Microsoft 365 Email Not Working? Here's What's Actually Broken (and How to Fix It)

When Outlook or Outlook on the web suddenly stops sending, receiving, or syncing mail, people almost always assume it's a Microsoft outage. It usually isn't. In the vast majority of cases, the cause traces back to one of a handful of repeat offenders: a stuck authentication token, a mailbox that quietly hit its storage ceiling, a DNS record that got overwritten during a domain change, or increasingly common right now a printer, scanner, or script that's still using a login method Microsoft has spent the last three years phasing out.

The fastest way to know what you're dealing with: open a private/incognito browser window and go to outlook.office.com. If mail loads there but your desktop Outlook is still broken, the problem is local to your device or profile, not Microsoft, and not your mailbox. If webmail is also broken, the problem sits with your account, your tenant's configuration, or (least likely of all) Microsoft's infrastructure.

That one test eliminates more wrong turns than anything else in this guide, so start there before you touch a single setting.

Step 1: Confirm Whether It's Microsoft or You

Microsoft 365 outages happen, but they're the least common explanation for "my email stopped working," not the most common one. Before you assume the worst:

• Check the public status page at status.office.com - no sign-in required. It shows active incidents affecting Exchange Online, Outlook, and related services.
• If you're an admin, the more reliable source is the Microsoft 365 admin center → Health → Service health. This shows tenant-specific incidents that sometimes never make it to the public page, along with an incident ID you'll want if you ever need to request an SLA credit for business-impacting downtime.
• Cross-check with a third-party monitor like Downdetector or a status aggregator. If thousands of other users are reporting problems at the same time as you, that's a real signal not confirmation bias.
• Follow @MSFT365status on X during a suspected outage; Microsoft posts updates there faster than the status page sometimes refreshes.

One habit worth building: during a confirmed outage, resist the urge to rebuild your Outlook profile, flush DNS, or restart anything. Outbound mail queues and retries automatically once service is restored. Making configuration changes mid-incident just gives you a second problem to fix tomorrow.

Reading the Signal: Webmail Works, Desktop Doesn't (or Vice Versa)

This single data point is the best diagnostic shortcut in this entire article:

• Webmail works, desktop Outlook doesn't → the problem is local: a corrupted profile, a damaged data file, a stuck credential, or a firewall/antivirus rule. Microsoft's servers are fine.
• Desktop works, webmail doesn't → rare, usually a browser extension, cached cookie, or conditional access session policy.
• Neither works, but your phone's Outlook app does → points to a Windows-specific issue (Credential Manager, broker plugin) rather than an account-level block.
• Nothing works anywhere → now you're looking at an account-level or tenant-level cause: mailbox quota, a Conditional Access block, or an actual outage.

The 8 Reasons Microsoft 365 Email Actually Breaks

Ranked roughly by how often each one shows up in real troubleshooting threads and support forums, not by how dramatic they sound.

1. Your authentication token is stuck in a loop

This is the "Outlook keeps asking for my password even though it's correct" problem, and it's almost never actually about the password. Since Microsoft 365 uses OAuth 2.0 (Modern Authentication) rather than checking your password every time, Outlook instead holds a refresh token and quietly renews it in the background. When that renewal fails, Outlook falls back to prompting you, and because retyping the password doesn't fix the underlying token problem, it loops.

Common root causes: a stale entry in Windows Credential Manager, a corrupted identity broker cache (Microsoft.AAD.BrokerPlugin), a Conditional Access policy that now requires device compliance or more frequent re-authentication, or simply a clock that's drifted enough to break time-based MFA codes.

Fix order: sign into office.com in a browser and complete MFA there first, check that your device's date/time is set to automatic, then clear the stored credentials in Windows Credential Manager (look for entries starting with "MicrosoftOffice" or "ADAL") and restart Outlook.

2. Basic Authentication for SMTP was quietly turned off

If a printer, scanner, or old script "just stopped" sending email with zero configuration changes on your end, this is almost certainly it, and it's the single biggest wave of "my email broke overnight" tickets happening across 2025–2026.

Microsoft disabled Basic Authentication by default for most Exchange Online protocols (IMAP, POP, EWS, older Outlook connections) back on December 31, 2022. The one holdout was SMTP AUTH Client Submission, the protocol multifunction printers and scan-to-email devices depend on, which Microsoft kept alive longer because so much legacy hardware relies on it. That grace period is now ending. Microsoft originally targeted retirement for September 2025, pushed the date once, and the current timeline has Microsoft rejecting Basic Auth SMTP submissions starting March 1, 2026, with full retirement targeted for April 30, 2026.

