Microsoft reports intermittent issues accessing Microsoft Copilot web

Users may be intermittently unable to access Copilot web and other pages that redirect to the m365.cloud.microsoft URL.

The impacted URL is m365.cloud.microsoft and other URLs which redirect to this page, including but not limited to:
– office.com
– portal.microsoft.com

Users may be using URLs such as office.com and the navigation Waffle to access M365 applications in the browser, such as Outlook. For this scenario, when the URL redirects to m365.cloud.microsoft they may experience impact. Users can access M365 applications in the browser direct through the product’s specific URL (eg outlook.office.com).

As a potential workaround, users can use the desktop version of the Microsoft 365 applications. Additionally, users may experience temporary relief by refreshing the cache when trying to access through the browser.

This issue could impact any user attempting to access Copilot web, or a URL which redirects to m365.cloud.microsoft.

07/10/2026 7:40 AM - History of Microsoft Updates:
Jul 10, 2026, 6:49 AM CDT
Jul 10, 2026, 6:07 AM CDT
After further investigations, we’ve confirmed that the Microsoft admin portal (admin.cloud.microsoft) is unaffected. The issue is limited to Copilot web (m365.cloud.microsoft) and other browser pages which redirect to this URL.
We’re continuing to work on a fix that will remove the impacting code which requests the groups claim within the token. We’ll provide a further update shortly with more details on the development and deployment timelines.
Jul 9, 2026, 2:04 PM CDT
Our investigation into the authorization flow has identified that tokens utilized by OAuthentication contain a “groups” claim which includes group memberships for users attempting to authentication. We suspect that due to the inclusion of group memberships, this may be resulting in the generation of larger than expected headers, resulting in impact. We’re working on a fix that would disable or remove the code which requests the groups claim within the token as a potential remediation, and working to confirm a timeline for fix deployment.
Jul 8, 2026, 9:00 PM CDT
We’re analyzing the authorization flow to understand why the generated large headers that are responsible for the associated error message are being created and are determining the next best steps for remediation.
Jul 8, 2026, 8:49 PM CDT
We’re investigating a potential issue with intermittent failures when accessing the Microsoft 365 suite portal and checking for impact to your organization. We’ll provide an update within 30 minutes.

07/10/2026 11:01 AM - Latest update from Microsoft:
 
We are performing final validations to roll back the recent change we suspect is contributing to impact. This change modified the route that back-end service calls take when users access the affected apps. Once the rollback is initiated, we expect it to take approximately one hour to complete. We’ll provide an update as soon as this process has started. In parallel, our investigation into the oversized cookies and the underlying root cause is ongoing. We continue to pursue additional mitigation paths, including a fix to adjust the cookie size to expected thresholds.

07/10/2026 2:36 PM - Latest update from Microsoft: Issue is Resolved-
We completed the traffic rerouting and have confirmed with previously impacted users that impact is now remediated.