updates (11:16 and 11:47 IST) kept the status at "Service degradation"; the 06:17 UTC update is the "as of 11:47 IST" status above.
Downloaded the November 2026 edition of the Service Level Agreement for Microsoft Online Services and read the General Terms (claims, deadline, 45-day processing, credit limits) and the Exchange Online and Teams sections; the 25/50/100% tiers appear in both sections.
Redid the uptime arithmetic: 30 x 24 x 60 = 43,200 minutes; (43,200 - 480) / 43,200 = 98.89%; (43,200 - 96) / 43,200 = 99.78%.
Checked Microsoft Learn for the Service health path, email notification labels, the Admin app, the PIR timing (48 hours / five business days) and the Graph serviceAnnouncement endpoints; checked RFC 5321 section 4.5.4.1 for the retry wording and Microsoft Support for Cached Exchange Mode.
Compared the Downdetector figures in The Tribune (138,058) and BleepingComputer (more than 129,500); they are user-report snapshots at different times, so both are given.
Not verified: the cause, which Microsoft has not published, and whether a specific tenant meets the SLA threshold. Not tested on an affected tenant.

Last tested: 2026-11-13

Sources

Microsoft 365 Service health, EX1550543 and MO1550821, as mirrored by the University of Pennsylvania: https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html
Microsoft 365 status page: https://status.cloud.microsoft
Microsoft 365 Status on X, first post ("in the Americas"): https://x.com/MSFT365Status/status/2120938282204688468
Microsoft 365 Status on X, "affect Microsoft 365 service connectivity for users in any region": https://x.com/MSFT365Status/status/2120941584220827979
Microsoft 365 Status on X, "a number of servers being unexpectedly unavailable": https://x.com/MSFT365Status/status/2120962673911181437
Microsoft, Service Level Agreement for Microsoft Online Services (November 2026): https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services
Microsoft Learn, How to check Microsoft 365 service health: https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health
Microsoft Learn, Service health and continuity (post-incident reviews): https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/service-health-and-continuity
Microsoft Learn, Service communications API in Microsoft Graph: https://learn.microsoft.com/en-us/graph/api/resources/service-communications-api-overview
Microsoft Learn, Mail flow intelligence (24-hour connector retry): https://learn.microsoft.com/en-us/defender-office-365/connectors-mail-flow-intelligence
Microsoft Learn, Get incident report: https://learn.microsoft.com/en-us/graph/api/servicehealthissue-incidentreport
Microsoft Support, Turn on Cached Exchange Mode: https://support.microsoft.com/en-us/office/turn-on-cached-exchange-mode-7885af08-9a60-4ec3-850a-e221c1ed0c1c
RFC 5321, Simple Mail Transfer Protocol, section 4.5.4.1: https://www.rfc-editor.org/rfc/rfc5321
ABC News (Australia), Microsoft outage: https://www.abc.net.au/news/2026-11-13/microsoft-outlook-outage/107380958
BleepingComputer, Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide: https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/
The Tribune (ANI), Microsoft 365 outage hits Outlook, Teams, AI services: https://www.tribuneindia.com/news/india/microsoft-outage-disrupts-outlook-teams-ai-services-for-over-five-hours/
Cyber Security News, Massive Microsoft 365 outage: https://cybersecuritynews.com/massive-microsoft-365-outage/
ABC News (US), Microsoft Outlook outage stretches on for hours: https://abcnews.com/US/outlook-down-microsoft-outage-reported-mail/story?id=138088203

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Copilot Studio Leaves the Teams App in 2027: What to Do Before February

epifive — Fri, 13 Nov 2026 05:14:40 +0000

Microsoft is retiring the Copilot Studio app inside Microsoft Teams. According to Message Center post MC1511056 (published October 16, 2026), you can no longer create agents in the app, editing existing agents there ends in January 2027, and the app is removed from Teams in February 2027. To prepare, move agent building to the Copilot Studio web app and, if your agents live in Dataverse for Teams environments, upgrade the environments you want to keep.

Who this is for and what you will have at the end

This guide is for Microsoft 365 and Power Platform admins, and for the people in a small company who built an agent from the Copilot Studio app in Teams and now own it. By the end you will know exactly what is changing and when, which of your agents and environments are affected, and have a short plan: a list of agents, an owner for each, an upgrade decision per environment, and updated instructions for your helpdesk.

Two different things are easy to confuse, so keep them apart from the start:

The Copilot Studio app in Teams is the place where makers built and edited agents. This is what is being retired.
An agent published to the Teams channel is a finished agent that colleagues chat with in Teams or Microsoft Copilot. The Message Center post says agents published to the Microsoft Teams channel are not part of this retirement.

The timeline

Two Message Center posts cover the sequence. The first, MC1315217, announced that classic agent creation moves from Teams to the web experience. The second, MC1511056, finishes the job.

Date	What happens	Source
Early April 2026	Classic agent creation becomes available in the Copilot Studio web app	MC1315217
June 30, 2026	Creating classic agents in the Teams app ends; people are redirected to the web app	MC1315217
Already in effect	"Agent creation in the Teams app is already no longer supported"	MC1511056
January 2027	Editing existing agents in the Teams app ends	MC1511056
Early January to early February 2027	Rollout window	MC1511056
February 2027	The Copilot Studio app is removed from Teams	MC1511056
November 15, 2026	You can no longer create new Dataverse for Teams environments	Power Platform admin docs
October 30, 2027	Dataverse for Teams environments that are not upgraded are decommissioned	Power Platform admin docs

As of 2026-11-13, February 1, 2027 is 80 days away, the date after which new Dataverse for Teams environments cannot be created is two days away, and the final decommission date is 351 days away. Plan around the first two now; the last is the hard stop for data.

Microsoft's guidance in the post is that classic-style chatbot agents are managed only in the web app, where users can still create, edit, publish and manage them. The post lists Copilot Studio, Microsoft Teams and Microsoft 365 Copilot as affected platforms and identifies no compliance considerations.

Prerequisites

Before you start you need:

Access to the Microsoft 365 admin center to read the Message Center posts for your own tenant. Dates in third-party summaries are secondary; your tenant's post is the reference.
Power Platform admin (or Global admin) rights to see environments in the Power Platform admin center and to upgrade one.
For each maker: a way to use the web app. Microsoft's upgrade article says that to access the Copilot Studio web app, users need a standalone subscription or an individual trial license for Microsoft Copilot Studio.
If you plan to upgrade an environment: tenant Dataverse capacity at least as large as the environment being upgraded.

Step 1: Find the agents built in the Teams app

Agents created in the Teams app are stored in a Dataverse for Teams environment, one per team. Microsoft's upgrade article describes it this way: when a user creates a bot in the Copilot Studio for Teams app, a Dataverse for Teams environment gets created for the team the user selected.

To list those environments:

Sign in to the Power Platform admin center at https://admin.powerplatform.microsoft.com.
In the navigation pane, select Manage, then Environments.
Look at the Type column. Environments marked Microsoft Teams are Dataverse for Teams environments.
The environment name is the same as the team name, so you can recognize which team each one belongs to.

Write down each environment, the team owner and the agents inside it. Ask the owners which agents are still used. Microsoft's CoE Starter Kit governance article notes that bots created with Copilot Studio in Teams environments are not discoverable in the CoE Starter Kit, so you will probably need to ask people or open the environments to see what is there.

Note that the same Learn page lists automatic deletion rules for unused environments. If an environment holds nothing but an unused agent, deciding not to upgrade it is a valid outcome.

Step 2: Decide what to do with each environment

Microsoft says Dataverse for Teams environments are deprecated and that upgrading to Dataverse is the supported way to keep the apps, flows, agents and data in them. The Learn page says to upgrade each environment you want to keep before October 30, 2027, and that Microsoft decommissions environments that are not upgraded on that date.

Use this simple decision table:

Situation	Suggested action
Agent is in daily use	Upgrade the environment, then manage the agent in the web app
Agent is a pilot nobody uses	Do not upgrade; export or note the topics you want, then let it go
Environment also holds Power Apps or flows that matter	Upgrade; the same upgrade keeps those apps and flows
Team was deleted	The environment is deleted with the team unless it was upgraded

The last row comes from the lifecycle table: the environment lifetime is tied to its team, and it is deleted automatically if the team is deleted. After an upgrade, Microsoft says the environment's lifecycle is no longer tied to the team.

Step 3: Upgrade the environments you want to keep

Microsoft documents the upgrade as a tenant admin task done from the Power Platform admin center environments view. In the environment's settings page the action is labeled Upgrade to production.

Before you begin, check capacity. The Learn page states that the tenant must have at least as much available capacity as the size of the Dataverse for Teams environment being upgraded, and that if capacity is short the upgrade is blocked and an error message is displayed. Each Dataverse for Teams environment has up to 2 GB of combined database and file storage, so a tenant with several environments should check available Dataverse capacity first. You can view Teams environment consumption under Licensing, Capacity add-ons, then the Microsoft Teams tab on the Capacity page.

