Nishant Nekkanty At about 11 a.m. Toronto time on Thursday, November 12, Outlook stopped delivering mail. Within the hour, Teams meetings were dropping, Copilot was unresponsive, and IT teams who went to check device status in Intune found they could not get in either. For most offices in the GTA, that was the middle of a normal working day, and it stayed broken well into Friday.
Microsoft says it was not a cyberattack, and it has not yet published a full root cause. But you do not need the root cause to learn from it. Here is what the outage taught us, and what we are changing with clients because of it.
The short answer: the outage proved that for most mid-sized businesses, Microsoft 365 is a single point of failure for email, meetings, files, security tooling and device management all at once. You cannot prevent a Microsoft outage, but you can decide in advance how your people will communicate, what your IT team can still do, and how long the business can run without it.
Moving off Microsoft is not the lesson. The lesson is that your continuity plan probably assumes your office or server fails, not your cloud provider. Add three things: a way to reach staff that does not run on Microsoft 365, offline copies of your critical runbooks and contacts, and a written decision on what the business does at the 2-hour, 8-hour and 24-hour mark.
Cloud concentration risk
Cloud concentration risk is the exposure a business takes on when many critical functions (email, chat, file storage, identity, security and device management) depend on a single cloud provider. When that provider has an outage, all of those functions fail together instead of one at a time.
What happened in the November 2026 Microsoft outage?
Problems began at about 16:00 GMT on Thursday, November 12 (11 a.m. Eastern). Outlook was hit hardest across web, desktop and mobile. Copilot was disrupted, and according to TechCrunch, Defender, Intune admin dashboards and some Cloud PCs were affected as well.
Microsoft described a large number of servers becoming “unexpectedly unavailable” and said there was no evidence of malicious activity. By Friday it was rolling back a network change, though it had not said whether that change was the cause. More than 12 hours in, Microsoft reported only “marginal success” restoring service.
74
Countries and territories that logged Outlook, Teams and Copilot problem reports on Downdetector within about an hour (Al Jazeera, Nov 13 2026)
~18 hrs
Approximate downtime before traffic began returning to Microsoft’s services, per network analyst Doug Madory of Kentik (TechCrunch, Nov 13 2026)
This was also not a one-off. It follows a January 2026 Microsoft 365 outage that lasted nearly 10 hours across North America. Two major multi-hour incidents in one year is enough to plan around.
Lesson 1: Is Microsoft 365 a single point of failure for your business?
For most companies with 50 or more staff, yes. Email, Teams, SharePoint and OneDrive files, sign-in, endpoint security and device management very often all come from the same Microsoft tenant. On November 12 several of those failed at the same time, which is very different from losing one tool.
Consolidating on Microsoft 365 is still the right call for most businesses: it is cheaper, more secure and easier to manage than a patchwork of vendors. The trade-off is that you have concentrated your risk, so your continuity planning has to account for it. Map which business functions depend on the tenant and you will usually find the list is longer than expected.
| Business function | Typical Microsoft dependency | Fallback to have ready |
|---|---|---|
| Staff communication | Teams, Outlook | SMS or phone tree, conference bridge from a different provider |
| Customer contact | Outlook shared mailboxes | Phone lines and a holding message on the website |
| Files and documents | SharePoint, OneDrive | Locally synced copies of critical files on key devices |
| Device management | Intune | Offline runbook and a list of who has local admin access |
| Security monitoring | Defender | Independent monitoring (firewall logs, MDR provider) |
Lesson 2: How do you reach staff when Teams and Outlook are down?
You need a communication channel that does not run on Microsoft 365, set up before the outage. If your only way to tell 150 people “email is down, here is what to do” is an email or a Teams post, you have no way to tell them.
The simplest version is a current list of staff mobile numbers held outside the tenant, and a group SMS or phone tree that a manager can trigger. Add a conference bridge from a different provider for leadership, and decide in advance who sends the first message and what it says.
Write the first message now, while nothing is broken. Something like: “Microsoft email and Teams are down across the world. This is not a problem with our systems. Use phones for urgent client contact. Next update by [time].” A pre-approved message gets sent in five minutes instead of after a 40-minute discussion.
