Friday the 13th, When the Cloud Goes Dark

And When Microsoft 365 Took an Unplanned Holiday

One of the world’s most trusted cloud platforms went down, leaving businesses scrambling. Does this shake our faith in cloud computing, or simply remind us that even the cloud needs a backup plan?

There is something about Friday the 13th that makes people a little uncomfortable. Whether you believe in superstition or not, it has long been associated with bad luck.

Outlook stopped cooperating. Emails refused to travel. Microsoft Teams and other services experienced disruptions. For many organisations, it felt as though someone had pulled the plug on their digital workplace.

And unfortunately, the IT department did not have a spare plug!

Jokes aside, this was a serious incident with significant consequences for businesses relying on Microsoft’s cloud ecosystem.

I experienced it firsthand.

As an IT leader supporting business operations across multiple countries, I have dealt with my share of infrastructure failures, connectivity problems and application outages. But this incident was particularly frustrating.

For nearly 15 hours, our users, from Mexico to Singapore, were unable to send or receive emails. Microsoft was investigating the problem, but there was no reliable recovery timeline to share with the business.

Our internet connections were working. Our internal systems were functioning. Yet one of our most important communication channels had effectively disappeared.

And there was very little our IT team could do to restore it.

It raised an uncomfortable question:

We moved to the cloud to improve reliability. So what happens when the cloud itself fails?

What happened to Microsoft 365?

The disruption began early morning in Friday the 13th, Singapore time and continued through out the day, affecting Microsoft 365 services across multiple regions.

Exchange Online, the cloud platform behind business email, was at the centre of the disruption.

Users reported difficulty accessing mailboxes, sending and receiving messages, and connecting through Outlook. Other Microsoft services also experienced varying degrees of disruption.

According to Microsoft’s incident communications, the problems were associated with network infrastructure changes and capacity-related issues.

Engineers worked to restore connectivity, redistribute traffic and stabilise the affected services.

Recovery was gradual.

Even after access began returning, some users continued experiencing delays in sending and receiving emails as systems worked through accumulated messages.

For our organisation, service largely recovered by Friday evening, although some delays persisted.

The incident demonstrated how interconnected modern cloud services have become.

We often think of Outlook, Teams, SharePoint and other Microsoft 365 applications as separate products.

But many of these services rely on shared infrastructure, authentication systems and underlying network components.

When an important component experiences problems, the consequences can extend well beyond one application.

The bigger concern: Communication and accountability

Technology failures happen.

Even the most sophisticated infrastructure cannot guarantee absolute availability.

What distinguishes a good technology provider is not simply how quickly it restores service, but how transparently it communicates during a crisis.

Throughout the incident, Microsoft’s engineering and support teams provided periodic updates through the Microsoft 365 Service Health Dashboard and public communication channels.

Microsoft also apologised for the disruption.

Charles Lamanna, Microsoft’s Executive Vice President for Copilot, Agents and Platform, publicly acknowledged the incident and expressed regret.

These acknowledgements deserve recognition.

However, I believe a disruption of this magnitude warrants more visible engagement from the company’s highest leadership.

At the time of writing, I could not verify a separate public statement from Microsoft’s CEO, Satya Nadella, addressing the outage.

When a platform supports millions of businesses, public institutions and essential services, a major outage becomes more than a technical problem.

It becomes a matter of customer confidence.

Customers do not expect executives to personally troubleshoot network configurations. They do, however, expect visible accountability, reassurance and a clear commitment to preventing similar failures.

There is an interesting contrast here.

When Microsoft 365 fails, IT leaders across thousands of organisations must explain the situation to their management and employees.

We are expected to communicate promptly, provide updates and take responsibility for maintaining business continuity, even when the failure is completely outside our control.

I believe it is reasonable to expect the same standard of communication from our technology providers.

Does this mean the cloud has failed us?

Whenever a major cloud outage occurs, someone inevitably asks:

Wouldn’t we be better off running our own servers?

Having worked with both traditional on-premises infrastructure and cloud environments, my answer is a firm No.

Cloud computing remains one of the most important technological developments for modern businesses, particularly small and mid-sized organisations.