Then:

Warn the agent's users. Microsoft says that during the upgrade people cannot edit or create bots in the environment, and chatting with a bot might have issues, so notify users of expected downtime.
In the Power Platform admin center, open Manage, then Environments, and select the environment whose Type is Microsoft Teams.
Select the upgrade action and read the message about the implications. Microsoft says admins are asked to confirm the action.
Confirm. Notifications appear as the operation moves through its states.

What changes after the upgrade

The Learn pages list these effects:

Bots continue to work as before without you taking action, and upgraded bots are marked with a diamond icon next to the name in the left pane of the Teams app.
Makers edit apps and flows in the Power Apps portal; for agents they can use the web app at https://copilotstudio.microsoft.com.
The upgraded environment's capacity starts counting against the tenant's Dataverse capacity.
The Microsoft 365 group association becomes editable.
Apps running in the environment require Power Apps or Power Automate licenses.
Microsoft also warns that after an upgrade, qualified Copilot Studio sessions are considered billed even if they do not use premium features such as premium connectors or non-Teams channels.

That last point matters for small businesses: an upgraded environment can start generating billable sessions. Read the licensing guide before upgrading an environment with a busy agent.

One more limitation appears in the upgrade article: to share an agent with other authors after an upgrade, you must add them as team owners in the team where the environment was created. Microsoft says you cannot do that if the Teams Owner security group was removed from the environment in the Power Platform admin center. The page frames this as a bug that is expected to be resolved.

A note on conflicting guidance: the upgrade article says users can continue to edit upgraded bots in the Teams app. MC1511056, which is newer, says editing in the Teams app ends in January 2027. Treat the Message Center post as current and plan to edit in the web app.

Step 4: Move makers to the web app

For each maker:

Open https://copilotstudio.microsoft.com and sign in with the work account.
Confirm the agent appears in the list. If it does not, check that the maker has a license that lets them use the web app (standalone subscription or trial, per Microsoft's upgrade article) and that the correct environment is selected in the environment picker.
Open the agent, make a small edit such as a topic description, and save it.
Publish the agent and test it in Teams.

If the agent is not visible in the web app environment list, the environment is probably still a Dataverse for Teams environment that has not been upgraded. Check Type in the admin center and follow Step 3.

For the licensing side, MC1315217 says that if needed you can adjust access through license assignments for the Power Virtual Agents for Office 365 entitlement and lists E1, E3, E5 and F1 among the affected licenses. Check the post in your own Message Center before you change any license assignment.

Step 5: Re-test the published agent in Teams

Because the retirement concerns the app that manages agents, your published agents should keep working. Still, run a short test after you move an agent, because publishing from a different place can expose problems. Microsoft's publishing article documents these steps:

In Copilot Studio, open the agent and select Channels on the top menu bar.
Select the Microsoft 365 and Microsoft Teams tile to open the configuration panel.
Confirm Make agent available in Microsoft Copilot is set the way you want it, and select Add channel if the channel is not yet added.
Select See agent in Teams, then Add to install it for yourself.
Chat with it and confirm it answers.

If users see "Sorry, something unexpected happened. We're looking into it. Error code: SystemError" after you republish, Microsoft documents a workaround: in the Teams admin center turn the agent app off, wait a few seconds and turn it back on; in Copilot Studio turn the Teams channel off, save, and turn it back on; then republish. If it persists, Microsoft asks for the Conversation ID, Agent ID and the time of the error.

Admin approval and installation links

If your agent was approved by an admin and appears under Built for your org in the Teams app store, the approval is managed in the Teams admin center. Microsoft says only an admin can remove the agent from that section, and that you must submit a new approval request if you change the icon or descriptions. The installation link does not work in the Teams mobile app, so use the app store listing for mobile users.

Step 6: Update your internal guidance

The Message Center post recommends four admin actions. Turn them into a checklist:

Tell affected users to manage agents in the Copilot Studio web app.
Update documentation, training and support guidance that mention the Teams app.
Check bookmarks, user communications and helpdesk scripts that send users to Teams for agent management.
Point users to the web app for supported experiences.

Also consider the creation controls in Teams. The Power Platform article explains that the ability to create apps or agents with Copilot Studio in Teams is controlled in the Teams admin center under Microsoft Apps by using app permission policies. After the retirement that control is less important for agents, but it still matters for Power Apps sample apps that can create Dataverse for Teams environments. Microsoft notes that the Inspection, Employee Ideas and Issue Reporting apps can create such an environment, and that this stops being possible for new environments from November 15, 2026.

Verification

After the change window, check the following:

Check	Expected result
Admin center environment list	No environment you want to keep still shows Microsoft Teams in the Type column
Web app	Each business-critical agent opens and can be edited and published
Teams	Each agent still answers a test question in a 1:1 chat
Capacity	Dataverse capacity after upgrades is within your entitlement
Helpdesk	Scripts point to the web app, not to the Teams app

Troubleshooting

Symptom	Likely cause	What to do
Upgrade is blocked with a capacity error	Tenant has less available capacity than the environment size	Free capacity or add capacity, then retry
Maker cannot open the web app	No standalone or trial license	Assign one, per the upgrade article
Cannot share an agent with other authors after upgrade	Authors are not team owners, or the Teams Owner group was removed	Add authors as team owners, or restore the group
Users see SystemError in Teams	Teams kept an older published version	Use the toggle and republish workaround above
Agent in Teams but a user cannot chat	Agent is not shared with the user or group	Share the agent and retest with the affected account

Checklist

Read MC1511056 in your own Message Center and note your tenant's dates.
List every environment with Type set to Microsoft Teams.
Name an owner for each agent, and retire the ones nobody uses.
Check Dataverse capacity, then upgrade the environments to keep.
Move makers to the web app and confirm licenses.
Re-test published agents in Teams.
Update helpdesk and training material.

For the web app side, see Build your first Copilot Studio agent. For controlling where agents can be built and what they can connect to, see Copilot Studio data policies and environments.

What we checked

Opened Message Center post MC1511056 (mirrored at mc.merill.net) on 2026-11-13; it was published October 16, 2026 and gives January 2027 for ending edits and February 2027 for removal of the app.
Opened MC1315217 on 2026-11-13 and confirmed June 30, 2026 as the end of classic agent creation in the Teams app and that existing agents continue to function.
Opened the Dataverse for Teams environment page on learn.microsoft.com on 2026-11-13 and read the lifecycle table: no new environments from November 15, 2026, upgrade before October 30, 2027, 2 GB per environment.
Cross-checked the deprecation wording between the Power Platform admin page and the CoE governance article, both of which state that Dataverse for Teams environments are deprecated.
Opened the Copilot Studio upgrade article (last updated 2026-07-21 per its metadata) and noted that it disagrees with the newer Message Center post on editing in the Teams app; this article follows the Message Center post.
Recalculated dates from 2026-11-13: 2 days to November 15, 2026; 351 days to October 30, 2027; 80 days to February 1, 2027.
Opened the Copilot Studio publishing article for Teams (updated 2026-10-29) and copied the menu labels used in Step 5.
Not checked: no live tenant was used, so the upgrade action and web app steps follow Microsoft's documentation as of 2026-11-13, and exact on-screen wording may differ.

Last tested: 2026-11-13

References

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Copilot Scheduled Prompts Move Off Power Platform: Migrate Before Dec 31

epifive — Fri, 13 Nov 2026 05:14:05 +0000

Microsoft is moving scheduled prompts in Microsoft 365 Copilot from Power Platform to native Copilot scheduling, called scheduled tasks. Message Center post MC1550533 (published November 12, 2026) and Microsoft Learn say the Power Platform version retires on December 31, 2026 and stops running after that date. To keep a schedule, recreate it as a new scheduled task in Copilot before then.

This guide is for Copilot users who rely on recurring prompts, and for the admins who support them. It covers what changes, how to find legacy schedules, how to recreate them and what the documentation does not say.

What the scheduled prompts change is

Scheduled prompts let a user run a Copilot request on a timetable, for example a daily brief. Until now the feature ran on Power Platform: Microsoft Learn describes a Power Platform production environment named Microsoft 365 that is created automatically the first time a licensed user uses a recurring Copilot feature.

The new design drops that dependency. Microsoft Learn states: "Scheduled tasks no longer use a Power Platform environment. Scheduled task data is processed and stored within the Microsoft 365 compliance boundary."

According to MC1550533, as summarized on the community mirror mc.merill.net:

Users describe a one-time or recurring task in natural language. Copilot runs it and returns the result to the associated conversation.
Users manage tasks under Tasks > Scheduled in the Microsoft 365 Copilot app.
Users can run, edit, pause, resume or delete a task.
A task that needs approval pauses until the user responds in the associated conversation.
Limits are 10 active and 50 total schedules per user.
For 30 days after the Scheduled tab appears, tasks can be reached from both the old "More options (...)" menu and Tasks > Scheduled. The old entry is then removed.

Microsoft's support article says scheduled prompts are "now called" scheduled tasks and are managed in Task Hub.

