Australian intelligence and police agencies hit by Microsoft outage

Australia's domestic intelligence agency and federal police have been affected by a global Microsoft outage, prompting the federal government to activate an agreement with the technology company to prioritise the restoration of services for Australian interests.

Australian Security Intelligence Organisation (ASIO) Director-General Mike Burgess and Australian Federal Police (AFP) Commissioner Krissy Barrett confirmed that their organisations were among those affected on Friday, 13 November.

The disruption affected Microsoft 365, Outlook and Teams, leaving users in several countries unable to access email, workplace communications and other services.

Home Affairs Minister Tony Burke said Microsoft had informed the Australian government that it did not believe the outage was caused by a cyber attack.

Speaking at a news conference alongside Burgess and Barrett, Burke said the government had activated its existing cyber security agreement with Microsoft to ensure Australian interests received appropriate priority during the recovery process.

"There is good security work that is done with Microsoft as a business and when it came to the formal cyber agreements which I've signed on behalf of Australia, the first of those was with Microsoft," Burke said.

"That agreement has in fact been activated today to make sure that we get appropriate prioritisation of Australian interests in this."

The minister did not disclose the specific operational arrangements under the agreement or how they would affect the restoration timetable for Australian users.

ASIO and federal police confirm disruption

Burgess confirmed that ASIO had experienced disruptions but said the agency's systems had not been affected entirely.

"We operate on multiple levels," he said, adding that ASIO had been affected "on one level, yes, but not completely".

He did not disclose which systems or intelligence operations had been affected.

AFP Commissioner Krissy Barrett also confirmed that the federal police had experienced problems linked to the outage but did not provide further details about the impact on police operations.

Their statements came as Australian government departments, businesses, educational institutions and other organisations reported difficulties accessing Microsoft's services.

Microsoft says outage was not a cyber attack

Burke said Microsoft had briefed him about the incident and did not believe it was dealing with a cyber security attack.

Instead, the company suspected a technical problem involving an update.

"The perspective of Microsoft at this stage, they do not believe they are dealing with a cyber event," Burke said.

"They believe that they're dealing in some ways similar to what we saw with respect to CrowdStrike, where there is an update that has gone awry."

The minister referred to the July 2024 CrowdStrike incident, when a faulty software update caused widespread disruption to computers running Microsoft Windows, affecting airlines, hospitals, businesses and government organisations worldwide.

Burke said the CrowdStrike incident had also demonstrated how a technical failure could affect other products and services connected to the disrupted systems.

He said Microsoft's latest information indicated that the current disruption was concentrated largely on email services, although problems could extend to other applications relying on the affected infrastructure.

Microsoft investigates server failures

Microsoft said the global disruption was linked to unexpectedly unavailable servers, which increased the workload on the remaining infrastructure.

Its investigation found that a core process on affected servers was becoming overwhelmed, causing them to stop responding to requests.

The company was also examining problems involving automated server health checks and recent configuration changes that might have contributed to the disruption.

Microsoft began restarting affected servers, redirecting traffic and testing alternative configurations. However, some servers became unresponsive again after traffic was restored.

The disruption affected several Microsoft services, including Exchange Online, Teams, SharePoint Online, Copilot, OneDrive and other Microsoft 365 applications.

Microsoft said recovery would take place gradually as it restored server capacity and monitored the stability of affected infrastructure.

Australia and Microsoft signed cyber security agreement in June

The agreement activated during the outage was established in June 2026 through a memorandum of understanding between the Australian government and Microsoft.

Burke announced the partnership on 10 June, describing it as an initiative to strengthen Australia's digital resilience and protect systems supporting the country's economy, public services and national security.

The agreement covers cooperation in several areas, including subsea cable security, hyperscale cloud resilience, the secure use of artificial intelligence, protection of small businesses and critical infrastructure, and emerging cyber threats.

The government said the partnership recognised the potential for disruptions to interconnected digital systems to have widespread consequences.

Microsoft was identified as a key partner in strengthening the security and resilience of Australia's digital infrastructure.

Burke's announcement on Friday marked the activation of that existing arrangement in response to the global outage. He did not announce a separate agreement or provide details of any specific service restoration guarantees.