On November 12, 2026, a Microsoft 365 outage disrupted Exchange Online and the Microsoft 365 features that depend on it. Outlook and Teams calendars drew most of the attention, but Intune was on Microsoft's list too: device enrollment, check-ins, and compliance policies were intermittently impacted, and recovery ran into November 13.
The timing made it worse for IT teams. The outage arrived two days after a Patch Tuesday that fixed an actively exploited Outlook zero-day, and one day after Microsoft confirmed that the November Windows update was already causing Intune check-ins to fail. Admins who needed to push critical patches through Intune were stuck waiting on check-ins that could fail or arrive hours late.
That wait matters more than it used to. AI is helping attackers move from disclosure to exploitation faster, and many vulnerabilities are now exploited before a patch exists. Every hour a critical fix sits waiting to reach devices is time attackers can use.
This post covers what Microsoft confirmed about the outage, why Intune patching stalled, what recent exploitation data shows, and how to keep critical patches moving when Intune check-ins stall.
What happened during the November 12 Microsoft 365 outage
The outage began at 16:17 UTC on November 12, under Microsoft incident EX1550543. Users couldn't reach their Exchange Online mailboxes through Outlook on the web, the Outlook desktop app, Exchange ActiveSync, or the REST API.
About two hours later, Microsoft opened a second incident, MO1550821, for other Microsoft 365 services. Microsoft said the features affected were the ones that interact with Exchange Online, while features that don't depend on it kept working.
Microsoft's explanation evolved as it worked the problem. It first pointed to servers failing automated health checks and dropping out of service, which overloaded the rest. Later it said a process responsible for establishing secure connections was being overwhelmed, and it began reverting a network change that correlated with the start of impact. Microsoft said there was no indication of malicious or cyber activity.
As of November 13, Microsoft reported recovery progress, including extending its email timeout window to 48 hours so delayed messages wouldn't be lost. It had not published a root cause or a time for full restoration, and has said a Post-Incident Report will follow.
For endpoint and security teams, the most relevant impacts on Microsoft's list were:
Microsoft Intune: Device enrollment, device check-in, and device compliance policies were intermittently impacted.
Microsoft 365 Apps admin center: Cloud Update, Cloud Policy, and Inventory were affected.
Microsoft Defender XDR and Defender for Office 365: Some portal pages and features, including Safe Links, could fail.
Why Intune admins were stuck waiting to push critical patches
The outage didn't happen in isolation. It capped three days in which a critical fix had to reach devices quickly, and the path many teams use to get it there kept slowing down.
A zero-day was already being exploited
Microsoft's November 2026 Patch Tuesday on November 10 fixed 1,094 CVEs. One of them, CVE-2026-124194, is an Outlook spoofing flaw that attackers were already exploiting to steal users' NTLMv2 password hashes. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a November 24 remediation deadline for federal agencies.
The fix for that zero-day ships in the Microsoft 365 Apps and Office LTSC updates, separate from the Windows cumulative update. Google also patched an exploited Chrome zero-day, CVE-2026-125350, which CISA added to the KEV catalog on November 10 as well.
The November Windows update was already delaying check-ins
Intune applies policy and app changes when a device checks in. According to Microsoft's Intune device check-in guidance, devices check in about every 8 hours on a regular schedule, with one maintenance sync allowed every 6.5 hours, and online devices are notified to sync when changes are made.
On November 11, Microsoft opened incident IT1549049. It confirmed that the November Windows security update can cause a device's check-in to fail during installation, and first described the impact as check-in delays of up to eight hours. Affected devices receive pending policies and apps at their next successful check-in, and Microsoft expects to release a fix in early December 2026.
Then the outage hit check-ins again
One day later, the Microsoft 365 outage put Intune device enrollment, check-ins, and compliance policies on Microsoft's list of intermittently impacted features. The Microsoft 365 Apps admin center's Cloud Update, which manages updates for Microsoft 365 Apps, was also affected. That's the update channel carrying the Outlook zero-day fix.
That left admins who rely on Intune for patching waiting on devices to check in during the same week attackers were exploiting the flaw they needed to close.
Why every hour of delay matters more as AI speeds up exploitation
A delay of a few hours can sound small. Recent data shows the window between disclosure and exploitation has narrowed to the point where those hours count, and AI is a big part of why.
