Exchange Online is Microsoft's hosted version of its Exchange email server: a cloud service that stores an organisation's mailboxes, calendars and contacts in Microsoft datacenters and delivers them to Outlook, phones and browsers. It exists so that companies no longer have to buy, patch and run their own mail servers. Microsoft operates the hardware and the software; the customer, known as a tenant, rents mailboxes per user per month and manages them through an admin portal. Most organisations never buy it on its own. It sits inside Microsoft 365 and Office 365 bundles, where it has become the data layer that much of the rest of the suite depends on.

That dependence was on display this week, when an Exchange Online failure that began on November 12, 2026, turned into a Microsoft 365 email outage that hit 19 services, from Outlook to Copilot.

How the service works

Inbound mail. A company that moves to Exchange Online points its domain's MX record, the DNS entry that tells other mail servers where to deliver, at a Microsoft host in the form domain.mail.protection.outlook.com. Incoming messages land first in Exchange Online Protection (EOP), the filtering layer that checks sender authentication (SPF, DKIM and DMARC), scores spam and quarantines malware. Only then is a message written to the recipient's mailbox. Microsoft Defender for Office 365, a paid add-on, adds Safe Links, which rewrites URLs so each click is checked when it happens.

Storage. Each user gets a primary mailbox and, depending on the plan, an archive. As of November 2026, according to Microsoft's Exchange Online limits page, Exchange Online Plan 1 provides a 50 GB mailbox and a 50 GB archive. Plan 2 provides 100 GB plus an auto-expanding archive of up to 1.5 TB. The frontline Kiosk plan gets 2 GB.

Access. Users reach their mailboxes through several protocols at once. Outlook for Windows uses MAPI over HTTP. Phones typically use Exchange ActiveSync. Browsers use Outlook on the web. Third-party applications historically used Exchange Web Services (EWS), an XML-based interface, and are now being pushed to Microsoft Graph, the REST API that also exposes OneDrive, Teams and SharePoint data.

Outbound mail. Sending is metered. According to Microsoft, a mailbox can send to 10,000 recipients a day and 1,000 recipients per message, at no more than 30 messages a minute. A tenant-wide cap, the Tenant External Recipient Rate Limit, has been enforced since May 2025 using a formula of 500 multiplied by the number of purchased email licences raised to the power 0.7, plus 9,500.

Administration. IT teams use the Exchange admin center and PowerShell. Retention, eDiscovery and sensitivity labels are set in Microsoft Purview but applied to data held in Exchange.

Standalone, Plan 1 costs $4 per user per month and Plan 2 $8 on annual commitment, according to Microsoft, but most mailboxes come bundled. From July 1, 2026, Microsoft 365 E3 rose from $36 to $39 per user per month; the standalone Exchange plans were left unchanged.

Origin and evolution

Microsoft shipped Exchange Server 4.0, the first version of the on-premises product, on April 2, 1996. The hosted service came twelve years later. On November 17, 2008, Microsoft announced that Exchange Online and SharePoint Online were out of beta and available for purchase in the US. Stephen Elop, then president of Microsoft's Business Division, said at the time that "customers are embracing Microsoft's software and services strategy en masse."

The bigger shift came on June 28, 2011, when Microsoft launched Office 365 in 40 markets, bundling desktop Office with cloud versions of Exchange, SharePoint and Lync. That bundle, later broadened into Microsoft 365, is how Exchange Online reached its current scale. Microsoft does not publish a mailbox count. On its January 28, 2026 earnings call, chief financial officer Amy Hood said paid Microsoft 365 commercial seats had passed 450 million.

Microsoft disabled basic authentication, the practice of sending a username and password with every request, across Exchange Online on October 1, 2022. Basic authentication for SMTP AUTH, used by printers and scanners, survived that cut; under a timeline Microsoft published in January 2026, it is due to be switched off by default at the end of December 2026.

EWS is going the same way. Microsoft announced in 2023 that it would disable EWS in Exchange Online from October 2026. That phase has begun: since October 10, 2026, tenants that want to keep EWS must list approved applications by ID, and Microsoft's documentation says EWS will be fully disabled in April 2027. Microsoft's own sources disagree on the end point, with one message centre post putting rollout completion in "early July 2027".

