The global Microsoft 365 outage has exposed a critical vulnerability in how organisations operate, exacerbated by rapidly growing interconnectedness and the increasing automation of critical and business as usual activities. The outage is likely to prompt serious discussions among business leaders about organisations’ reliance on digital infrastructure and single technology vendors, and what proportionate resilience measures are needed to prevent further similar disruptions.
While we cannot make an assessment on root cause, this outage highlights the risks created by decades of growing digital dependency on a small segment of technologies and infrastructure critical to business activities and communications. This level of outage across a core business technology was likely inevitable regardless of an accidental or malicious, human or agentic trigger.
In April 2025, Microsoft reported more than 430m paid commercial Microsoft 365 seats. This growth reflects the value organisations have derived from a common digital environment, including greater productivity, lower infrastructure management costs, improved collaboration and access to increasingly sophisticated security capabilities.
The launch of Office 365 in 2011 accelerated the transition from locally managed software and infrastructure to cloud-based services. For many organisations, Microsoft’s services now underpin how employees access systems, communicate with customers, collaborate with colleagues, approve transactions, manage sensitive information and respond to incidents.
These dependencies have accumulated incrementally. Individual decisions to adopt a new collaboration tool, consolidate security services or automate a business process may have made commercial and operational sense. Taken together, however, they have created a level of concentration that many organisations have not fully assessed.
Although AI tools, such as Copilot and agents, have increased productivity and efficiency, they have also driven businesses to rapidly automate manual processes on top of the centralised cloud-based dependency, creating additional business continuity challenges.
Different disruptions, different systems, shared points of failure
This is not a new phenomenon. In July 2024, a faulty software update from US cyber security company CrowdStrike affected an estimated 8.5m Windows devices globally, disrupting airlines, banks, healthcare providers and other critical services. Although the technical circumstances were different, the incident demonstrated how a failure within one widely used technology component can have consequences far beyond the organisation responsible for it.
The current Microsoft outage has not, so far, resulted in the same level of immediate operational disruption as the CrowdStrike outage. The distinction between the two lies in the layer of technology affected and its relationship to critical business operations.
CrowdStrike's faulty software update caused Windows computers and servers to crash at the operating system level, resulting in immediate operational disruption. By contrast, the current Microsoft outage is centred on Exchange Online and its interconnected cloud services. Failures within Microsoft's service infrastructure have disrupted email, collaboration and associated business workflows but many customers' underlying computing infrastructure and specialist operational systems remain functional.
The distinction is not necessarily one of criticality, but of how disruption manifests. CrowdStrike caused immediate operational failures but the Microsoft outage risks creating a more progressive form of disruption as delays to communications, approvals, transactions and decision-making accumulate and begin to affect core business operations.
One of the most important lessons from the Microsoft outage is that having multiple applications, tools or even technology providers is not the same as having genuinely independent and resilient technology capabilities. Organisations may rely on several different applications or suppliers, but if these share underlying infrastructure, identity services or other critical dependencies, a single failure can disrupt multiple business activities simultaneously.
Microsoft 365 is supported by globally distributed infrastructure designed to provide redundancy and high availability. However, geographical distribution does not necessarily protect against failures affecting shared software components, configuration processes or services on which multiple applications depend. Redundancy within a technology ecosystem is not necessarily equivalent to independence from it.
The trigger for the next major digital disruption could be a software defect, human error, malicious activity or an unintended action by an automated or AI-enabled system. Microsoft has reported no indication of malicious activity in the current outage and there is no publicly reported evidence of AI involvement. However, the potential for widespread disruption exists regardless of who, or what, initiates it.
For business leaders, the question is not whether another major digital disruption will occur, but whether their organisations will be better prepared the next time it does.
Could the disruption from the Microsoft outage have been avoided?
Microsoft's eventual investigation will help explain why its technology failed. For business leaders, an equally important question is why a failure in that technology was able to disrupt their own organisation and how it can be avoided or at least better mitigated in the future.