Exploitation is now the top way in. Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation overtook stolen credentials as the leading breach entry point for the first time in the report's 19 years, accounting for 31% of initial access, up from 20%.
AI is shortening the defense window. Verizon reports that attackers are using AI to speed up exploitation, shrinking the window for defense from months to hours, and warns that AI-driven weaponization of known vulnerabilities can create a capacity crisis for security teams.
Remediation is falling behind. The same report found that organizations fully remediated only 26% of CISA KEV vulnerabilities, down from 38%, and that the median time to fully patch rose to 43 days from 32.
Exploitation often starts before a patch exists. Mandiant's M-Trends 2026 estimates the mean time to exploit at negative seven days, meaning exploitation routinely begins before a patch is released.
Federal deadlines now run in days. CISA's Binding Operational Directive 26-04, issued June 10, 2026, gives federal civilian agencies three calendar days to fix the highest-risk known exploited vulnerabilities on internet-exposed systems.
The directive applies only to federal agencies, but it's a useful benchmark for everyone else. When exploitation can begin before a fix ships and the most urgent deadline is three days, a patch that waits a day or more for devices to check in uses up much of the time defenders have.
How to keep critical patches moving when Intune check-ins stall
Outages and update bugs will happen again. These steps help IT teams keep critical fixes on track when the usual delivery path slows down.
Track the incidents that affect delivery. Follow MO1550821, EX1550543, and IT1549049 in Service health in the Microsoft 365 admin center, so you know which hours changes may not have reached devices.
Map each urgent fix to its update channel. This month's exploited Outlook fix ships in the Microsoft 365 Apps and Office update, the Chrome fix needs a browser update and relaunch, and Windows updates ship separately. A device can be current in one channel and still exposed in another.
Confirm installed versions on each device. After missed or failed check-ins, an assigned policy or app doesn't prove the update is installed. Check the installed build or version directly.
Fix exploited and KEV-listed vulnerabilities first. Move CVE-2026-124194 and CVE-2026-125350 ahead of the rest of a 1,000-plus CVE release. Our guide to prioritizing patch management covers how to rank the rest.
Trigger a sync once service recovers. Microsoft's workaround for the November check-in issue is a manual check-in after the Windows update finishes, and admins can start a device sync from the Intune admin center instead of waiting for the next scheduled check-in.
Keep a second path for critical fixes. For actively exploited vulnerabilities, have a way to deploy a fix and confirm it installed that doesn't depend on a single service's check-in cycle.
How Splashtop AEM helps Intune teams patch without waiting on check-ins
Splashtop AEM (Autonomous Endpoint Management) is an endpoint management solution that works alongside Microsoft Intune. Intune stays in place for enrollment, policy, and compliance, while Splashtop AEM adds a patch path that doesn't wait on Intune check-ins. For a step-by-step setup, see how to fix slow Intune patching.
Real-time patching: Deploy Windows and macOS operating system updates and supported third-party application updates on demand, without waiting for the next scheduled check-in.
Coverage for this month's exploited fixes: The Windows software patch catalog includes Microsoft 365 Office apps such as Outlook classic, Word, Excel, and PowerPoint, along with Google Chrome, so teams can push the fixes for both November zero-days from one console.
Risk-based prioritization: CVE scanning flags vulnerabilities in CISA's KEV catalog, and AI-powered CVE summaries and EPSS scores help teams move exploited vulnerabilities to the front of the queue.
Proof that every fix landed: Patch status shows which updates are installed, pending, or failed on each device, with a record of every status change, so teams can confirm a fix instead of assuming it.
Controlled rollouts: Policies, update rings, maintenance windows, and restart controls let teams test an urgent update on a small group of devices before expanding it.
Teams that want more control over third-party updates can follow our guide to automating third-party app patching with Splashtop AEM.
Patch critical vulnerabilities without waiting on the next check-in
The November outage and the check-in bug before it showed how quickly a critical fix can get stuck between release and installation. Microsoft is working on fixes for both, but similar disruptions will happen again, and faster, AI-assisted exploitation leaves less room for them.
Teams that can see which devices are exposed, push urgent fixes on their own schedule, and confirm each install are in a stronger position the next time the usual delivery path slows down. Splashtop AEM gives Intune teams that second path for the vulnerabilities that can't wait.
Start a free trial of Splashtop AEM to see which endpoints are exposed and deploy critical patches without waiting on check-ins.