Key dates

Date	Event	Source
Nov 11, 2026	Rollout to Frontier/TAP	MC1550533
Nov 30 to Dec 31, 2026	Worldwide rollout	MC1550533
Dec 31, 2026	Power Platform scheduled prompts retire and stop running	MC1550533, Microsoft Learn
Jan 1, 2027	Scheduled tasks no longer appear in the legacy inventory	Microsoft Learn (inventory page)

The Message Center post says rollout timing may change based on reliability and migration readiness. It listed no "updated" date when we opened it. Learn and Message Center agree on December 31, 2026, so there is no date conflict to plan around.

Who it affects and availability

The post says it affects users with a Microsoft 365 Copilot premium license who use scheduled tasks, subject to organizational controls. It covers Microsoft 365 Copilot and Copilot Chat and Tasks in the Microsoft 365 Copilot app, on web and Windows desktop.

Microsoft's support article adds that scheduling works in Copilot Chat and in Microsoft Copilot on the web or desktop, and that Microsoft Teams, Outlook and mobile are not included in this initial release. That differs from the Learn admin page, which still describes legacy prompts as working across Teams, Office.com chat and Outlook. The pages do not reconcile the two, so test where your users actually schedule.

Two groups to watch:

Users who scheduled prompts during the public preview. Learn says these keep running in Power Automate until they expire before December 31, 2026. They do not appear on the Microsoft Copilot scheduled prompts page; manage them in Power Automate.
Consumer Copilot Tasks. A separate support article for personal Microsoft accounts (Microsoft 365 Personal, Family, Premium and Pro) says those Tasks will migrate to Copilot Cowork. That is a different feature and not part of MC1550533.

The documents we opened do not state whether sovereign clouds such as GCC are included. The Message Center post as we read it does not say. Check your tenant's own Message Center entry.

Requirements

A Microsoft Copilot license. Learn: "This feature is available to all users with a Microsoft Copilot license. There is no separate policy setting for this feature."
For the legacy inventory: the Power Platform Administrator role, PowerShell 7.0 or later, and the Az.Accounts and Microsoft.PowerApps.Administration.PowerShell modules.
To see the legacy prompts in the Microsoft 365 environment, the inventory page says you also need the System Administrator role on that environment. It takes about 30 minutes to show up everywhere.
Learn notes scheduled prompts appear only in the Work IQ tab of Microsoft Copilot.

Microsoft advises using roles with the fewest permissions rather than Global Administrator.

How to check whether you're affected

As a user

Open Copilot and look for scheduled prompts you created. If a prompt appears on the scheduled prompts page, it is a legacy Power Platform schedule until you recreate it. Treat any recurring prompt you rely on as at risk. MC1550533 says schedules that will not migrate automatically must be recreated before December 31, 2026; the documents we opened do not list which schedules migrate automatically, so recreate anything important.

As an admin: inventory legacy schedules

Microsoft Learn publishes an inventory process for legacy prompts. Its own warning applies: it covers only Power Platform scheduled prompts, and scheduled tasks "will not appear in this inventory" from January 1, 2027.

Sign in to the Power Platform admin center, select the Microsoft 365 environment (the default name; your tenant might use a different one), select Membership, then select Add me to get the System Administrator role.
Sign in with Connect-AzAccount.
Find the environment with the documented command:

Get-AdminPowerAppEnvironment 'Microsoft 365'

Save the scripts from the Learn inventory page (Get-CopilotActions.ps1 and the removal scripts) in the same folder. We do not reproduce them here; copy them from Microsoft's page.
List all legacy prompts for the tenant, using your own environment ID:

.\Get-CopilotActions.ps1 -EnvironmentId abc123-a100-xyz000-12345

For one user, add -UserId. To export, pipe the output to Export-Csv, as the page shows:

.\Get-CopilotActions.ps1 -EnvironmentId abc123-a100-xyz000-12345 | Export-Csv -Path C:\temp\resultFile.csv

The values above are Microsoft's documented placeholders. The output lists fields such as Name, CreatedOn, Status and CreatedByFullName.

How to migrate your scheduled prompts, step by step

Microsoft's support page describes the creation path for scheduled tasks. Menu names may vary because the page says Home, the new Copilot starting point, is still rolling out.

Recreate a schedule as a user

Go to Copilot Chat and sign in with your Microsoft 365 account.
Use one of the documented methods: hover over a prompt and select Schedule this, choose when and how often it runs, then select Save; create a scheduled task directly in Copilot Chat; or create one from Task Hub.
After a run, the response appears in the Chats section on the left. Scheduled tasks are bolded and have an icon.

Manage tasks

Select the Task icon in the left sidebar header of the Copilot app.
Select the Scheduled tab. Tasks appear under Active or Inactive.
Use Run now (Active tasks only), Edit Schedule, Pause (Active only; the task moves to Inactive) or Delete (deleted tasks do not appear in Inactive).

MC1550533 words the path as Tasks > Scheduled. The two pages describe the same tab differently, so match whichever label you see.

What admins should do

Microsoft's recommended actions in MC1550533 are to:

Notify users who rely on scheduled prompts.
Tell them to recreate schedules that will not migrate.
Tell them Copilot Chat schedule management is moving to Tasks > Scheduled.
Update internal documentation and helpdesk guidance.
Review applicable Microsoft 365 Copilot controls and organizational policies.

If you use the inventory, export the list before the retirement date, contact each owner and give them the retirement date. Deleting legacy prompts with the documented scripts is optional and not required by Microsoft.

Limitations, testing and rollback

Limits: 10 active and 50 total schedules per user (Learn and MC1550533). The support page lists no limits, so use the Learn figure.
Approvals: tasks needing approval pause until the user responds in the conversation.
Unknowns: the documents do not say which legacy schedules migrate automatically, what error a user sees after December 31, or whether every schedule frequency carries over.
Testing: recreate one schedule per user group, run it with Run now, and confirm the response lands in Chats.
Rollback: Microsoft does not document a way to keep Power Platform scheduled prompts past December 31, 2026. During the 30-day overlap, the old menu still reaches tasks.
Rollout timing: worldwide rollout runs November 30 to December 31, which leaves little time. Users in the worldwide group may not see the Scheduled tab until late in that window.

Privacy and admin notes

Scheduled task data is processed and stored within the Microsoft 365 compliance boundary.
MC1550533 states the change alters how existing customer data is processed and that Copilot can run tasks without the user present.
Microsoft says the change does not cause data loss; earlier responses stay in chat history.
Scheduled tasks are not a connected experience and are not controlled by the Allow the use of connected experiences in Office setting. Legacy prompts still are until retirement: setting it to Disabled hides legacy scheduled prompts, though existing ones keep running until their schedule finishes.
There is no separate policy setting for scheduled tasks. If you must block them, review your Copilot license assignment; the documents we opened describe no other control.
For audit and retention of Copilot interactions, see /blog/copilot-interactions-audit-retention-ediscovery. For license planning, see /blog/microsoft-365-copilot-license-assignment-checklist.

What we checked

Opened MC1550533 on mc.merill.net on 2026-11-13: published November 12, 2026, no updated date shown, act-by December 31, 2026, limits of 10 and 50.
Opened the Learn page "Manage Scheduled Prompts for Microsoft Copilot" (updated 2026-11-11): confirmed the December 31, 2026 retirement, the 10 active and 50 total limits and the lack of a separate policy setting.
Cross-checked the retirement date and limits between MC1550533 and the Learn page: both match.
Opened the Learn inventory page (updated 2026-11-11): copied the documented commands and prerequisites and confirmed legacy inventory ends for scheduled tasks on January 1, 2027.
Opened the Learn Power Platform page on the Microsoft 365 environment: confirmed the environment name, the role and the Copilot license requirement.
Opened Microsoft's support pages on scheduling prompts and on consumer Copilot Tasks: quoted the UI labels.
Could not confirm in the Microsoft 365 roadmap and found no Tech Community post for this retirement; labels differ between Message Center and the support page.
Not tested on a live tenant or account; the rollout had not reached every account on 2026-11-13. We did not run the PowerShell.

Last tested: 2026-11-13

Sources

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Apache HTTP Server HTTP/2 RCE (CVE-2026-119618): Check and Patch

epifive — Fri, 13 Nov 2026 05:13:30 +0000

Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a critical flaw in the HTTP/2 module (mod_http2) that the Apache project says "can lead to RCE" (remote code execution). Releases 2.4.55 through 2.4.70 are affected. The most important action is to upgrade to 2.4.71; if you cannot do that today, make sure HTTP/2 is turned off by serving only Protocols http/1.1.

What happened

Dates below come from the Apache HTTP Server project's own security page for the 2.4 series, which we treat as the primary source.

Date	What the primary source says
2026-10-26	The issue was reported to the project by Anthropic's OSS Scanner (tracked by the reporter as ANT-2026-MAPKT6MZ).
2026-11-03	Google Cloud Vulnerability Research reported the issue independently.
2026-11-11	The fix was committed (commit `824beab`) and Apache HTTP Server 2.4.71 was released. The release lists 3 CVEs: 1 critical, 1 important, 1 low.
2026-11-11	Wiz published an analysis rating the issue critical.
2026-11-12	BleepingComputer reported on the fix and cited the Apache advisory and the Wiz analysis.

