The Azure AD MFA Outage of November 2018: When Sign-In Itself Goes Down

Retrospective: this article looks back at events from November 2018, written in 2026 with the benefit of hindsight.

On November 19, 2018, Azure Active Directory's multi-factor authentication service suffered a major outage. For much of a working day, many users in Europe, Asia and the Americas could not complete MFA and were unable to sign in to Office 365 and other services that required it.

What happened

Microsoft's post-incident report traced the outage to a combination of issues in the MFA backend, including a code change and a latent bug that caused resource exhaustion under load. Retries made the problem worse. Recovery took several hours.

Why it mattered

Organizations had been told — correctly — to require MFA for everyone. The outage showed the other side: when the identity provider's MFA fails, everything protected by MFA fails with it. Companies with no emergency access plan were locked out of their own administrative portals.

Lessons in hindsight

• Emergency access (break-glass) accounts are essential. At least two cloud-only accounts, excluded from MFA-dependent Conditional Access policies but protected in other ways, let administrators respond during an outage.
• Do not weaken security permanently in response. Disabling MFA during an outage is understandable; forgetting to re-enable it is not.
• Identity is critical infrastructure. It deserves an outage runbook like any other.
• Resilience features matter. Microsoft later added a backup authentication service to keep existing sessions working during certain outages.

In hindsight

Identity provider outages have continued across vendors. The 2018 MFA outage is why every Microsoft 365 security baseline now includes break-glass accounts — and why the best plans protect those accounts with phishing-resistant FIDO2 keys rather than simply excluding them from all controls.