Consider what a company would need to build to approach the capabilities offered by Microsoft 365.

Multiple geographically distributed data centres, redundant power supplies, high-speed network connections, backup infrastructure, security monitoring, disaster recovery facilities and teams of specialised engineers working around the clock.

The investment would be enormous.

And even after spending that money, the organisation would still face hardware failures, software defects, cyberattacks, configuration mistakes and connectivity problems.

Cloud computing makes sophisticated infrastructure and operational capabilities accessible to organisations that could never justify building them independently.

Why the cloud remains compelling

Redundancy and resilience: Major cloud providers operate infrastructure with multiple layers of redundancy. This does not eliminate outages, but it offers protection that smaller organisations would struggle to reproduce economically.

Cost efficiency: Businesses avoid substantial upfront investments in servers, storage, data centres and supporting infrastructure. They can redirect capital and IT resources towards activities that create business value.

Scalability and elasticity: Organisations can expand or reduce resources as requirements change. Some services automatically adjust computing capacity based on demand, while others can be scaled through configuration or licensing changes.

Security and maintenance: Cloud providers invest heavily in infrastructure protection, monitoring, patching and specialist expertise. Customers still remain responsible for managing identities, access controls and their own data.

Global accessibility: Employees working across different countries can securely access common applications without requiring businesses to maintain complex infrastructure in every location.

For an organisation operating across several countries, these capabilities are particularly valuable.

Rather than maintaining separate email and collaboration environments across multiple offices, we can provide users with a common, centrally managed platform.

The advantages are substantial.

One major outage does not invalidate them.

The cloud is not unreliable simply because it occasionally fails. But we would be unwise to assume that it can never fail.

The misunderstanding about cloud availability

Microsoft offers service-level commitments for its cloud services, with Exchange Online commonly associated with a 99.9% availability commitment.

That sounds reassuring.

But 99.9% is not 100%.

Over a 30-day month, the difference represents approximately 43 minutes of downtime.

More importantly, service-level commitments are not promises that every incident will be resolved within that period.

Actual availability is measured using specific contractual definitions, including the scope and duration of disruption experienced by affected users.

And even when a provider fails to meet its commitment, the consequences for customers can be far greater than the subscription fees involved.

Imagine a trading company unable to transmit important shipping documents, confirm orders or communicate with customers.

A few hours of lost connectivity can disrupt transactions, delay shipments and damage customer relationships.

A subscription service credit, where applicable, cannot necessarily compensate for those operational consequences.

This is why businesses need to distinguish between two responsibilities.

Service availability is largely the provider’s responsibility. Business continuity remains ours.

Business continuity does not have to cost a fortune

A common misconception is that resilience requires maintaining a complete secondary infrastructure.

For most small and mid-sized businesses, that would be impractical and unnecessarily expensive.

The objective should not be to duplicate everything Microsoft provides.

It should be to identify the few services and processes that absolutely must continue during an outage.

A practical continuity strategy can be surprisingly affordable.

1. Establish an independent communication channel

Start with the simplest question.

If Outlook and Teams become unavailable tomorrow, how will employees communicate?

Businesses should maintain an approved emergency communication channel independent of Microsoft 365.

This could be a secure messaging platform, an independently hosted communication service or an emergency notification system.

The key is independence.

An alternative platform that relies entirely on Microsoft Entra ID for authentication may also become inaccessible during a broader Microsoft identity outage.

The system should be configured, documented and periodically tested.

2. Consider an email continuity service

For organisations where email is mission-critical, an independent email continuity solution is worth evaluating.

Providers such as Mimecast, Proofpoint Essentials and Barracuda offer products or service packages with email continuity capabilities.

Depending on the solution, these services may accept incoming mail while Exchange Online is unavailable, queue messages for later delivery or provide emergency inboxes that users can access independently.

Some solutions also support sending messages during an outage.

The capabilities vary considerably, so businesses should distinguish between simple email queuing and full emergency mailbox functionality.

A continuity service can provide meaningful protection without requiring the organisation to build a second Exchange environment.

However, it introduces an additional subscription cost and another service provider to manage.

3. Maintain emergency email addresses

For smaller organisations with limited budgets, a handful of emergency mailboxes hosted with an independent provider may be sufficient.