On premises, Exchange Server Subscription Edition arrived on July 1, 2025, and support for Exchange 2016 and 2019 ended on October 14, 2025.

Why it matters for marketers

First, it is a large share of the business inbox. EOP decides whether B2B email programmes reach their recipients. Its authentication checks overlap with the rules Google applied to Gmail, covered in PPC Land's report on Google's updated requirements for bulk email senders. Safe Links also has a direct effect on reporting. Because security scanners follow rewritten URLs to check them, email platforms can record clicks that no person made, inflating click-through rates in campaigns aimed at corporate addresses.

Second, it is the data store for Microsoft's AI products. Copilot reads mail, calendar and contacts through Microsoft Graph. Microsoft reported Microsoft 365 commercial cloud revenue of $27.78 billion for the quarter to September 30, 2026, up 17%, alongside Copilot daily users up nearly 50 percent quarter over quarter. When Exchange fails, those features fail with it.

Third, it holds regulated personal data. PPC Land reported that a Microsoft France executive told the French Senate in June 2025 that he could not guarantee French data would never reach US authorities, and that the Hessian data protection commissioner in November 2025 concluded that Microsoft 365 could be used in line with GDPR.

Limitations, criticisms and disputes

Reliability. Microsoft's Service Level Agreement for Online Services promises 99.9% monthly uptime for Exchange Online, measured in user-minutes, and defines downtime as any period when users "are unable to send or receive email with Outlook Web Access." Credits are 25% of the monthly fee below 99.9%, 50% below 99% and 100% below 95%. In a 30-day month, 99.9% allows about 43 minutes of downtime. Microsoft's own published figure for worldwide Microsoft 365 uptime in the first quarter of 2026 was 99.526%, below the SLA threshold, though that is an aggregate and not a per-tenant measure. Exchange incidents with their own IDs were recorded in March 2025, September 2025, March 2026 and from August 31 to September 3, 2026, when Microsoft cited "core authentication configuration issues."

Concentration risk. Because so many services read from Exchange, a single fault cascades. During the November 2026 incident, Microsoft's status page stated that features of other Microsoft 365 services "that interact with Exchange Online and email services are impacted."

Security. The Cyber Safety Review Board, reviewing the Storm-0558 intrusion that Microsoft disclosed on July 11, 2023, concluded that it "was preventable and should never have occurred" and that the attacker succeeded "because of a cascade of security failures at Microsoft." Attackers used forged tokens and downloaded about 60,000 State Department emails, according to the board. In January 2024, Microsoft disclosed that the Russian group Midnight Blizzard had accessed its own corporate email accounts, prompting CISA's Emergency Directive 24-02.

Platform control. Retirements of basic authentication, EWS and SMTP AUTH have forced customers and software vendors to rebuild integrations on Microsoft's timetable. Microsoft's proposed per-mailbox limit of 2,000 external recipients a day, first set out in April 2024, was postponed repeatedly before Microsoft cancelled it "indefinitely" on January 6, 2026.

Exchange Online and adjacent terms

Exchange Server is the software that customers install and run themselves. Exchange Online is the same lineage operated by Microsoft as a multi-tenant service. Microsoft's sovereign "Microsoft 365 Local" offering, announced in 2025, runs Exchange Server, not Exchange Online.

Outlook is a client, the application that displays mail. Outlook.com is Microsoft's consumer mail service. Neither is Exchange Online, though business Outlook users usually connect to it. The bulk-sender requirements Microsoft enforced from May 5, 2025, for domains sending over 5,000 messages a day apply to Outlook.com, Hotmail and Live addresses, according to Microsoft, not to business tenants.

Exchange Online Protection is the filtering layer included with Exchange Online. It is also sold separately to protect on-premises mail servers, and should not be confused with Defender for Office 365, the paid add-on that supplies Safe Links and Safe Attachments.

