Microsoft Outage 2026: What It Means for NDIS Providers and Participants

A fault inside Microsoft's email servers stopped Outlook, Teams and other Microsoft 365 tools from working in Australia and around the world. Microsoft said there was no sign of a cyber attack. Support in the home and in the community does not run through an inbox, but the admin around it does: referrals, rosters, service agreements, meetings and invoices. At the time of writing we had not seen any NDIA or NDIS Commission notice saying NDIS portals were affected.

What happened in the Microsoft outage

Problems started in the early hours of Friday 13 November, Melbourne time, which was Thursday afternoon in the United States. Microsoft confirmed that customers could not connect to Exchange Online, the service that runs Outlook email for businesses. It later said the problem could affect Microsoft 365 users in any region, not only the Americas.

Australians felt it as the working day began. ABC News reported more than 4,400 Outlook problem reports on Downdetector Australia by 8:20am, and The New Daily put the figure above 5,500 by 9am.

Microsoft said a process on the affected servers that sets up secure connections became overloaded, so the servers stopped handling requests. Restarting servers gave some recovery, but some became unresponsive again once traffic came back. Microsoft also said it was checking whether a small number of recent configuration changes had played a part. Home Affairs Minister Tony Burke said Microsoft had told him it did not believe it was dealing with a cyber attack.

By late Friday morning Microsoft had not given a time for full recovery. If you are reading this later, check Microsoft's own 365 status page for the latest position.

Which Microsoft services were affected

Microsoft listed a long set of services that could be affected. The ones NDIS providers use most are:

• Outlook and Exchange Online: sending, receiving and opening email.
• Microsoft Teams: the parts that depend on email, such as calendars and booking meetings.
• SharePoint Online and OneDrive: shared files and policies.
• Planner and To Do: task lists used by office teams.
• Copilot: Microsoft's AI assistant.
• Defender and Intune: the security and device tools in the background.

Microsoft said features that do not rely on Exchange Online kept working. Even so, some IT administrators reported trouble opening the Microsoft 365 admin centre and status pages, which made it harder to know what was going on.

How the outage hit Australia

This was not only an office inconvenience. The Australian Federal Police and ASIO both confirmed they were affected. Courts in South Australia and Victoria said court operations were hit, and the ACT, Tasmanian and Western Australian governments reported problems. Schools texted parents to phone in absences because email was down, and Service NSW closed centres in parts of regional New South Wales, according to local councils.

Health services carried on. Queensland Health said there were no known clinical impacts, and Services Australia said Centrelink payments and customer-facing services were not affected. The federal government activated its cyber cooperation agreement with Microsoft to push for Australian services to be restored as a priority.

How the Microsoft outage affects NDIS providers

Many NDIS providers, small and large, run their office on Microsoft 365. When it stops, the support itself can carry on, but the coordination around it slows down. These are the pressure points we see across the sector:

1. Referrals and new enquiries. Support coordinators, hospitals and families send most referrals by email. If the inbox cannot be reached, a referral can sit unseen for hours, and a participant waits longer for a start date.
2. Roster changes and shift messages. Rostering software often sends shift offers, changes and confirmations by email. Last-minute cover gets harder when those messages do not arrive.
3. Hospital discharge and case meetings. Discharge planning, case conferences and support coordinator meetings often run on Teams. A meeting that cannot go ahead can push back a discharge or a move into a new home. A planned NDIS hospital discharge program keeps the steps on paper and by phone, so a delayed meeting does not mean a delayed discharge.
4. Service agreements and plan documents. Quotes, service agreements and plan details are usually sent and signed online, so new starts can stall.
5. Incident and complaint notices. Internal alerts about incidents need to reach the right manager quickly. When email is down, teams need a phone-based way to escalate.
6. Invoices and payments. Invoices to plan managers and self-managed participants, remittances and payroll messages are delayed. CNN reported that some Australian businesses could not even print invoices.

The NDIA runs its own portals and systems. During the 2024 CrowdStrike outage, the NDIA said its portals and app were not affected. At the time of writing we had not found a notice saying the portals were hit this time, but check the NDIS news page before you lodge claims or service bookings.

