The continuing outage of Microsoft’s collaboration tools will have a “cascading” effect on businesses, with the financial impact increasing the longer it stretches, experts say.
Microsoft 365 tools Exchange Online and Outlook were affected, with Teams, SharePoint Online, Copilot also likely to face an impact from the interruption that began on Thursday. The company is still working on fixing it.
“The continuing outage of Microsoft’s collaboration tools, especially emails and scheduling, will not only impact communications, but also have a cascading impact on decision-making, revenue and service delivery,” said Saurabh Verma, vice president, ICT growth advisory at consultancy Frost & Sullivan.
“The actual dollar impact or revenue loss would go up with every passing minute, as millions of organisations across critical and non-critical sectors are deeply embedded with MS 365 suite.”
Microsoft's outage reports on November 12 reached 74 countries and territories in about an hour on Downdetector, which monitors internet disruption.
The financial consequences from such an outage are significant, said Morey Haber, chief security adviser at BeyondTrust. “Lost productivity, interrupted transactions, missed revenue and recovery expenses can quickly accumulate into millions of dollars across affected organisations,” he said.
“While Microsoft may offer contractual service credits under applicable Service Level Agreements (SLAs), these typically represent a fraction of actual business losses. Credits generally offset future service charges rather than compensate customers for lost revenue, operational disruption, or reputational damage.”
The power cut may also affect software as a service (SaaS) tools using MS’s 365 application programming interface (APIs), which refers to rules that allow software apps to communicate, Mr Verma said.
“With MS having a significant market share in collab tools, there is no escaping and second solution to it. No product in today’s age and time is immune to such outages,” he added.
The outage “exposes the severe operational fragility of single-vendor cloud concentration” across global businesses and financial markets, said Vijay Valecha, chief investment officer at Century Financial.
It has caused a considerable amount of disruption to financial workflows, although on the capital markets side, the core stock exchange matching engines are largely unaffected, he added.
“Institutional execution desks lost their primary email channels during a turbulent week of trading and were therefore forced to revert to phone calls and WhatsApp to confirm settlements,” he said.
Richemont, the Swiss luxury group that owns Cartier, was forced to delay its results. On the banking side, payment clearing was not affected at all, although payment networks and banking portals that required a secondary login were all having problems, Mr Valecha added.
Technology disruptions have been common in recent years, as digital usage continues to soar.
In October last year, Microsoft's Azure portal went down, affecting hundreds of thousands of people trying to access apps, games, websites and other services. That came in the same month that an outage of Amazon Web Services, which lasted for about 15 hours, disrupted several AWS-hosted services and platforms.
In June this year, several web platforms, apps and internet services including X, Zoom, Reddit, Canva, Amazon Web Services, Microsoft Teams, Fortnite and Discord also experienced significant disruption.
Managing outages
For finance companies to mitigate risk, they must use out-of-band communication channels such as independent messaging platforms, dedicated voice lines and secondary SMS modes so trading desks and crisis teams can co-ordinate immediately when primary email services go dark, Mr Valecha said.
“This is exactly what desks in Singapore have used,” he added. “Decoupled identity and access management can also be explored. If a single vendor handles both email and single sign-on, an power cut locks staff out of third-party applications that are otherwise running normally.”
Also, although the Microsoft outage is not a cybersecurity issue, hostile actors could be looking to take advantage of those affected, offering a resolution or assurances, said Aiden Sinnott, principal threat researcher at Sophos Counter Threat Unit.
“People should exercise caution when receiving emails, texts or calls purporting to be from Microsoft or other affected businesses, particularly banks or shops,” he said.
“Be aware of requests for urgent action, sharing of personal information and avoid clicking on links sent via message or email.”