If your device or app authenticates with a plain username and password instead of OAuth 2.0, it will fail with an error resembling "550 5.7.30 Basic authentication is not supported for Client Submission" once your tenant's cutover hits. Every major MFP manufacturer  Ricoh, Xerox, Canon, HP has published firmware or configuration guidance for moving scan-to-email workflows to OAuth 2.0 or an SMTP relay service instead.

What to check: in the Microsoft Entra admin center, review sign-in logs filtered to "legacy authentication" to see which devices or accounts are still using it before Microsoft makes the decision for you.

3. Your Outlook data file (OST) is bloated or corrupted

Classic Outlook keeps a local cached copy of your mailbox in an OST file. When that file gets too large, gets interrupted mid-sync (a laptop sleeping during a big folder download is a classic trigger), or the disk it lives on has errors, you'll see symptoms ranging from Outlook hanging on "Loading Profile" to specific error codes.

The reassuring part: none of these mean your actual email is gone. The OST is a local cache of what's already stored safely in Exchange Online. Deleting it and letting Outlook redownload everything is almost always the correct move, not a risky one - the only cost is time and bandwidth for the resync.

4. Autodiscover DNS is missing, wrong, or stale

Autodiscover is the background process that lets Outlook figure out your mail server settings from just your email address. It depends entirely on a DNS record, specifically a CNAME for autodiscover.yourdomain.com pointing to autodiscover.outlook.com (some registrars use an SRV record instead). This breaks most often right after a domain migration, a switch of DNS/hosting providers, or when an old on-premises Exchange autodiscover record never got cleaned up and is now competing with the cloud one.

Symptoms include new profiles failing to set up automatically, shared mailboxes not appearing, and free/busy calendar lookups failing for other people trying to schedule with you.

A genuinely useful clue most guides skip: if the "new" Outlook for Windows or Outlook on the web connects fine but "classic" Outlook can't set up a profile on the same account, that's not a coincidence - the new Outlook authenticates through a web-based sign-in flow and largely bypasses local Autodiscover DNS lookups, while classic Outlook still depends on them. If you can log in everywhere except classic Outlook, treat that as strong evidence the problem is DNS-related, not account-related.

Fix: verify the CNAME with your domain registrar or DNS host, and use Microsoft's Remote Connectivity Analyzer to confirm what Outlook is actually resolving. DNS changes can take anywhere from a few minutes to 24–48 hours to fully propagate, so don't panic if it's not instant.

5. Your mailbox hit its storage ceiling

Exchange Online enforces mailbox quotas in three stages, and most users have no idea where their number actually sits:

Default limits: Exchange Online Plan 1 gives 50 GB per mailbox; Plan 2 gives 100 GB primary plus 1.5 TB of auto-expanding archive storage; the hidden "Recoverable Items" folder (where permanently deleted mail actually lands) defaults to 30 GB, or up to 100 GB if the mailbox is on legal hold. Worth knowing right now: Microsoft has been rolling out a change through mid-2026 that doubles standard Business plan mailbox storage from 50 GB to 100 GB, but the rollout isn't instant across every tenant, so a mailbox sitting at 49 GB today can still hit its old limit before the new allowance lands. Don't assume you're covered just because you read the increase was coming.

Fix for end users: archive or delete large attachments, empty Deleted Items, and check whether your account has an in-place archive mailbox enabled - moving old mail there doesn't count against your primary quota. Admins can raise the quota manually up to the plan's ceiling via the Exchange admin center or PowerShell.

6. A mail flow rule or spam filter is quietly eating mail

"I'm not receiving emails from one specific person" is a different problem from "email is completely down," and it's diagnosed completely differently. Exchange Online Protection (EOP) assigns every incoming message a Spam Confidence Level (SCL) score; high scores route straight to quarantine instead of the inbox, even for messages that are perfectly legitimate. Invoices with links, marketing-style formatting, and unusual attachments are common false-positive triggers.

The tool that actually answers this: Message Trace, found in the Exchange admin center under Mail Flow, or in the Microsoft Defender portal. Run a trace for the sender/recipient pair in question and you'll see one of two things: the message shows as "Failed" with a specific reason (transport rule, spam filter, quarantine each independently fixable), or there are zero results at all, meaning the message never reached Microsoft's servers in the first place. That second scenario almost always points back to a DNS or MX record problem on the sending or receiving domain, not a spam filter issue.

7. A Conditional Access policy is blocking sign-in outright

Different from the token-loop problem above, this is your organization's security policy actively refusing access, not a technical glitch. Conditional Access can require a compliant, enrolled device; block sign-in from unfamiliar countries or IP ranges; or demand a fresh MFA challenge more often than your session naturally renews. If you traveled recently, got a new laptop, or your device fell out of Intune compliance (a lapsed certificate is a common silent trigger), this is worth checking before you assume something is broken.