Lesson 3: Can your IT team still work when the admin portals are down?
Often not as much as you would think. During this outage, administrators reported being unable to reach Intune dashboards. The tools you would use to diagnose and respond were part of the outage.
The fix is unglamorous: keep the critical information somewhere that does not depend on Microsoft. That means an offline or printed copy of your incident runbook, vendor support numbers, your Microsoft tenant ID and support contract details, and emergency (break-glass) admin account procedures. If your runbook lives only in SharePoint, it went down with everything else.
Do not “fix” an outage by loosening security. When sign-in is flaky, it is tempting to switch off MFA or relax Conditional Access to get people working. That does not fix a provider outage, and it is easy to forget to switch back on.
Lesson 4: Does a non-cyberattack outage still create security risk?
Yes. Microsoft said there was no sign of malicious activity, but large public outages are a gift to phishing crews. Expect emails and texts pretending to be Microsoft “service restoration” notices, fake password reset links, and calls from people claiming to be Microsoft support.
Tell staff plainly: Microsoft will not email, text or phone them individually about this outage, and IT will not ask for passwords. Also note that with Defender affected, some of your usual security screening may have been degraded for part of the outage. That is a good reason to have monitoring that does not depend on the same vendor, such as firewall logging or an independent managed detection and response service.
Lesson 5: Does your disaster recovery plan cover a cloud provider outage?
Most do not. Traditional disaster recovery plans are written for a fire, a flood, a ransomware attack or a failed server: something that happens to you, where you control the recovery. In a provider outage you control none of the recovery. Your plan is about how the business keeps working while you wait.
Do not count on the SLA to cover the cost either. Microsoft’s Service Level Agreement for Online Services pays out in service credits against your subscription, not compensation for lost productivity or lost sales. The commercial risk of a day without email sits with you.
Here is the short framework we use to add a provider outage to a client’s continuity plan:
List what runs on the tenant: Every business function that stops if Microsoft 365 stops, including the less obvious ones like scanners that email documents, phone systems tied to Teams, and line-of-business apps that sign in with Microsoft accounts.
Set decision points at 2, 8 and 24 hours: Decide now what happens at each. At 2 hours: staff message, switch client contact to phones. At 8 hours: notify key clients, defer deadlines. At 24 hours: leadership call on contractual or regulatory notifications.
Build the out-of-band kit: Staff phone list, SMS or call tree, alternate conference bridge, offline runbook and vendor contacts, all stored outside Microsoft 365.
Assign owners: Name who declares the incident, who sends the staff message, who talks to clients, and who watches the Microsoft service status page for updates.
Run it once a year: A 30-minute tabletop exercise (“it is 11 a.m. and Outlook and Teams are down, what do we do?”) will surface the gaps faster than any document review.
Should you move away from Microsoft 365 after this outage?
For almost every mid-sized business, no. Every major cloud provider has outages, and running a second, parallel email and collaboration platform costs far more than the occasional bad day it would protect you from. Switching vendors swaps one concentration risk for another.
The better investment is resilience around the platform: the out-of-band communication plan, offline runbooks, independent security monitoring, and a tested continuity plan. That is a few days of work, not a migration project, and it pays off the next time any vendor you depend on goes down.
The November 12 outage was Microsoft’s problem to fix, but how long your business stood still was yours. Companies that had a backup way to reach staff, offline runbooks and pre-agreed decision points lost hours of convenience. Companies without them lost a day of work. Use this outage as the reason to close that gap before the next one.
If you want a second set of eyes on how your business would handle the next one, our team can review your Microsoft 365 setup and your backup and disaster recovery plan together, and give you a short list of what to fix first. An incident readiness workshop is also a practical way to run the tabletop exercise above with your leadership team.
Sources
- Microsoft hit by global outages: What happened and why?, Al Jazeera, 2026
- Microsoft’s latest email outage turned into a full-blown global cloud crisis, TechCrunch, 2026
- Microsoft 365 outage drags on for nearly 10 hours, The Register, 2026
- Service Level Agreements for Online Services, Microsoft, 2026
- Microsoft Cloud service status, Microsoft, 2026
Paul Thresher 