The Apache description reads: "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE." In plain words, it is a race condition. Per Wiz, a remote, unauthenticated attacker could corrupt heap memory and potentially achieve code execution with the web server process's privileges.

What the sources say, and what they do not

Statement	Who made it	Status
Versions 2.4.55 through 2.4.70 are affected; 2.4.71 fixes it	Apache HTTP Server project	Primary source; matches Wiz
Standalone mod_h2 2.0.8 through 2.0.42 is affected	Apache HTTP Server project	Primary source; matches Wiz
No exploit is available and no in-the-wild exploitation is reported	Wiz, as of 2026-11-11	A vendor statement about its own knowledge at publication; not confirmed by Apache
64% of cloud environments have vulnerable resources, 51% have publicly exposed instances	Wiz telemetry	A claim from one vendor's data; Wiz says the figures do not account for configuration
The condition is real and patching or disabling HTTP/2 is advised	watchTowr, as reported by BleepingComputer	Reported by a news outlet; we did not open watchTowr's own page
Exact exploitation details, number of affected servers worldwide	Nobody	Unknown; the Apache page contains no proof of concept

The same release also fixes two other issues: CVE-2026-106023 (important, a NULL pointer dereference in mod_md that can crash a child process, affecting 2.4.30 through 2.4.70) and CVE-2026-109163 (low, a 1-byte stack buffer overwrite in mod_vhost_alias, affecting 2.4.69 and 2.4.70). Upgrading to 2.4.71 covers all three.

Am I affected?

You are potentially affected if all of the following are true:

You run Apache HTTP Server (httpd) at a version from 2.4.55 through 2.4.70, or the standalone mod_h2 from GitHub at 2.0.8 through 2.0.42.
mod_http2 is loaded.
HTTP/2 is actually enabled through the Protocols directive.

On point 3, the Apache documentation gives the default as Protocols http/1.1 and says "By default, only the http/1.1 protocol ... is allowed." The mod_http2 page adds: "You must enable HTTP/2 via Protocols in order to use the functionality." Wiz also states the issue applies only where HTTP/2 is used. So a server that has never had h2 or h2c added to Protocols should not be using HTTP/2. Do not rely on that alone: many hosting panels, container images and tutorials add Protocols h2 http/1.1 automatically, and a virtual host can set its own value.

Indicators of compromise

None. Neither the Apache advisory nor the Wiz analysis publishes indicators of compromise, and we are not adding any. At the time of writing there is no published way to confirm from logs that this specific flaw was used.

What to do now

Find every Apache HTTP Server you run (web servers, reverse proxies, container images, appliances that embed httpd).
Check the version on each (Step 1 below).
Check whether HTTP/2 is enabled (Step 2).
Upgrade to 2.4.71 or later using your normal build or package process (Step 3).
If you cannot upgrade today, disable HTTP/2 (Step 4) and schedule the upgrade.
Verify and restart (Step 5).

Step 1: Check the version

The httpd manual documents -v ("Print the version of httpd, and then exit.") and -V ("Print the version and build parameters of httpd, and then exit."):

httpd -v

On some distributions the binary is named differently; use whatever your installation calls it. If the version is 2.4.55 through 2.4.70, you are in the affected range. If you installed through a distribution or vendor package, also read that vendor's own security notice, because the package's version label may not follow the upstream number. We did not verify any distribution's handling of this fix.

Step 2: Check whether mod_http2 is loaded and HTTP/2 is on

List loaded modules. The manual describes -M as "Dump a list of loaded Static and Shared Modules", and -t with -D DUMP_MODULES prints all loaded modules after the syntax test:

httpd -M
httpd -t -D DUMP_MODULES

Look for http2_module in the output. Then search your configuration for the Protocols directive. Replace the path with your configuration directory:

grep -rn "Protocols" /path/to/your/httpd/conf

Interpret the results with the documented rules:

Protocols h2 http/1.1 means HTTP/2 over TLS is enabled for that scope.
Protocols h2 h2c http/1.1 means HTTP/2 over TLS and over cleartext is enabled.
A Protocols line inside a <VirtualHost> replaces any Protocols line in the base server for that host. The Apache docs say base-server protocols are inherited "only if the virtual host has no own Protocols directive." Check every virtual host.
No Protocols line at all means the default, http/1.1.

Step 3: Upgrade to Apache HTTP Server 2.4.71

Upgrade through whatever method you used to install: your package manager, your container base image, or a source build. The Apache security page lists 2.4.71 as the fixed release for Apache HTTP Server. The page does not list a fixed version for the standalone mod_h2 from GitHub, and Wiz's table is internally inconsistent about it (it lists "2.0.42 and newer" as patched while the affected range ends at 2.0.42). If you use the standalone mod_h2, check that project's own release notes before relying on a specific version number. We did not open them.

After upgrading, run httpd -v again to confirm the version.

Step 4: If you cannot upgrade today, disable HTTP/2

The Apache HTTP/2 guide says, under "Disabling HTTP/2": to serve only HTTP/1, set

Protocols http/1.1

It also says you can remove the Protocols h2 ... line from the relevant scope, or omit LoadModule http2_module if you do not need the module at all. Wiz's mitigation matches: restrict protocols to HTTP/1.1 and remove h2 and h2c references. Be thorough, because a single virtual host with its own Protocols h2 http/1.1 line stays exposed even if the base server is fixed.

Two documented side effects to know about: http/1.1 is "always available and cannot be excluded," so clients will keep working, and browsers that used HTTP/2 simply fall back to HTTP/1.1. Pages may load somewhat differently, but the Apache documentation does not describe any loss of functionality.

Step 5: Validate the configuration and restart

Run the syntax test, which the manual says exits with a return code of 0 for "Syntax OK":

httpd -t

Then restart or reload the server using your platform's service manager so the change takes effect, and repeat Step 2 to confirm no scope still enables h2 or h2c if you chose to disable it.

How to prevent it

Keep a version inventory. The affected window (2.4.55 through 2.4.70) is wide. Knowing which hosts run which release is the fastest way to answer the next advisory.
Enable only what you use. The Apache documentation notes that Protocols defaults to http/1.1, that unavailable protocols are ignored, and that LoadModule http2_module can be omitted. If a server does not need HTTP/2, leaving the module out reduces exposure to HTTP/2 flaws.
Do not leave HTTP/2 on in forgotten virtual hosts. Search all included configuration files, not only the main one.
Watch the official advisory page. The Apache HTTP Server 2.4 security page at httpd.apache.org lists each CVE with affected and fixed versions and dates.
Plan for the web server process's privileges. The risk described by Wiz is code execution with the privileges of the web server process. Running httpd as an unprivileged account and limiting what that account can reach is general hardening; we did not verify specific settings for this article, so follow your platform's documentation.

Checklist

[ ] Every Apache HTTP Server host is listed with its version.
[ ] Hosts on 2.4.55 through 2.4.70 are upgraded to 2.4.71 or later.
[ ] Standalone mod_h2 users have checked that project's release notes.
[ ] Where upgrading must wait, Protocols http/1.1 is set in every scope, or mod_http2 is not loaded.
[ ] httpd -t returns Syntax OK and the service has been restarted.
[ ] Your team knows that no public exploit was reported as of 2026-11-11 and will re-check the advisory.

What we checked

Opened the Apache HTTP Server 2.4 security page on 2026-11-13. It lists CVE-2026-119618 as critical, affecting 2.4.55 through 2.4.70, fixed by commit 824beab on 2026-11-11, with 2.4.71 released 2026-11-11. It also lists the two other CVEs fixed in the same release. We read the first 100,000 characters of that long page; the rest was not read.
Opened the Wiz analysis on 2026-11-13. The affected versions and the 2.4.71 fix match the Apache page. Wiz's statement of no known exploitation is its own and is dated to its publication. Its mod_h2 fixed-version wording conflicts with the affected range, so we left a fixed mod_h2 version out.
Opened the BleepingComputer report on 2026-11-13. It matches the Apache and Wiz facts; the watchTowr statement comes only from that report.
Cross-checked HTTP/2 being off by default between the Apache core documentation (Protocols default http/1.1) and Wiz's note that HTTP/2 must be in use.
Opened the Apache HTTP/2 guide, the mod_http2 page, the core Protocols directive entry and the httpd program page, and used only the directives and options quoted above.
The commands in this guide are not run output: we did not run them. They follow the Apache manual, and we show no output for them.
Not tested on a live server; we did not try to exploit or reproduce the flaw, and we did not open watchTowr's or the mod_h2 project's own pages.

Last tested: 2026-11-13

Sources

Apache HTTP Server 2.4 vulnerabilities (primary source): https://httpd.apache.org/security/vulnerabilities_24.html
Wiz analysis of CVE-2026-119618: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Apache HTTP/2 guide: https://httpd.apache.org/docs/2.4/howto/http2.html
Apache mod_http2 documentation: https://httpd.apache.org/docs/2.4/mod/mod_http2.html
Apache core directives, Protocols: https://httpd.apache.org/docs/2.4/mod/core.html#protocols
Apache httpd program options: https://httpd.apache.org/docs/2.4/programs/httpd.html
BleepingComputer report: https://www.bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw/

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

iCloud+ Storage Plans and Pricing in the US: Which Tier Do You Need?

epifive — Thu, 12 Nov 2026 05:14:42 +0000

iCloud+ costs $0.99 a month for 50 GB, $2.99 for 200 GB, $9.99 for 2 TB, $29.99 for 6 TB and $59.99 for 12 TB in the US, according to Apple's pricing page checked on 2026-10-31. Most people with one iPhone and a photo library fit in 50 GB or 200 GB, while a family sharing one plan usually needs 200 GB or 2 TB.

