Microsoft's Outage Exposed A Midmarket Resilience Blind Spot
Microsoft 365 doesn't have to suffer a cyberattack to disrupt security, communications and business operations. The Nov. 12 outage offers IT leaders a chance to find out just how much of their resilience depends on the platform being available.
Whenever a major cloud outage happens, it almost always forces IT leaders to revisit the same question: What parts of your disaster recovery plan still work when the platform used to execute that plan doesn't?
Microsoft's Nov. 12 outage disrupted Outlook and Exchange Online and affected Exchange-dependent functions across other Microsoft 365 services.
Microsoft has said there was no evidence of the outage being caused by malicious activity.
But from an IT resilience perspective, it doesn't really matter if downtime is caused by a cyberattack, a software update or someone tripping over a wire.
Any of those scenarios could disrupt communications and access to business-critical systems.
For midmarket organizations operating with smaller IT teams and fewer redundant platform options, dependency on a platform that is also part of a resilience strategy can become consequential.
When Your Backup Plan Depends On Microsoft, Too
There's a temptation after an outage of this massive scale to talk about redundancy: have another service ready if Microsoft 365 becomes unavailable.
In practice, that is considerably harder.
Matt Saunders, field CTO at Adaptavist, argues that business generally can't transparently switch between Microsoft 365 and an alternative such as Google Workspace because organizations don't design their productivity environments to operate interchangeably across both.
"Classic IT disaster planning strategies suggest using a second service for resilience, but in practice, it’s almost impossible for a business to function without tools such as Microsoft. It’s not just a problem of synchronising data so you can use the other when one is down; any company of any size will not be able to transparently switch from one to the other, because the offerings are different and no one designs systems to interoperate with both," Saunders said in an email statement to MES Computing.
That means organizations may not want to think in terms of a backup to Microsoft 365. Instead, they should ask: How do we keep operating without Microsoft 365?
If Outlook becomes unavailable as it did Thursday, how does IT communicate with employees? If Teams isn't fully functional, how does the incident response team ordinate? Where are employees' phone numbers or their email addresses outside of the organization's domain stored? Can administrators reach Microsoft's service-health information if their normal administrative path is inaccessible?
It's a problem I noticed during the outage myself: directing administrators to an admin center for outage information isn't useful if access to the entire environment is part of the issue.
Microsoft did provide a public service-status site, and during the incident it pointed customers toward that site if the admin center wasn't available.
That is exactly the kind of independent communication path organizations need when the critical cloud services they depend on go dark.
An Outage Can Also Create A Security Window
There's another problem, an email to me revealed.
Attackers don't need to cause an outage to take advantage of one.
In an email, Matt Hull, vice president of cyber intelligence and response at NCC warns that disruption and confusion give criminals an opportunity to impersonate Microsoft or internal IT personnel.
"Cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create. Organizations should remind colleagues to be particularly vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay," Hull said.
“Social engineering is a particular concern here, especially vishing and impersonation of Microsoft or internal IT support teams. With email services affected, traditional phishing may be less effective in the immediate term, but phone calls, text messages and other channels remain fully available to attackers. We could see attempts to convince people to reset passwords, approve multi-factor authentication requests or provide remote access to their devices," he added.
Not too long after our own company's Microsoft 365 services came back online, I received a suspicious Teams call from someone identified only as "IT Representative." The call was flagged as a suspected phishing attempt. There's no evidence it was connected to the outage, but the timing underscored Hull's point that disruption creates that kind of confusion attackers can exploit.
The Post-Outage Exercise Midmarket IT Should Run
Once Microsoft's services stabilize, it may be a good idea for midmarket IT leaders to pull their incident response and business continuity folks together and run through five questions:
How did we learn Microsoft 365 was experiencing and outage?
How did IT communicate with employees when normal ways were unavailable?
Which security, identity or incident-response processes depended on affected Microsoft services?
What information did we discover we couldn't access without Microsoft 365?
Could an employee tell a legitimate emergency IT message from an attacker's exploit?
Yesterday's Microsoft outage was an infrastructure incident and not an attack, the company said. For IT leaders, that's exactly why it makes such a useful resilience test for their own organizations.