8. It's an actual Microsoft outage

It happens, and when it does, it's usually short. Most public Microsoft 365 incidents resolve within a few hours; the ones that stretch longer tend to involve authentication infrastructure or affect multiple services simultaneously (Exchange and Teams going down together, for instance), rather than Exchange Online in isolation. This is genuinely the least likely cause on this list, which is exactly why it's worth ruling everything else out first instead of waiting on a status page refresh.

Fixing It Yourself: The Order That Actually Works

For a regular user without admin access, work through these in order - most people never need to go past step 3:

1. Test outlook.office.com in an incognito browser window. This isolates client vs. account issues immediately (see the diagnostic above).
2. Check your phone's Outlook app. If mail is flowing there, your account and mailbox are fine - the problem is specific to one device.
3. Run Microsoft's Support and Recovery Assistant (SaRA), downloadable at aka.ms/SaRASetup, or the built-in troubleshooters in the Windows "Get Help" app. This is Microsoft's own first-party diagnostic tool - it scans your Outlook configuration, identifies known issues automatically, and can fix a surprising number of them without you touching the registry or a data file directly.
4. Rebuild your Outlook profile if SaRA points to profile or data-file corruption. Your mail lives on Exchange Online's servers, not in the local OST - a rebuild redownloads everything and rarely loses data.
5. Clear stale credentials in Windows Credential Manager if you're stuck in a password/MFA loop, then sign in fresh.
6. If none of that works, hand your IT admin specifics, not vibes. "It's broken" gets you nowhere. "It fails in both classic Outlook and Outlook on the web, my mailbox shows under quota, and I have no inbox rules configured" gets a problem solved in minutes instead of days.

If You Manage the Tenant: Where Admins Should Actually Look First

The order that saves the most time, in practice:

1. Service health (admin center → Health) - rule out a known Microsoft-side incident before touching anything.
2. Message trace for the specific sender/recipient pair - tells you immediately whether the message was quarantined, blocked by a transport rule, or never arrived at all.
3. Domain health (admin center → Settings → Domains) - confirms MX, SPF, and Autodiscover DNS records are present and correctly pointed, especially after any recent domain or hosting changes.
4. Entra ID sign-in logs - filter for the affected user to see whether Conditional Access blocked the sign-in, and why.
5. Microsoft Remote Connectivity Analyzer - an independent, external test of what Autodiscover and Exchange connectivity actually look like from outside your network, useful for catching DNS issues your own machine's cache is hiding from you.

Why Email Works For Some People on Your Team But Not Others

This is the pattern that confuses people the most, because "Microsoft is down" doesn't explain why half the office is fine. A few real explanations:

• Conditional Access policies scoped to a specific security group are common when a company is midway through rolling out a new MFA or device-compliance requirement gradually rather than to everyone at once.
• A newly onboarded employee whose license hasn't finished provisioning or replicating through Entra ID yet - this can take longer than people expect, especially right after a bulk license assignment.
• Mail flow or transport rules targeting a specific distribution list or department, rather than the whole domain.
• Hybrid environments, where some mailboxes still live on-premises and others have migrated to Exchange Online - Autodiscover behaves differently for each, so a fix that works for a cloud-only colleague may not apply to someone on a mailbox that hasn't migrated yet.

If you're troubleshooting a "some people, not others" case, the first question to ask isn't "what's different about the affected user's computer" - it's "what does the affected user have in common with each other, and not in common with everyone else."

Mobile Outlook Not Syncing? Different Rules Apply

If desktop and webmail both work but the Outlook app on your phone doesn't, treat it as a separate problem rather than another symptom of the same one. The most common causes on mobile are unrelated to anything above: aggressive battery-optimization settings on Android killing the app's background sync, notification permissions quietly revoked after an OS update, or, if your company uses Intune/mobile device management a Conditional Access policy specifically requiring an enrolled, managed device that your personal phone no longer satisfies. Re-adding the account from scratch fixes the local sync-state issue; anything permission or policy related needs to be resolved at the OS or MDM level, not by removing and re-adding the mailbox.

Preventing the Repeat: What to Fix Once and Stop Thinking About

• Bookmark the admin center's Service Health page if you have any admin role - it's faster and more specific than any public status tracker.
• Audit legacy authentication now, not in March. If you run scan-to-email devices or old scripts, check Entra sign-in logs for Basic Auth usage before Microsoft's cutover makes the decision for you at the worst possible time.
• Turn on auto-expanding archiving if you're on a plan that supports it, so mailbox quota stops being a recurring fire drill.
• Don't let cached data files grow unchecked if Outlook has felt sluggish for months, that's often the OST quietly bloating toward a corruption event, not just "Outlook being Outlook."
• Document your DNS records outside of Microsoft if you manage a custom domain, so a hosting migration doesn't accidentally wipe your Autodiscover CNAME along with everything else.