This guide shows the full price table, what each tier adds besides storage, how to check what is using your space before you pay, and how to upgrade, downgrade or cancel. Prices change, so confirm the figure on Apple's page before you subscribe.

Who this is for and what you will have at the end

This is for anyone whose iPhone is warning that iCloud storage is almost full, or who is deciding whether a paid plan is worth it. At the end you will know how much space you actually use, which tier covers it, whether Apple One is cheaper for you, and how to change plans without losing data.

US iCloud+ prices

Apple's support page for iCloud+ plans lists these US prices in USD, billed monthly. Prices were checked on 2026-10-31.

Storage	US price per month	Cost per year at that price
5 GB	Free	$0
50 GB	$0.99	$11.88
200 GB	$2.99	$35.88
2 TB	$9.99	$119.88
6 TB	$29.99	$359.88
12 TB	$59.99	$719.88

The yearly column is simple arithmetic (twelve times the monthly price), not a separate Apple offer. Apple's page says upgrades are billed monthly, and that residents in some US states have tax added to the monthly payment due to state laws. If you pay through a country other than the US, the price table differs, so use Apple's regional page.

Source: iCloud+ plans and pricing.

What each tier includes besides storage

The free 5 GB is what you get the first time you sign in to an iPhone, iPad or Mac with your Apple Account. It covers backups, syncing personal information across devices, and access at iCloud.com.

Paid plans add features beyond the space:

Feature	50 GB	200 GB	2 TB, 6 TB, 12 TB
iCloud Private Relay	Yes	Yes	Yes
Hide My Email	Yes	Yes	Yes
Custom Email Domain	Yes	Yes	Yes
Apple Invites	Yes	Yes	Yes
HomeKit Secure Video	1 camera	Up to 5 cameras	Unlimited cameras
Share with family	Up to 5 others	Up to 5 others	Up to 5 others

Apple's page shows the 6 TB and 12 TB tiers adding no features over 2 TB, only more space. That means the difference between 200 GB and 2 TB is mostly the number of HomeKit Secure Video cameras plus the storage itself. If you do not use HomeKit cameras, the choice comes down purely to how much data you hold.

What actually uses iCloud storage

Apple's iCloud overview lists what iCloud stores:

Photos and videos, through iCloud Photos, Shared Albums and the Shared Photo Library
iCloud Drive files and folders
Device backups of important iPhone and iPad data, made when the device is connected to power and Wi-Fi
Notes, Calendar, Safari tabs and bookmarks, Passwords, Keychain and Contacts
Messages
iCloud Mail
HomeKit Secure Video recordings

Photos and device backups are often the largest items, and they compete for the same space, so the usage list described below is the way to see your own numbers.

Check your usage first

Open Settings and tap your name.
Tap iCloud. A bar graph at the top shows overall usage.
Tap Storage or Manage Account Storage (the label depends on your iOS version). You see apps and features listed by how much space they use.

Apple also says you can check usage at iCloud.com. Write down the total used, then compare it with the tiers above. Leave some headroom, because photos and backups only grow.

Free up space before you pay

Apple's storage page suggests these steps, and they can bring a full account back under 5 GB or 50 GB.

Recommended for You. On iOS 17 and later, open Settings, tap your name, tap iCloud, then tap Recommended for You. Options for large files and old backups appear there.
Trim backups. Open Storage or Manage Account Storage, tap Backups, then tap your device. Turn off apps you do not need backed up. Apple warns that turning an app off also removes its data from iCloud.
Delete old device backups. On an iPhone or iPad, tap the device, tap Turn Off and Delete from iCloud, and confirm. Apple says backups stay available for 180 days after you stop using iCloud Backup, and a backup being used for a restore cannot be deleted.
Clean up Photos and other content. Apple notes that deleting photos in iCloud Photos removes them from every device signed in with the same Apple Account. Items in Recently Deleted do not count toward your storage, but they can be recovered for only 30 days.

A caution about deleting when full

Apple says that if you exceed your iCloud storage limit, deleted photos and videos are removed immediately and cannot be recovered from Recently Deleted. Back up the photos you care about to a computer or another drive before you delete from a full account. The related guide iPhone backup: iCloud vs computer and how to restore explains the options.

What happens when iCloud is full

Apple lists these effects when you run out of storage:

iCloud backups stop.
New photos and videos stop uploading to iCloud Photos.
iCloud Drive and other iCloud apps stop staying up to date across your devices.
You cannot send or receive email with your iCloud address.

Because iCloud backups stop when the account is full, check that your latest backup is recent before you replace or reset a phone.

Which tier should you choose?

Use your measured usage rather than a guess. The table below is a rule of thumb that matches common situations to the capacity figures above, not an Apple recommendation.

Situation	Reasonable tier	Why
One iPhone, small photo library, mostly backups	50 GB ($0.99)	Covers backups and a modest library
One person with a large photo library and videos	200 GB ($2.99)	Four times the space for $2 more a month
Family of several sharing photos and backups	200 GB or 2 TB	Shared storage, up to five others
Heavy video, many devices, lots of iCloud Drive files	2 TB ($9.99)	Room to grow, unlimited HomeKit cameras
Very large libraries across a family	6 TB or 12 TB	Storage only, no extra features

If you have more than one HomeKit Secure Video camera, the 200 GB tier supports up to five cameras and 2 TB supports unlimited cameras.

Apple One as an alternative

Apple One bundles iCloud+ with other Apple services. Apple's US page lists these monthly prices as of 2026-10-31:

Apple One plan	Price per month	iCloud+ storage included
Individual	$21.95	50 GB
Family	$27.95	200 GB
Premier	$39.95	2 TB

Individual and Family include Apple TV, Apple Music and Apple Arcade, and Premier adds Apple Fitness+ and Apple News+. Family and Premier can be shared with up to five people. Apple says subscriptions you do not already have are free for the first month, and if you already pay for an included service you keep paying for it separately until the trial ends.

Apple One only makes sense if you already pay for several of the bundled services. If you only need storage, a standalone iCloud+ plan is far cheaper. If you pay for both Apple One and iCloud+, Apple says you can downgrade or cancel only the iCloud+ plan and keep the storage that comes with Apple One.

Upgrade, downgrade or cancel on an iPhone

Menu paths depend on your iOS version. These come from Apple's support pages.

Upgrade

iOS 18.4 to iOS 26: Open Settings, tap your name, tap Subscriptions, tap iCloud+ under Active, then tap See All Plans. To buy a first plan, tap your name, tap iCloud, scroll down and tap Upgrade to iCloud+.
iOS 18 to 18.3: Open Settings, tap your name, tap iCloud, scroll and tap Manage Plan, then choose a plan.
iOS 17 and earlier: Open Settings, tap your name, tap iCloud, tap Manage Account Storage, tap Change Storage Plan, then choose a plan.

Apple's page also describes steps for iOS 27 and later, where Manage Plan sits under iCloud+ Features in iCloud settings.

Downgrade or cancel

iOS 18.4 and later: Open Settings, tap your name, tap Subscriptions, then tap iCloud+ under Active. To cancel, tap Cancel Subscription. To downgrade, tap See All Plans and choose a plan.
iOS 18 to 18.3: Settings, your name, iCloud, Manage Plan, Downgrade Options, choose a new plan, then tap Done.
iOS 17 and earlier: Settings, your name, iCloud, Manage Account Storage, Downgrade Options, choose a new plan, then tap Done.

Apple says the change takes effect after your current billing period ends. If your stored data is over the new limit, iCloud stops syncing and updating your information and backups will not complete until you free space or increase your storage. Copy or download anything that exceeds the new amount first. Downgrading to the free plan also removes Hide My Email, Private Relay, Apple Invites and HomeKit Secure Video support.

Apple says partial refunds are available where required by law, and that if you recently changed your plan you can contact Apple within 14 days to ask for one.

Checklist

Open Settings, your name, iCloud, and note how much storage you use.
Run Recommended for You and delete old backups you no longer need.
Back up irreplaceable photos before deleting from a full account.
Pick the smallest tier with headroom: 50 GB, 200 GB or 2 TB cover most people.
Choose 2 TB or more only for storage, or for more than five HomeKit cameras.
Compare Apple One only if you already pay for the bundled services.
Confirm the current price on Apple's page, because prices and taxes can change.

