Microsoft is working to resolve an ongoing Exchange Online issue that has been mistakenly
It started on a Sunday. Not the kind of Sunday you sleep in. The kind where your calendar’s empty because your emails vanished—and everyone who tried to reach you got a ghostly NDR instead.
Microsoft’s Exchange Online team is scrambling to fix incident EX1436407, which since July 19 has locked users out of their own mailboxes. Not because they clicked a bad link. Not because they broke a policy. But because a routine infrastructure change triggered a runaway memory spike—and the system, designed to protect, panicked and quarantined everyone.
Users can’t receive mail. Senders get slapped with Non-Delivery Reports. Calendars? Frozen. For some, it’s been four days. And still, Microsoft hasn’t said who’s affected, how many, or when it’ll be fixed.
This isn’t the first time. Not even close.
Back in March 2025, an anti-spam filter started eating legitimate emails. May? A machine learning model decided Gmail was spam. September? A URL-blocking rule in Exchange and Teams turned every link into a threat. February 2026? Thousands of real URLs got flagged as phishing. Each time, Microsoft called it a "bug." Each time, they fixed it. And each time, the same underlying flaw stayed: automation at scale, with no human oversight.
Now? Same script. New version.
The cleanup’s moving. From 66% to 72% of the junk indexing data cleared by Wednesday evening. Mailboxes are being released region by region, as memory pressure eases. But that’s not a timeline. That’s a progress bar with no finish line.
And here’s the real question: Why are we still surprised?
We treat cloud services like magic. You press a button, and email works. But magic doesn’t scale. It breaks. And when it does, you don’t get a call. You get a dashboard update.
This isn’t just about Exchange. It’s about the illusion of reliability. We’ve outsourced our core communications to a system that can’t tell the difference between a spammer and a client’s invoice. And when it messes up? We’re left guessing.
I’ve seen this before. In 2018, a firewall update took down a hospital’s patient portal. The vendor said it was "an edge case." It wasn’t. It was a design flaw. Same here.
Admins? Monitor the Service Health Dashboard. Tell your team to expect delays. Prepare fallback channels—Slack, Teams, even phone calls. But don’t wait for Microsoft to fix this. They’re not fixing the system. They’re just cleaning up the mess.
And if you’re still trusting your business email to a black box that can’t explain why it locked you out? You’re not being secure. You’re being naive.
We don’t need better detection. We need less automation. And more accountability.
Next update’s Thursday at 6 p.m. UTC. I’ll be watching. You should too.
What actually triggered the quarantine? The infrastructure change no one saw coming
The root cause? A routine, automated infrastructure update—something that’s happened a hundred times before without incident. This time, it triggered a cascade.
According to Microsoft’s internal alert (EX1436407), the change caused "excessive memory consumption from unexpected indexing data." That’s the technical version. The real story? A background process meant to optimize search indexing got stuck in a loop, chewing up RAM like a drunk at an all-you-can-eat buffet. When memory hit critical levels, the system’s safety protocol—designed to protect against spam overload—panicked. It didn’t diagnose the cause. It didn’t pause the process. It just... quarantined everything. Every mailbox. Every calendar. Every inbound message.
It’s not a bug. It’s a design failure.
The system was built to react to spam volume, not to memory pressure. It saw "too much data" and assumed "malicious activity." It’s the same logic that once flagged Gmail as spam because the sender’s IP was shared with a known botnet. Same logic that blocked legitimate URLs in September because a heuristic rule misread a PDF attachment as a credential phishing payload.
We keep building systems that punish the innocent to catch the guilty. And we’re shocked when they fail.
Microsoft confirmed this is a recurrence of EX1434354—a similar incident from last year. They patched the symptom. They didn’t fix the architecture.
And now? We’re watching it happen again.
The cleanup’s at 72%. That’s progress. But it’s not resolution. It’s triage.
Every mailbox being restored is a bandage. The wound? Still open.
The pattern is clear. The fix isn’t.
This isn’t the first time Exchange Online has flipped its own switch.
March 2025: Anti-spam filters started swallowing real emails. Microsoft blamed a "configuration drift." They rolled back. Three weeks later, it happened again.
May 2025: A machine learning model trained on phishing patterns decided Gmail was spam. Why? Because the sender’s IP was shared with a known botnet. The model didn’t know Gmail’s IPs are shared by millions of legitimate users. It didn’t care. It just flagged.
September 2025: Exchange and Teams users couldn’t open links in emails. A heuristic rule flagged any attachment with a .pdf extension as a credential phishing attempt. Turns out, every HR department sends payroll PDFs. Every vendor sends invoices. Every lawyer sends contracts. All blocked.
February 2026: Another heuristic update. This time, it flagged 12,000 legitimate URLs as phishing because they contained the word "login" in a query string. Microsoft said they "reduced false positives." They didn’t fix the logic. They just lowered the sensitivity.
And now? July 2026. Memory pressure triggers a quarantine. Not because of spam. Not because of malware. Because the system panicked.
Each time, the same pattern: automation without context. Detection without understanding. Response without accountability.
Microsoft treats these as isolated bugs. They’re not. They’re symptoms.
The system was never designed to handle uncertainty. It was designed to assume certainty—and punish anything that breaks the script.
We’ve built a cloud that can’t admit it’s wrong.
And we wonder why users lose trust.
What you can do while Microsoft plays cleanup
Let’s be clear: Microsoft isn’t going to fix this in the next 48 hours. They’re cleaning up the mess. They’re not fixing the architecture.
So what do you do?
- Monitor the Service Health Dashboard like your business depends on it—because it does.
The dashboard isn’t a luxury. It’s your early warning system. If you’re waiting for an email from Microsoft, you’re already too late.
- Prepare fallback channels. Now.
If your team can’t send or receive email, how do they communicate? Slack? Teams chat? Phone? Text? Pick one. Test it. Make sure everyone knows how to use it. Don’t wait until the outage hits.
- Review your quarantined mailboxes.
Use the Exchange Admin Center to check what’s been flagged. Don’t assume it’s spam. It might be your CFO’s invoice. Your client’s proposal. Your payroll file. Restore them manually if you’re certain they’re clean.
- Audit your automation rules.
Do you have any mail flow rules that auto-quarantine based on sender, attachment type, or URL? Disable them. Temporarily. Until this blows over. You’re not being paranoid. You’re being smart.
- Stop pretending the cloud is magic.
You didn’t buy a service. You bought a dependency. And dependencies break. Especially when they’re built on systems that don’t understand context.
This isn’t about Exchange. It’s about how we think about security.
We’ve outsourced our trust to black boxes that can’t explain why they locked us out.
And we wonder why we’re always surprised when they fail.
We need less automation. More visibility. And someone—anyone—who takes responsibility when things go wrong.
Until then? Stay vigilant. And don’t wait for Microsoft to save you.