Business continuity and resilience professionals need little introduction to concentration risk. The prolonged Microsoft 365 outage, which is still ongoing at the time of writing, nevertheless brings home what the term means in practice: organizations around the world depending on the same supplier’s ubiquitous services, with very limited control over recovery when shared infrastructure fails.
By Microsoft’s 07:29 UTC update on 13 November, disruption was continuing into a second day, more than 15 hours after the recorded start of the Exchange Online incident. Microsoft reported encouraging results from a patch, but restoration remained incomplete. A multi-region incident lasting this long is an exceptional disruption that challenges the usual assumptions that an organization of Microsoft’s strength will be able to achieve rapid recovery from downtime.
The breadth of the impact brings home the reality of concentration risk. Dependencies on Exchange Online affected functions across collaboration, security, compliance, and AI services. Core Teams calls and chats, and direct access to SharePoint files, remained available. Nevertheless, the incident demonstrates how apparently separate applications can share dependencies that allow one failure to disrupt multiple business activities.
Immediate resilience options are limited. An organization cannot simply transfer its integrated Microsoft environment to another provider during an outage. Where alternative arrangements have not been prepared, the practical response is to use surviving functions, invoke manual workarounds, and wait.
Some organizations have a different exposure. Smaller businesses using independently hosted IMAP email can retain mailbox access, while organizations using Google Workspace can continue activities supported by that platform, provided access does not depend on affected Microsoft services. The protection comes from independent infrastructure, rather than IMAP itself: IMAP can also connect to Microsoft-hosted mailboxes. Neither group is insulated from delays involving affected customers, suppliers, or other partners.
Crises within a crisis
The outage also highlights a lesson about ‘crises within a crisis’. An organization managing a separate incident during the outage could have found its response hampered if it relied on Outlook for crisis communications. Organizations hosting business continuity plans in SharePoint seem to have been lucky, this time, with direct access to SharePoint files apparently remaining available in this incident, but the wider question still applies: how would incident managers cope if the platform holding their business continuity plans became inaccessible?
Business continuity plans therefore need their own continuity arrangements. Independent communication and storage channels, current offline copies of plans and contact lists, and exercises that assume the usual response tools are unavailable should be considered. A plan that depends on the same services that it is intended to help the organization cope without has an obvious flaw!
Future resilience for concentration risk
The more difficult question will come after the Microsoft restoration. Will organizations consider backup platforms for future failover, or will they place prolonged cloud outages in the ‘too difficult’ box and accept the consequences?
For many, the latter will be the likely decision. Maintaining alternative platforms brings costs, administrative demands, and complexity, including complications around data, security, and staff familiarity. Integration delivers substantial everyday benefits, while the value of an alternative will remain largely invisible until it is needed.
But the choice need not be between duplicating the entire technology estate and accepting complete dependence. A proportionate fallback might preserve independent crisis communications, access to essential information, and a limited set of critical activities. It must be prepared and exercised: another subscription alone is not a usable business continuity capability.
The responsibility of business continuity and resilience professionals is to make that decision explicit. Which activities can stop, for how long, and with what consequences? What would a workable fallback cost, and who has authority to accept the remaining exposure?
For many organizations, the answer may still be the ‘too difficult’ box. That should follow an informed assessment and an accountable decision. When a supplier’s services become integral to everyday operations, accepting its recovery timetable is itself a resilience choice.
The author
David Honour is editor of Resilience Forward.
