Microsoft's outage shows what happens when email is also the recovery plan

What is known, and what is not

The Financial Times reported that Microsoft 365 services, including Outlook, Teams and the Copilot assistant, have been disrupted worldwide since Thursday, with governments, regulators, health services and companies affected. Microsoft's own updates describe a problem that began on Thursday evening, when part of its infrastructure came under elevated load in several regions after servers became unexpectedly unavailable. The company paused deployments and restarted affected servers. Later it said its fixes for a traffic-management problem had not worked as expected and that it was adding capacity.

On Friday the company reported encouraging recovery in Europe, a more stable picture in Japan and improvement in North America, while warning of intermittent problems. A senior executive said there was no indication of malicious or cyber activity. That is a statement about current evidence, not a final root-cause finding, and Microsoft has not yet explained why servers became unavailable or why the first remedies failed. Until it does, claims about the underlying cause, including any link to recent changes or staffing, are speculation.

What the sequence does suggest is a fault in the way load is routed and absorbed, not a single failed component. Restarting servers and adding capacity are standard steps, and the fact that they took more than a day to bite implies the problem fed on itself as traffic shifted between regions.

Why email failing is worse than it looks

The visible costs are real: a Swiss luxury group briefly delayed its half-year results, an airline warned that booking confirmations could be late, and some Japanese financial firms reportedly fell back on fax machines to confirm transactions. The German government said it expected a very big economic impact. None of these has yet been quantified, and a reliable estimate will take weeks.

The deeper issue is structural. Most organisations plan for an IT failure by assuming they can use email and messaging to coordinate the response: to tell staff what to do, reach suppliers and brief regulators. When those tools belong to the failing system, the plan has no communication layer. Steven Murdoch, a security engineering professor at UCL, made this point directly, noting that email is the tool used to co-ordinate recovery from problems.

Public services show the same pattern with different consequences. NHS England said local services were using long-standing measures such as paper records, and an official said no clinical procedures were reported cancelled. That is reassuring, and it also shows what resilience looks like in practice: rehearsed manual fallbacks, not a second cloud account. Organisations without such fallbacks have been improvising.

A concentration problem with a regulatory test attached

This is the latest in a run of outages at dominant suppliers, following disruptions at Cloudflare and Amazon's cloud services last year. Each has prompted the same argument: firms have consolidated onto a single provider for cost and efficiency, and a provider that is dependable most of the time can still impose severe losses when it fails. The economics of consolidation have not changed, so the exposure has not either.

What has changed is the supervisory framework. The UK's Financial Conduct Authority, itself unable to reach its email during the disruption, said it was using its expanded powers over critical third-party suppliers to the financial sector to ask Microsoft to explain the impact. That is among the first practical uses of a regime designed for exactly this scenario. UK defence minister Luke Pollard called for systems that are more resilient and recover faster, and said he expected government cyber officials to be pressing Microsoft on the point.

The European Banking Authority was also affected, which gives European supervisors a direct interest in the answers. Whether those answers are public is an open question. Voluntary post-incident reports have a mixed record; mandatory ones with stated recovery-time expectations would be a more significant step.

What to watch

The first marker is Microsoft's explanation: the trigger, why early fixes failed, and whether any customer data or mail flow was lost or only delayed. A detailed account would let customers judge whether the failure is likely to recur. A vague one would raise the pressure from regulators.

The second is the aftermath of recovery. Delayed mail can arrive in bursts, and security firms warn that criminals may exploit the confusion by offering fixes or assurances. Staff who have been without email for a day are more likely to click on an unexpected message that claims to restore access.

The third is how companies and public bodies respond. Practical measures are modest and cheap by comparison with the cost of an outage: an independent channel for incident communication, a tested manual process for critical functions, and contract terms that give customers a say in resilience. Boards that treat this week as a one-off will find the same dependency waiting for them at the next failure. Those that act on it will have turned a costly disruption into a useful test.