References

Apple Support, iCloud+ plans and pricing
Apple, iCloud+
Apple Support, Manage your iCloud storage on your Apple device
Apple Support, Buy iCloud+ or upgrade your current storage plan
Apple Support, Downgrade or cancel your iCloud+ plan
Apple, Apple One

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Holiday Laptop Buying Checklist: Specs, Returns, Warranty and Scams

epifive — Thu, 12 Nov 2026 05:14:06 +0000

A good holiday laptop purchase comes down to five checks made before you pay: the specs meet a floor that suits your work, the operating system runs the software you need, the exact model number matches the spec sheet, the return and warranty terms are acceptable, and the seller is real. This checklist walks through each one so that a Black Friday price does not decide the purchase for you.

Who this is for and what you will have at the end

This guide is for US buyers shopping for a laptop in November and December, whether for yourself, a student or as a gift. It is not a list of recommended models or prices; deals change hourly and any price quoted here would be out of date. Instead you will have a written set of minimums, a way to compare listings that look alike, a list of policy questions to answer before checkout, and a setup routine for the first days after the laptop arrives, while it can still be returned.

Price bands are described in general terms. Budget laptops trade build quality, display and battery for price. Mid-range models aim for a balance of processor, memory and storage. Premium models add better displays, materials and battery life. The checklist works the same way in every band.

Before you shop: write down the use and the floor

Decide what the laptop is for

Write one sentence about the main use: browsing, email and documents; schoolwork with a specific learning platform; photo or video editing; software development; or gaming. Then list any must-have software. That sentence decides the operating system and the minimum specs, and it keeps you from being steered toward a deal that does not fit.

If a school, employer or software vendor has published requirements, those override any general advice. Check them before you look at any listings.

Set spec minimums from official requirements

Microsoft publishes the floor for Windows 11 and a separate, higher bar for Copilot+ PCs:

Component	Windows 11 minimum	Copilot+ PC requirement
Processor	1 GHz or faster, 2 or more cores, compatible 64-bit processor or SoC	Compatible processor or SoC with an NPU capable of 40+ TOPS
Memory	4 GB	16 GB DDR5 or LPDDR5
Storage	64 GB or larger	256 GB SSD or UFS
Security	UEFI with Secure Boot, TPM 2.0	Same as Windows 11
Graphics	DirectX 12 or later with WDDM 2.0 driver	Same as Windows 11
Display	720p, larger than 9 inches diagonally, 8 bits per color channel	Same as Windows 11

Microsoft names AMD Ryzen AI 300 and 400 series, Intel Core Ultra 200V and 300V series, and Snapdragon X series processors for Copilot+ PCs. It also says that a PC with a 40+ TOPS NPU but less than 16 GB of RAM or less storage is not a Copilot+ PC, so a listing that says "AI PC" is not the same as a Copilot+ PC.

The Windows 11 minimums tell you what will install, not what will feel quick in three years. Memory is the spec most worth getting right: check on the manufacturer's spec page whether the RAM is soldered or upgradeable, because soldered memory cannot be added later. For a detailed look at how much you need, see 8 GB vs 16 GB of laptop RAM.

For the rest of the spec sheet, compare like with like:

Processor: compare the exact model name and generation, not just the brand tier.
Storage: confirm the drive is an SSD and note its capacity; the operating system and updates take a share of it before you install anything.
Display: check resolution, size and panel type on the manufacturer's spec page, not on a retailer's summary.
Battery: compare the battery capacity listed on the spec page, and if the manufacturer explains how its battery-life figure was measured, read that before relying on it.
Ports: list the devices you will plug in (monitor, USB drives, card reader, wired network, charger) and confirm the laptop has matching ports, or budget for a hub.
Weight and keyboard: these matter more for a laptop you will carry every day than most benchmark differences.

If a model is in the EpiFive device portal, you can compare spec sheets side by side at /devices.

Choose the operating system: Windows 11, macOS or ChromeOS

Each platform has a support detail worth checking before you buy, especially at a deep discount on older stock.

Windows 11

Windows 11 Home and Pro for personal use require internet connectivity and a Microsoft account during initial setup, and every edition needs internet access for updates. Some budget laptops ship with Windows 11 Home in S mode. Microsoft says S mode allows apps only from the Microsoft Store and requires Microsoft Edge, with Edge as the default browser and Bing as the default search engine. Switching out of S mode is free but one-way; Microsoft's S mode FAQ gives the steps under Settings, System, Activation, and warns against the "Upgrade your edition of Windows" link, which leaves the device in S mode.

Avoid buying a laptop that still runs Windows 10 unless it can be upgraded. Microsoft says Windows 10 reached end of support on October 14, 2025, and no longer receives security updates. The consumer Extended Security Updates program can protect a Windows 10 device until October 12, 2027, but that is a bridge, not a reason to buy one.

macOS

Apple publishes a compatibility list for each macOS release. Before buying an older, open-box or refurbished Mac, confirm that its exact model appears on the list for the newest release. Apple's macOS Tahoe 26 list, for example, names specific MacBook Air and MacBook Pro models by size, chip and year, so the year alone is not enough. On a Mac you already own, Apple notes that Software Update shows only updates compatible with that Mac.

ChromeOS

Google's Auto Update policy says ChromeOS devices receive 10 years of updates, counted from the platform release date. A Chromebook launched several years ago and sold new at a holiday discount has already used part of that time. Google lists an "Automatic updates until" date for each model and says to check it when making a purchasing decision. After the final update, Google says the device no longer gets security updates, bug fixes or new features, and some apps may stop being supported. The manufacturer's "End of Sale" date is not related to update eligibility.

If you are deciding between a Chromebook and Windows, check that the software you rely on runs on ChromeOS first.

Check the exact model number

Holiday listings often show a familiar product name with a short spec summary. Similar model names can cover different processors, memory, storage, displays or build materials, and a configuration sold for a sales event may not match the one reviewed elsewhere.

HP's guidance explains why the full number matters. It says thousands of products may share a model number, which describes the components and features; the product number identifies the product within a series; and the serial number is unique to each device. Other manufacturers use similar schemes with their own names.

Copy the full model or product number from the listing, not the marketing name.
Search for that number on the manufacturer's own website and open its spec page.
Compare processor, RAM (and whether it is soldered), SSD capacity, display and battery line by line.
If the listing does not show a full model number, ask the seller or treat it as a reason to skip the deal.
When the laptop arrives, check the number on the label. HP says its label is most often on the bottom of the laptop, and that pressing Fn and Esc together on an HP notebook should open the HP System Information window.

Read the return, warranty and payment terms

Return windows and holiday return policies

Return terms are set by each retailer and can differ by product category, by sale event and by whether an item is open-box or clearance. The FTC says a seller's site must say whether you can return an item for a full refund, and recommends finding out who pays return shipping, how long the return window is and whether there is a restocking fee. It also notes that sellers often have different refund and return policies for sale items, especially clearance merchandise.

Before you check out, open the retailer's return policy page and answer:

How many days do you have, and does a holiday or extended return period apply to a November purchase?
Are laptops or computers excluded from that extended period or given a shorter window?
Is there a restocking fee for opened computers?
Do you have to return the original packaging and accessories?
For marketplace listings on a retailer's site, does the retailer's policy apply, or the third-party seller's?

Save a copy or screenshot of the policy with your order.

Manufacturer warranty

The FTC says a written warranty must be available for you to read before you buy, whether you shop in a store or online. Check how long it lasts, what it covers ("if they aren't listed, assume they aren't covered"), whether the remedy is repair, replacement or refund, whether you must register the product, whether you deal with the manufacturer or the seller, and who pays shipping for repairs. Keep a copy of the warranty and your receipt, since the receipt proves the purchase date and that you are the original owner.

Extended warranties and service contracts

Checkout pages often offer protection plans. The FTC says an extended warranty or service contract costs extra and is not a good value if it does not offer more coverage than the warranty that came with the product. Ask who backs the contract (it may not be the manufacturer), whether there are deductibles or per-service fees, whether accidental damage is covered and what the yearly cost works out to. The FTC also notes that putting money aside in savings can be the better option. For a deeper comparison of manufacturer plans, see whether a laptop extended warranty is worth it.

Avoid fake deals and marketplace scams

The FTC warned in its November 2025 holiday alert that scammers pose as real companies and run ads, especially on social media, for brand-name products at unusually low prices. Clicking can lead to a scam site that takes your money and sends a fake item, something unlike the ad, or nothing at all.

Use these checks before paying:

Search the seller. The FTC suggests searching the seller's name and the website the ad sends you to, with words like "review," "complaint" or "scam."
Do not trust stars alone. The FTC says some reviews and ratings are fake, and fake reviews can be positive or negative.
Do not treat the padlock as proof. The FTC notes that "https" means a site is encrypted, not that it is legitimate.
Pay by credit card. The FTC says paying by credit card best protects you in case of a scam or if something else goes wrong. To dispute an error, it says to call right away and send a letter that reaches the card company within 60 days of the first bill showing the problem.
Walk away from unusual payment demands. The FTC says never to buy from online sellers that insist on gift cards, wire transfers, payment apps or crypto.
Know the shipping rule. The FTC says sellers must ship as promised in their ads, and if no time is promised, within 30 days of receiving your order details and payment.
Keep records. Save the receipt, order confirmation number, return policy, shipping promise and messages with the seller.

If something goes wrong, contact the seller first, then report it to the FTC at ReportFraud.ftc.gov.