Recent developments

Microsoft opened incident EX1550543 for Exchange Online on November 12, 2026; reported start times range from about 16:17 GMT to 18:15 GMT. Microsoft initially said the load was not driven by "an increase in traffic," attributing it to servers becoming unexpectedly unavailable. It later said a process "responsible for establishing secure connections" was being overwhelmed, and began reverting a network configuration change that correlated with the start of impact, even though it had said hours earlier that it had found no such change. Downdetector reports for Outlook peaked at over 120,000 in the US, according to ABC News. Charles Lamanna, a Microsoft executive vice president, said on X that there was "no indication this is the result of malicious or cyber activity." As of the morning of November 13 UTC, Microsoft's status page still listed the service as degraded, and Microsoft had promised a post-incident report.

Meanwhile, EWS disablement is under way, and apps using the Exchange Online Admin API must move to new permissions by November 30, 2026, before the old ones are deprecated on December 1.

Timeline

  • April 2, 1996 - Microsoft releases Exchange Server 4.0, the first version of Exchange.
  • November 17, 2008 - Exchange Online and SharePoint Online leave beta and go on sale in the US.
  • June 28, 2011 - Office 365 launches in 40 markets, bundling Exchange Online with SharePoint, Lync and Office.
  • October 1, 2022 - Basic authentication disabled across Exchange Online, excluding SMTP AUTH in tenants still using it.
  • July 11, 2023 - Microsoft discloses the Storm-0558 intrusion into Exchange Online and Outlook.com mailboxes.
  • September 2023 - Microsoft announces EWS will be disabled in Exchange Online from October 2026.
  • January 19, 2024 - Microsoft discloses Midnight Blizzard's access to its corporate email accounts.
  • April 2, 2024 - The Cyber Safety Review Board publishes its Storm-0558 report.
  • April 2024 - Microsoft proposes a 2,000-a-day external recipient limit per mailbox.
  • May 2025 - Tenant-level external recipient limit enforced for all tenants; Outlook.com bulk-sender requirements take effect on May 5.
  • July 1, 2025 - Exchange Server Subscription Edition becomes generally available.
  • October 14, 2025 - Support ends for Exchange Server 2016 and 2019.
  • December 4, 2025 - Microsoft announces Microsoft 365 price increases effective July 1, 2026.
  • January 6, 2026 - Microsoft cancels the per-mailbox external recipient limit.
  • January 2026 - Microsoft publishes a revised SMTP AUTH basic authentication timeline.
  • First quarter 2026 - Microsoft 365 worldwide uptime recorded at 99.526%.
  • August 31 - September 3, 2026 - Exchange Online authentication outage (EX1464935).
  • October 10, 2026 - EWS allow lists become mandatory for tenants keeping EWS enabled.
  • November 12, 2026 - Exchange Online outage (EX1550543) begins, affecting 19 Microsoft 365 services.
  • November 30, 2026 - Deadline to migrate Exchange Online Admin API permissions.
  • End of December 2026 - SMTP AUTH basic authentication scheduled to be disabled by default.
  • April 2027 - EWS scheduled to be fully disabled in Exchange Online.

Summary

Who: Microsoft builds and operates Exchange Online. Business and public-sector tenants buy it, mostly inside Microsoft 365 bundles, and IT administrators manage it. Marketers meet it as the destination for B2B email and as the data source behind Copilot.

What: A multi-tenant cloud service that hosts email, calendars and contacts, filters mail through Exchange Online Protection and exposes mailbox data to Outlook, Teams, Copilot and third-party apps through protocols such as MAPI, ActiveSync and Microsoft Graph.

When: Exchange Online went on sale on November 17, 2008, and reached global scale through Office 365 from June 28, 2011. EWS is being disabled between October 2026 and 2027, and an outage that began on November 12, 2026, disrupted 19 Microsoft 365 services.

Where: Microsoft datacenters worldwide, with EU customer data processed inside the EU Data Boundary that Microsoft said it completed in February 2025.

Why: It removes the cost of running mail servers in-house, but concentrates email, identity-linked data and AI features on one provider, which makes its outages, security failures and policy changes felt across every service built on top of it.