Business continuity and resilience professionals need little introduction to concentration risk. The prolonged Microsoft 365 outage, which is still ongoing at the time of writing, nevertheless brings home what the term means in practice: organizations around the world depending on the same supplier’s ubiquitous services, with very limited control over recovery when shared infrastructure fails.
By Microsoft’s 07:29 UTC update on 13 November, disruption was continuing into a second day, more than 15 hours after the recorded start of the Exchange Online incident. Microsoft reported encouraging results from a patch, but restoration remained incomplete. A multi-region incident lasting this long is an exceptional disruption that challenges the usual assumptions that an organization of Microsoft’s strength will be able to achieve rapid recovery from downtime.
The breadth of the impact brings home the reality of concentration risk. Dependencies on Exchange Online affected functions across collaboration, security, compliance, and AI services. Core Teams calls and chats, and direct access to SharePoint files, remained available. Nevertheless, the incident demonstrates how apparently separate applications can share dependencies that allow one failure to disrupt multiple business activities.
Immediate resilience options are limited. An organization cannot simply transfer its integrated Microsoft environment to another provider during an outage. Where alternative arrangements have not been prepared, the practical response is to use surviving functions, invoke manual workarounds, and wait.
Some organizations have a different exposure. Smaller businesses using independently hosted IMAP email can retain mailbox access, while organizations using Google Workspace can continue activities supported by that platform, provided access does not depend on affected Microsoft services. The protection comes from independent infrastructure, rather than IMAP itself: IMAP can also connect to Microsoft-hosted mailboxes. Neither group is insulated from delays involving affected customers, suppliers, or other partners.
Crises within a crisis
The outage also highlights a lesson about ‘crises within a crisis’. An organization managing a separate incident during the outage could have found its response hampered if it relied on Outlook for crisis communications. Organizations hosting business continuity plans in SharePoint seem to have been lucky, this time, with direct access to SharePoint files apparently remaining available in this incident, but the wider question still applies: how would incident managers cope if the platform holding their business continuity plans became inaccessible?
Business continuity plans therefore need their own continuity arrangements. Independent communication and storage channels, current offline copies of plans and contact lists, and exercises that assume the usual response tools are unavailable should be considered. A plan that depends on the same services that it is intended to help the organization cope without has an obvious flaw!
Future resilience for concentration risk
The more difficult question will come after the Microsoft restoration. Will organizations consider backup platforms for future failover, or will they place prolonged cloud outages in the ‘too difficult’ box and accept the consequences?
For many, the latter will be the likely decision. Maintaining alternative platforms brings costs, administrative demands, and complexity, including complications around data, security, and staff familiarity. Integration delivers substantial everyday benefits, while the value of an alternative will remain largely invisible until it is needed.
But the choice need not be between duplicating the entire technology estate and accepting complete dependence. A proportionate fallback might preserve independent crisis communications, access to essential information, and a limited set of critical activities. It must be prepared and exercised: another subscription alone is not a usable business continuity capability.
The responsibility of business continuity and resilience professionals is to make that decision explicit. Which activities can stop, for how long, and with what consequences? What would a workable fallback cost, and who has authority to accept the remaining exposure?
For many organizations, the answer may still be the ‘too difficult’ box. That should follow an informed assessment and an accountable decision. When a supplier’s services become integral to everyday operations, accepting its recovery timetable is itself a resilience choice.
The author
David Honour is editor of Resilience Forward.
Industry comments on the Microsoft outage
Comments sent to Resilience Forward include:
Simon Azzopardi, CEO of CoreView
“The delay in tracing the Microsoft outage to a configuration change is noteworthy. Early on, Microsoft said that no recent change correlated with the impact. Several hours later, however, it reported that a network configuration change did correlate with the outage. If an organization with Microsoft’s resources and telemetry needs that long to connect a change to its impact, most businesses will struggle to understand what changed in their tenant and when.
“Businesses can’t control Microsoft’s infrastructure. But they can control their own tenant. That means knowing exactly how it is configured, tracking every change made to it, and being able to restore it to a known good state quickly.
“As services recover, IT teams should do three things. Confirm that security and compliance controls such as data loss prevention, sensitivity labelling, and Intune compliance policies are working as intended. Review every emergency change made during the outage, because workarounds made under pressure tend to become permanent gaps. And treat delayed email with extra caution: Microsoft warned that Safe Links might not be able to check URLs during the disruption, and attackers routinely use outages as cover.”
“Our sympathy goes out to every IT team that has spent their time keeping their organization running without email, calendars and, in many cases, their security and compliance tools.”
Aiden Sinnott, Principal Threat Researcher at Sophos Counter Threat Unit
“Although the Microsoft outage is not a cyber security issue, bad actors will be looking to take advantage of concerned individuals, offering a resolution or assurances. At this time, even more so than usual, people should exercise caution when receiving emails, texts or calls purporting to be from Microsoft or other affected businesses, particularly banks or shops. Be aware of requests for urgent action, sharing of personal information and avoid clicking on links sent via message or email.”