After it arrives: setup and verification

Do these while the return window is still open:

Inspect and photograph the box, the laptop and the serial number label before you power it on.
Confirm the model number on the label matches your order and the manufacturer's spec page.
Connect to the internet for setup. Windows 11 Home and Pro need it for initial setup with a Microsoft account; have your account details ready.
Verify the hardware you paid for: processor, RAM and storage. The guide on how to check laptop specs on Windows 11 and Mac shows where to look.
Install updates before installing your own apps. On a Chromebook, check the update schedule under Settings, About ChromeOS, Additional details.
Decide on S mode if the laptop has it, remembering that leaving S mode is one-way.
Register the warranty if the manufacturer requires it, and file the receipt and warranty copy together.
Use it for real work for a few days. A problem with the keyboard, display, battery or ports found now can be handled under the return policy rather than as a warranty repair, where the FTC notes a company may have the right to fix the product before it refunds your money.

Holiday laptop checklist

One sentence on the main use and a list of must-have software.
Spec floor written down, using Windows 11 or Copilot+ PC requirements as a reference, with RAM sized for the life of the laptop.
Operating system support checked: no Windows 10-only machines, Mac model on Apple's current compatibility list, Chromebook "Automatic updates until" date checked.
Full model or product number compared with the manufacturer's spec page.
Return window, holiday terms, restocking fee and seller of record confirmed and saved.
Manufacturer warranty read; extended plan bought only if it adds coverage you need.
Seller researched, paid by credit card, records kept.
Setup and hardware verification done before the return window closes.

References

Microsoft, Windows 11 specifications and system requirements: https://www.microsoft.com/en-us/windows/windows-11-specifications
Microsoft Support, Windows 10 support has ended on October 14, 2025: https://support.microsoft.com/en-us/windows/windows-10-support-has-ended-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281
Microsoft Support, Windows 11 in S mode FAQ: https://support.microsoft.com/en-us/windows/windows-11-in-s-mode-faq-851057d6-1ee9-b9e5-c30b-93baebeebc85
Apple Support, macOS Tahoe 26 is compatible with these computers: https://support.apple.com/en-us/122867
Apple Support, How to download and install macOS: https://support.apple.com/en-us/102662
Google, ChromeOS Auto Update policy: https://support.google.com/chrome/a/answer/6220366
Google, Chromebook update schedule: https://support.google.com/chromebook/answer/9367166
HP, How to find your HP laptop model number: https://www.hp.com/us-en/tech-takes/laptops/how-to/how-to-find-hp-laptop-model-number.html
FTC, Online shopping: https://consumer.ftc.gov/articles/online-shopping
FTC, How to avoid an online shopping scam this holiday season: https://consumer.ftc.gov/consumer-alerts/2025/11/how-avoid-online-shopping-scam-holiday-season
FTC, Warranties: https://consumer.ftc.gov/articles/warranties
FTC, Extended warranties and service contracts: https://consumer.ftc.gov/articles/extended-warranties-and-service-contracts

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Someone is sending email from your domain: how to stop it with DMARC

epifive — Thu, 12 Nov 2026 05:13:31 +0000

If someone is sending email that appears to come from your domain, the fix is to publish SPF, turn on DKIM signing for your own domain, and move your DMARC policy to p=reject so receivers that enforce DMARC refuse the forged mail. Before you change anything, confirm that the mail really is forged: read the Authentication-Results header of a sample message. If it fails DMARC, it is spoofing; if it passes with your domain, it left your own systems and you have a different problem.

Who this is for and what you will have at the end

This guide is for owners and administrators of a small or mid-sized business who have received a report that fake invoices, payment requests or phishing messages are going out in the company's name. It assumes you manage DNS for the domain and, ideally, use Microsoft 365, although the DNS records apply to any mail provider.

At the end you will have:

A way to tell forged mail from mail sent by your own accounts and apps.
DMARC reports arriving in a mailbox you control, and a method for reading them.
SPF, DKIM and DMARC records that tell receivers to reject mail that fails.
Locked-down records for parked domains and subdomains that never send mail.
A short list of what to do while you wait for the policy to take effect.

Why anyone can send mail as your domain

SMTP, the protocol behind internet email, doesn't validate that a sender is who they claim to be. A message carries two sender values. The MAIL FROM address (also called 5321.MailFrom, the envelope sender or Return-Path) is used between mail servers and for bounces. The From address (5322.From) is what the recipient sees in their mail app. They can be in different domains, and an attacker controls both.

Microsoft's documentation gives the classic example: the envelope sender is dubious@proseware.com while the visible From address is security@woodgrovebank.com. The transmission is valid SMTP, yet it deceives the recipient. SPF checks only the MAIL FROM domain, and DKIM checks only the domain that signed the message, so an attacker can pass both with a domain they own while showing yours in the From line. DMARC closes that gap by requiring that the domain SPF or DKIM validated aligns with the From domain, and by telling receivers what to do when it doesn't.

This means two things for you. You can't stop someone typing your address into a From field. You can make every receiver that honors DMARC reject the message, and you can see how much of it is happening.

Step 1: Confirm it is spoofing and not a compromised account

Ask the person who received the message to send it to you as an attachment, or to copy the full headers. Outlook's menu paths for viewing headers are on Microsoft's support page, "View internet message headers in Outlook", linked in the references. Paste the headers into Microsoft's Message Header Analyzer if you want them parsed.

Find the Authentication-Results header. The three fields that matter are smtp.mailfrom= (the envelope domain SPF checked), header.d= (the domain that signed the message with DKIM) and header.from= (the visible From domain).

Microsoft's DMARC troubleshooting page shows this header, from a message where SPF and DKIM pass individually but neither aligns with the From address:

Authentication-Results: spf=pass (sender IP is 198.51.100.10)
  smtp.mailfrom=bounces.adatum.com; dkim=pass (signature was verified)
  header.d=adatum.com; dmarc=fail action=oreject
  header.from=contoso.com;compauth=fail reason=000

That is documented output from learn.microsoft.com, not output from your tenant. Read it like this: header.from=contoso.com is the forged domain, while smtp.mailfrom and header.d belong to a different domain, so dmarc=fail.

Use the result to decide what you are dealing with:

What the header shows	Most likely cause	Next step
`dmarc=fail`, `smtp.mailfrom` and `header.d` in someone else's domain	Spoofing from outside	Continue with steps 2 to 6
SPF or DKIM passes and the domain is yours (for example `header.d=contoso.com`, `dmarc=pass`)	Mail left a system you authorize: a compromised mailbox, a stolen app credential or a forgotten sender	Treat as an account incident: reset passwords, enforce MFA, review the sending system
`dmarc=bestguesspass` or `dmarc=none`	You have no DMARC record at all	Publish one in step 3
`spf=fail` with `-all`, but the message was still delivered	The receiver doesn't enforce, or DMARC isn't set	Publish DMARC; enforcement depends on the receiver

The second row is an inference from how alignment works rather than a rule Microsoft states in one sentence: a message aligned with your domain by SPF or DKIM can only have been sent by a source that SPF authorizes or that holds your DKIM key. If that describes your spam, tighten account security first. The small business MFA rollout checklist covers that side.

Step 2: Check what your domain publishes today

Before you change records, look at what exists. In PowerShell, Resolve-DnsName (also used in Microsoft's own troubleshooting page) shows the DMARC record:

Resolve-DnsName -Name "_dmarc.contoso.com" -Type TXT | Select-Object -ExpandProperty Strings

Check the SPF record the same way, against the domain itself:

Resolve-DnsName -Name "contoso.com" -Type TXT | Select-Object -ExpandProperty Strings

You are looking for three things. A single record starting v=spf1, because two SPF records cause permerror. A _dmarc TXT record starting v=DMARC1;, and its p= value. And whether the SPF record ends in -all. If no _dmarc record exists, Microsoft 365 reports dmarc=bestguesspass or dmarc=none for your mail when it receives it, and nobody is told to reject forgeries.

If you use Microsoft 365, you can also check DKIM:

Get-DkimSigningConfig | Format-List Domain, Enabled, Selector1CNAME, Selector2CNAME

Enabled should be True for your custom domain. The full procedure for publishing the CNAME records and enabling signing is in SPF, DKIM and DMARC for Microsoft 365, so this article doesn't repeat it.

Step 3: Publish DMARC at p=none with reporting

Don't jump to p=reject yet. If a legitimate sender such as a billing tool or newsletter service isn't aligned, p=reject makes receivers refuse your real mail. Start with monitoring, which also gives you evidence of how much forged mail exists.

First create a place for reports. Microsoft recommends a dedicated mailbox or a Microsoft 365 Group, not a person's inbox, and says to start with rua only because forensic (ruf) reports can be high volume. Then add one TXT record at your DNS host:

Hostname: _dmarc
Type: TXT
Value: v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@contoso.com

Microsoft's rollout example uses the same structure, with rua and ruf addresses. A few details from the documentation:

The hostname _dmarc is required, and there must be only one _dmarc TXT record.
p=none takes no action on failing mail but still produces reports.
pct defaults to 100 if you leave it out.
Aggregate reports are typically sent once a day and describe the previous day.
If the report address is in a different domain from the one you're monitoring, that other domain must publish a TXT record named contoso.com._report._dmarc with the value v=DMARC1;. Without it receivers don't deliver the reports.
Microsoft 365 doesn't send forensic reports even if your record has a ruf address, so other providers' reports are the only source.