For example, a company could maintain a separate domain with emergency addresses for sales, logistics, finance and management.

These addresses would not replace the primary email system.

Instead, they would provide a fallback channel for important business communications.

Employees should know when to activate them, and critical customers and suppliers should have a trusted way to verify the alternate addresses.

This last point is important. Unexpected changes to business email addresses can resemble phishing or payment-redirection scams.

Emergency communication arrangements must therefore include a clear verification process.

4. Keep essential information accessible

Cloud applications make it wonderfully convenient to store everything centrally.

But convenience can also create dependency.

Imagine that your emergency contact list, business continuity procedures and critical transaction documents are all stored in SharePoint.

If SharePoint becomes inaccessible during a broader outage, your continuity plan may become inaccessible precisely when you need it.

Organisations should identify essential information and maintain securely protected copies in locations that do not depend on the same infrastructure.

This could include selected contact lists, customer and supplier details, shipping schedules, operational procedures and critical business records.

The objective is not to duplicate the entire company’s data.

It is to preserve access to the information necessary to continue essential activities.

5. Conduct a simple outage simulation

Perhaps the most valuable improvement costs almost nothing.

Conduct a short business continuity exercise.

Assume that Outlook and Teams are unavailable for an entire working day.

How would employees communicate?

Which business transactions would stop?

Could customers still reach key departments?

Who would authorise emergency arrangements?

Would staff know where to find the relevant procedures?

The answers may reveal more about an organisation’s resilience than an expensive disaster recovery system.

Choosing the right level of protection

Not every organisation requires the same continuity arrangements.

A small professional services firm with 20 employees will have very different requirements from an international trading company with hundreds of users.

I would recommend a simple, risk-based approach.

Business requirement	Practical continuity measure
Basic emergency communication	Independent messaging and contact lists
Critical departmental email	Secondary domain and selected mailboxes
Business-wide email continuity	Dedicated email continuity service
Essential documents and procedures	Secure independent or offline copies
High operational dependency	Tested continuity plans with assigned responsibilities

The intention is not to eliminate all risk.

That would be neither realistic nor economical.

Instead, businesses should evaluate how much disruption they can tolerate, which activities are most critical and how much they are prepared to invest to protect those activities.

Sometimes, a few carefully chosen safeguards can make a substantial difference.

What about compensation for the outage?

There is one more point worth mentioning.

Microsoft’s online services are governed by Service Level Agreements, which may provide service credits when availability falls below contractual commitments.

Businesses using Microsoft 365 Business Basic, Business Standard, Business Premium or standalone Exchange Online subscriptions may be eligible, depending on the affected service and applicable agreement.

However, these credits are generally not automatic and do not necessarily cover financial losses or the entire Microsoft 365 subscription.

I have covered the eligibility rules, possible service-credit percentages, evidence requirements and claim process in a separate article:

Microsoft 365 Went Down. Can Your Business Claim Compensation? A Practical Guide for SMBs.

Businesses affected by the November outage should review their contractual rights and applicable claim deadlines promptly.

The real lesson from Friday the 13th

Despite the inconvenience and frustration of this incident, my confidence in cloud computing remains strong.

Microsoft 365 continues to provide tremendous value through its security capabilities, operational efficiency, global accessibility, scalability and sophisticated infrastructure.

For most small and mid-sized businesses, recreating these capabilities independently would be economically unrealistic.

But cloud adoption does not mean we can stop thinking about business continuity.

In fact, as organisations become increasingly dependent on cloud platforms, understanding those dependencies becomes even more important.

We need to ask better questions.

What happens if our primary email platform becomes unavailable?

Can employees continue communicating?

Can our critical business processes operate temporarily without the usual applications?

And do we have a plan that people actually understand?

Technology providers must continue improving reliability, transparency and accountability.

But businesses must also take responsibility for preparing for the unexpected.

The cloud may be someone else’s infrastructure, but business continuity remains our responsibility.

And perhaps the next time Friday the 13th appears on the calendar, we should make sure our emergency contact list is stored somewhere other than SharePoint!

Because sometimes, even the cloud needs a little backup.