What the outage means for participants and families

Your support workers do not need your email to turn up, so your regular supports should go ahead as rostered. Where an outage can affect you is the paperwork and the back-and-forth:

• If you emailed your provider about a shift change, a new support or an invoice, phone them to make sure it was received.
• Keep your provider's phone number, your support coordinator's number and your after-hours contact saved in your phone, not only in your email.
• If a hospital discharge or a move was waiting on emailed paperwork, call the hospital team or your coordinator to confirm the date still stands.
• Treat any message that offers to fix your email, asks you to log in, or asks for bank details with suspicion. More on that below.

If you are waiting on a home, you can look at current SDA housing in Victoria and the latest accommodation vacancies any time. Neither depends on email working.

Scam and phishing risk after the Microsoft outage

Big outages bring scammers. After the CrowdStrike outage in 2024, Home Affairs and the ACCC's National Anti-Scam Centre warned Australians about fake fix offers, phishing emails and people asking for remote access to computers. Expect the same this time.

There is an extra risk with this outage. Microsoft said its Defender Safe Links service might not be able to check web addresses, which means the link checking many organisations rely on in Outlook and Teams may not have been working as normal.

NDIS providers hold very personal information, and the sector has seen real attacks. In July 2026 the NDIA warned that criminals had used myGov to get into some NDIS accounts through phishing. Simple rules help:

• Do not click links or download files from unexpected messages about the outage.
• Never give anyone remote access to a work computer unless your own IT provider asked for it and you rang them on a number you already know.
• Never change bank or payment details based on an email alone. Call the person on a known number first.
• Report scams to Scamwatch and tell your team what you saw.

What the NDIS Practice Standards expect when systems fail

Registered NDIS providers have had to meet the Emergency and Disaster Management practice standard since January 2022. It sits in the core module and is about keeping supports going that are critical to a participant's health, safety and wellbeing. Continuity of supports is also part of the governance and operational management standard.

The NDIS Commission describes business continuity planning as a cycle of four stages: prevention, preparedness, response and recovery. It also expects providers to test scenarios where important parts of the business stop working. National Disability Services guidance makes the point that this is wider than fires and floods, and covers events such as a significant IT issue or a power outage.

In other words, a day without email is exactly the kind of event an auditor will expect your plan to cover. If your plan only talks about natural disasters and infection control, now is the time to add IT.

Why one provider can stop a whole sector

This outage did not come out of nowhere. ABC News reported that in August, Home Affairs national security head Hamish Hansford warned that Australia's deep reliance on Microsoft could have a disproportionate impact if the company had an outage. The Conversation noted earlier Microsoft 365 disruptions in January and August this year.

The lesson for the disability sector is practical. Nothing that keeps a participant safe should depend on one app or one company. Email is fine for admin. It should never be the only way a worker finds out about a risk, a medication change or a shift.

What NDIS providers should do now

1. Keep an offline contact list. Participants, families, guardians, support coordinators, on-call managers and key workers, stored securely somewhere that is not only in email or the cloud.
2. Agree a second way to talk. Decide in advance who phones whom, and which non-Microsoft channel the team uses for urgent messages.
3. Have paper shift notes ready. Workers can write notes by hand or on their phone and enter them once systems return.
4. Make critical information reachable. Risk plans, medication charts and behaviour support plans should be available to the people who need them when the network is down, kept securely and in line with privacy rules.
5. Give referrers a second route. A staffed phone line and a referral form that does not rely on your email server means new referrals are not lost.
6. Brief staff on scams. A five minute team message today can stop a fake fix or a payment scam.
7. Add IT outages to your plan. List the supports that must never stop, note which system each one depends on, and write down the backup for each.

How to test your business continuity plan

A plan nobody has tried is a guess. Pick a quiet morning and run a short exercise. Tell the office team that email and shared files are down for two hours, then ask them to cover a sick worker, confirm tomorrow's roster, take a new referral and escalate a pretend incident, all without the usual systems.

Write down what slowed them down. Those gaps become your action list. Repeat the test at least once a year and after any real outage. The NDIS Commission describes continuity planning as four stages: prevention, preparedness, response and recovery, and it expects providers to test scenarios where key parts of the business stop working.

What to do once Microsoft 365 is back

• Check that every email sent during the outage actually arrived, especially referrals, incident reports and shift changes.
• Enter paper shift notes into your system and file the originals securely.
• Record the event in your risk register, including what worked and what did not.
• Update the plan and tell your team what changed.

Common questions