Many organisations have business continuity and disaster recovery plans. However, these have often focused on restoring an organisation's own systems, responding to a cyber attack or managing disruption at a particular location. They may be less effective when an external provider experiences a prolonged, global outage affecting multiple services simultaneously.
The availability of genuine alternatives is also a challenge. Other technology platforms exist, but the ability to move thousands of employees, established workflows, security controls and sensitive corporate data to another environment at short notice is limited. Purchasing an alternative service is not the same as having a functioning alternative operating capability.
The same challenge applies to suppliers. An organisation with effective internal continuity arrangements may still experience significant disruption if its customers, payment providers, logistics partners or other critical third parties depend on the affected infrastructure.
These are not simply technology risks. They are risks to revenue, contractual commitments, regulatory obligations, reputation and, in some cases, the delivery of essential services.
Strategic priorities for business leaders
The immediate response will help organisations manage the current disruption. Reducing the impact of future incidents requires a more strategic approach to digital resilience.
1. Understand where your dependencies concentrate
Organisations need to map their critical business activities against the technology, data, people and third parties that support them.
This should go beyond an inventory of applications and suppliers. Leaders need to understand which services rely on common identity, infrastructure, communications or security capabilities and where a failure could affect several critical activities simultaneously.
2. Define the minimum viable operating model
Business leaders should establish which activities must continue during a significant technology outage, what level of service is acceptable and how long the organisation can tolerate disruption.
For some businesses, maintaining customer communications and access to critical information will be sufficient for a limited period. For others, payments, regulated services, safety-related processes or operational decision-making cannot tolerate prolonged disruption.
These requirements should determine investment in resilience, rather than an ambition to duplicate every existing technology capability.
3. Invest in genuine alternatives
Diversifying technology suppliers can reduce concentration risk, but only if the alternatives are sufficiently independent and can be activated when needed.
Organisations should consider independent emergency communications, protected access to essential records, alternative identity or access arrangements, resilient backups and standalone capabilities for particularly critical business processes.
These arrangements must be proportionate to the business impact of disruption. Maintaining a complete parallel technology environment will be neither practical nor necessary for many organisations. Maintaining an independent capability to deliver essential services may be.
4. Exercise failure across the organisation
Business continuity and crisis management exercises should include scenarios in which multiple services from a major technology provider are unavailable for an extended period.
What would happen if email, collaboration, identity management and access to corporate documents were disrupted simultaneously? Could leadership coordinate the response? Could the organisation continue making payments, managing customers and responding to a separate security incident?
Exercises should test these capabilities in practice, involving business leaders, operational teams, IT, security, procurement and critical third parties.
5. Build resilience into technology and AI investment decisions
Resilience needs to become a more explicit consideration in decisions around technology consolidation, cloud adoption and AI integration.
Business leaders should assess the additional dependencies created by new technologies, establish appropriate controls over automated actions and ensure that critical processes can operate or be recovered when automation fails.
This includes challenging whether the commercial benefits of further integration justify the additional concentration risk and whether adequate safeguards, recovery mechanisms and exit arrangements are in place.
6. Treat digital resilience as a board-level business risk
Organisations cannot outsource accountability for operational resilience to their technology providers.
Boards and executive teams should establish clear ownership of concentration risk, agree tolerances for disruption and ensure that resilience investment reflects the potential business consequences of failure.
Supplier assurance, service-level agreements and regulatory compliance are important, but they are not substitutes for an organisation's demonstrated ability to continue operating when a critical supplier is unavailable.
What does the Microsoft outage say about the future?
Microsoft will restore its services. The wider dependencies that this incident has exposed will remain.
Organisations do not need to abandon the technology ecosystems that have enabled their growth and transformation. However, they do need to recognise where efficiency has created fragility and where the absence of viable alternatives has increased their exposure to disruption.
The measure of digital resilience is not simply how quickly a technology provider can recover. It is how effectively an organisation can continue to operate while it waits.
Control Risks supports organisations in understanding their digital dependencies, monitoring for malicious or benign incidents causing outages, planning for digital disruption scenarios, building and exercising business continuity, crisis management and digital resilience capabilities, and assessing concentration and third-party risks. Find out how we can support your organisation.