On October 12, Exchange Online administrators found themselves locked out of the Exchange Admin Center (EAC) after a configuration change caused administrators to receive “Internal Server Error” messages when attempting to access the web-based management console.
This issue prevented admins from managing Exchange Online resources such as mailboxes and groups, with no workaround available during the disruption. Microsoft first acknowledged the problem at 09:37 UTC and directed affected admins to incident EX1500900 for more information through the Microsoft 365 admin center.
Its engineers traced the failures to unexpected HTTP 302 redirects. Testing then identified a recent EAC configuration change as a potential contributor to the access failures, and Microsoft began rolling it back. For approximately 5.4 hours, admins were unable to access the EAC, until Microsoft identified the faulty change and performed a rollback, which restored access.
Reading our article? Try our product:
Microsoft confirmed that reverting the change restored normal service functionality, and said it is reviewing both the change itself and its monitoring and telemetry systems to improve detection and alerting for similar issues in the future.
A preliminary Post-Incident Report is expected within two business days, with a final report to follow.
The incident added to a growing list of Microsoft service incidents linked to configuration changes, raising concerns about change management and testing processes across Microsoft 365 services.
This isn’t the first EAC outage, either. In April 2025, admins worldwide were blocked from the Exchange Admin Center, with many seeing “HTTP Error 500” errors when trying to log in.
For organizations that depend on Exchange Online, these repeated outages show how much rests on a single cloud management console, and why it pays to plan for the times it isn’t available.
Fortify Your Server with Messageware Security
Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.
Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.
EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.
Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.