Yesterday’s Microsoft 365 outage (MO1550821) took down Exchange Online, Teams, SharePoint, Copilot — and Defender XDR.
Most post-mortems will focus on the productivity outage. I want to focus on the security one, because they arrived together and only one of them got written up in the helpdesk ticket.
What actually happened
Root cause was not a traffic spike. A core process on affected servers became overwhelmed, servers failed health checks and dropped out of rotation. Microsoft paused all deployments and investigated recent configuration changes.
UptimeRobot recorded the first Exchange Online incident at 16:17 UTC. Microsoft’s formal incident opened at 18:26 UTC. That two-hour gap is the window during which a SOC was operating with degraded tooling before the incident even had a tracking number.
Why an XDR outage is different from an email outage
Outlook being slow = productivity problem.
Defender XDR being degraded = visibility blackout.
Three things happen simultaneously when Defender XDR degrades:
Alert visibility drops — the SOC cannot see the signals the platform would normally surface
Incident response queues pause — open incidents stop updating, new ones may not be created
Automated remediation stops or becomes unreliable — containment actions may not complete
An attacker who is already inside does not need to exploit the outage. They only need to operate while the defenders cannot see them.
The fallback
It is procedural, not architectural:
SIEM correlation rules that consume raw telemetry (firewall, proxy, endpoint events, identity sign-ins) — not just rules that fire on Defender XDR incidents
Entra ID sign-in logs forwarded to the SIEM independently of the XDR platform
Firewall and proxy logs retained and searchable for the duration of the incident response cycle
The fallback plan written before the next outage, not during it
UptimeRobot shows 62 Microsoft 365 incidents in the past 90 days, median duration 7 hours 20 minutes. This is a pattern.
Full analysis: https://threataft.com/articles/microsoft-365-defender-xdr-outage-november-2026
Does your SOC playbook have a specific section for XDR console degradation? Curious how teams are handling the dependency.
Top comments (0)