The reports are XML, often compressed. You can read them by hand while the volume is small, or use a DMARC reporting service listed in the Microsoft Intelligent Security Association catalog.

Step 4: Read the aggregate reports

Give the record at least a few days so that receivers send their summaries. Then look at each <record> in the XML. Microsoft's page explains the fields that matter:

Element	What it tells you
`<source_ip>`	The server that sent mail using your domain
`<count>`	How many messages came from that IP
`<disposition>`	What the receiver did: `none`, `quarantine` or `reject`
`<dkim>` and `<spf>` under `<policy_evaluated>`	Whether DKIM or SPF aligned with your From domain
`<domain>` under `<auth_results>`	The domain SPF or DKIM actually validated

Sort the sources into three groups:

Known and aligned. Your Microsoft 365 tenant, with SPF aligned. Healthy; no action.
Known but not aligned. A legitimate service where authentication passes but alignment fails. The page's example: SPF pass in auth_results but fail in policy_evaluated. The service uses its own domain in MAIL FROM or signs with its own domain. Fix it at the service: have it sign DKIM with your domain, or change its MAIL FROM to your domain or a subdomain.
Unknown, high volume, everything failing. Microsoft's table describes this pattern as a potential spoofing or phishing campaign and says no action is needed because your DMARC policy protects recipients once it is enforced. This is the group you are trying to stop.

Don't skip group 2. Every legitimate sender you leave unaligned becomes a bounce the day you reach p=reject. Common examples named in Microsoft's table are services that use their own MAIL FROM, forwarded mail and mailing lists. Forwarding is the exception: it breaks SPF and can break DKIM when the body changes, so a share of failures from forwarders is normal.

Step 5: Fix SPF and DKIM for the legitimate senders

For each legitimate sender from group 2, use the vendor's documentation to find its include: value or its DKIM setup. For Microsoft 365 as the only sender, Microsoft's documented SPF record is:

v=spf1 include:spf.protection.outlook.com -all

For a domain with an on-premises server and a bulk mailer on a subdomain, the same page gives:

contoso.com            TXT  v=spf1 ip4:192.168.0.10 include:spf.protection.outlook.com -all
marketing.contoso.com  TXT  v=spf1 include:servers.adatum.com include:spf.protection.outlook.com -all

Keep these rules in mind:

One SPF record per domain or subdomain.
Fewer than 10 DNS lookups. include, a, mx, exists and redirect each count, and so do nested includes; ip4, ip6 and all don't. If you exceed the limit, see fixing an SPF record that is too long.
Use -all. Microsoft notes that DMARC treats -all and ~all both as SPF failures, but a ~all failure is effectively ignored by DMARC when the message has no DKIM signature.
Put services you don't control, such as bulk mail platforms, on a subdomain. Each subdomain needs its own SPF record and DKIM setup, because unlike DMARC they don't inherit from the parent.

After each change, watch the next day's reports and confirm that the sender moved from group 2 to group 1.

Step 6: Move to quarantine, then reject

Once the legitimate senders are aligned and the only failing traffic is unknown sources, tighten the policy in stages. Microsoft's recommended order is p=none, then p=quarantine, then p=reject, starting with a subdomain that has low mail volume and saving the parent domain for last. You can step pct through 10, 25, 50, 75 and 100 to limit the share of failing mail that gets the policy at first.

Hostname: _dmarc
Type: TXT
Value: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@contoso.com

When the reports stay clean at 100, finish with:

Hostname: _dmarc
Type: TXT
Value: v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@contoso.com

What "reject" means depends on the receiver. Microsoft's page says the messages are typically discarded, and that a Microsoft 365 recipient with Honor DMARC record policy turned on rejects a failing message during SMTP with 550 5.7.1 and stamps dmarc=fail action=oreject. With p=quarantine, the message goes to Junk Email by default. Other providers make their own decisions, which is why DMARC lowers the volume of spoofing instead of removing it.

One side effect to know about: outbound mail from a Microsoft 365 domain that fails DMARC at the destination is routed through the high-risk delivery pool if your policy is p=quarantine or p=reject, and there is no override. Align your senders first, so that doesn't catch legitimate mail.

Step 7: Lock down domains and subdomains that don't send mail

Attackers don't need your main domain. Old domains, typo-protection domains and unused subdomains are all usable for forgeries if nothing is published. For a registered domain that sends no mail, Microsoft documents two records:

Hostname: @ (contoso.net)
Type: TXT
Value: v=spf1 -all

Hostname: _dmarc (contoso.net)
Type: TXT
Value: v=DMARC1; p=reject;

The pct, rua and ruf values are arguably unnecessary here because no valid mail should come from the domain. Microsoft's note also applies to your *.onmicrosoft.com domain: if you don't use it for email, add a DMARC record for it, which you do in the Microsoft 365 admin center under Settings > Domains, then the DNS records tab and Add record, with the TXT name _dmarc and the value v=DMARC1; p=reject. DMARC on your main domain also covers subdomains that have no record of their own, including ones that don't exist, unless a subdomain publishes its own _dmarc record.

Troubleshooting

Symptom	Likely cause	Fix
`dmarc=fail` but SPF and DKIM both pass	Neither domain aligns with the From address	Make the service sign with your domain or use your domain in MAIL FROM
`dmarc=temperror` or `dmarc=permerror`	DNS timeout, or a DMARC record with a syntax error	Check syntax with `Resolve-DnsName`, and keep exactly one `_dmarc` TXT record
No reports arrive	Wrong `rua` address, or external report address without the `_report._dmarc` record	Fix the address or publish `contoso.com._report._dmarc` in the receiving domain
Legitimate mail from a vendor is rejected after `p=reject`	The vendor isn't aligned	Add its DKIM signing with your domain; move it to a subdomain
Forwarded messages fail	Forwarding breaks SPF; body changes can break DKIM	Expect some failures; the receiving side can use trusted ARC sealers
You still see forged mail in some inboxes	The receiving provider doesn't enforce DMARC, or you're still at `p=none`	Confirm the published policy; enforcement is the receiver's decision

If the spoofed mail targets your own users, a Microsoft 365 tenant can also deal with inbound forgeries of your domain. The Tenant Allow/Block List guide explains the spoofed sender entries, and Microsoft documents the anti-phishing setting Honor DMARC record policy when the message is detected as spoof.

What to do while you wait

DNS changes and receivers' enforcement take time, and DMARC doesn't recall mail that was already sent. In the meantime:

Tell customers and staff that you will never change bank details by email, and agree how payment changes are verified, for example by calling a known number.
Report the phishing to the people it targeted, so they can block it on their side.
Keep the sample headers and message copies so you can show which domain and IP the mail came from.

Checklist

Read the Authentication-Results header of a sample message and decide spoofing or compromised account.
Check that exactly one SPF record and a _dmarc record exist.
Publish v=DMARC1; p=none; rua=... and confirm reports arrive.
Sort the aggregate report sources and align every legitimate sender.
Move to p=quarantine, then p=reject, using pct steps, subdomains first.
Publish v=spf1 -all and p=reject for parked domains.
Review reports weekly at first and monthly once stable.

What we checked

Opened "Set up DMARC to validate email in Microsoft 365" on learn.microsoft.com on 2026-11-12 (page dated 2026-07-03): the record syntax, p=none/quarantine/reject rollout order, the pct steps 10, 25, 50, 75 and 100, and the parked-domain record v=DMARC1; p=reject;.
Opened the SPF configuration page on 2026-11-12 and confirmed the Microsoft 365 record v=spf1 include:spf.protection.outlook.com -all, the parked-domain record v=spf1 -all, and the 10-lookup rules.
Cross-checked the Authentication-Results fields (smtp.mailfrom, header.d, header.from, dmarc, action) between the DMARC page and the "Anti-spam message headers" page; both describe dmarc=fail action=oreject the same way.
Documented output: the sample Authentication-Results header in step 1 is quoted from Microsoft's DMARC troubleshooting section, with compauth=fail reason=000. The reason code table on the headers page defines 000 as a DMARC fail where the sender's policy is p=quarantine or p=reject.
Confirmed on the DMARC page that Microsoft 365 doesn't send forensic reports and that cross-domain report addresses need a _report._dmarc TXT record.
Not checked hands-on: we did not run any command or change DNS on a live tenant or domain, and the second row of the step 1 table is our own reading of how alignment works. Steps follow Microsoft's documentation as of 2026-11-12.

Last tested: 2026-11-12

References

Set up DMARC to validate email in Microsoft 365: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure
Set up SPF to identify valid email sources: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure
How email authentication works in Microsoft 365: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about
Anti-spam message headers (Authentication-Results and compauth reason codes): https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo
View internet message headers in Outlook: https://support.microsoft.com/office/cd039382-dc6e-4264-ac74-c048563d212c

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.