Microsoft outage raises questions around sovereignty, resilience and over-reliance on a single provider

The events of Microsoft’s major outage last week may now seem like a not-so-distant nightmare, but the questions it raised look likely to reverberate far beyond the 36 hours or so it lasted. 

The outage began just before 5:00AM local time on Friday (the 13th, inauspiciously) and affected everything from Outlook and Teams to Copilot and Purview - and everyone from ASIO and the AFP through to “governments, courts, healthcare services, businesses, airlines and banks”, according to The Guardian. 

The company stated on X at 5:09PM local time on Saturday that it had “restored service to the remaining impacted customers and regions”, bringing an end to the latest high-profile outage, following CrowdStrike in 2024 and both Azure and AWS last year. 

The fault was attributed by Micosoft to “server issues”, and while rumours abounded – albeit unfounded ones – that claimed the ‘real cause’ of the outage could be anything from an undisclosed cyber-attack to AI gone rogue, local technology providers were left scrambling in the wake of the downtime. 

Wayne Small, founder of The Cyber Advisory, said that he spent the day telling the MSPs he works with to explore alternative ways of checking in with their customers. 

“If you've got critical infrastructure, you want to have some of your team keeping an eye on that and paying extra attention to the potential source of those alerts, because the hackers might take the opportunity to have a crack at trying to get in at different ways, knowing most people use email alerts,” he told techpartner.news. 

More focus needed on risks and resilience 

Issues of sovereignty, business resilience and what relying on a single provider not headquartered in the country means for the future also dominated discussions. 

Astha Singh, senior BDM for Microsoft at Tech Data APAC, said that with the Microsoft ecosystem deeply embedded in the way businesses work today, organisations need to ask themselves whether they’re building resilient businesses or simply building businesses that depend on technology always being available. 
 
“Business continuity needs to go beyond having a backup for infrastructure. It needs to consider people, processes, platforms and dependencies,” she said on LinkedIn. 

“Security and resilience are interconnected. Organisations need visibility into their risks, dependencies and recovery capabilities. AI adoption should come with thoughtful governance and contingency planning [and] productivity cannot come at the expense of preparedness.” 

This reliance on the likes of Microsoft and others for AI capabilities was also raised by Jonas Christensen, CEO of ExpandIQ, a Melbourne-based AI transformation partner. 

He stated that until recently, an outage like this meant a slow afternoon of email, but once AI is doing part of the work, it means lost output. 

“Firms are handing more of their work to AI every month and almost all of it runs on a handful of companies based in the US. When one of them has a bad day, most organisations have nothing to fall back on, and that reliance will grow over the next few years,” he said on LinkedIn. 

“That’s why I think every AI strategy needs a resilience section sitting next to the efficiency and ROI case. Know which work depends on which provider, keep a fallback you control for the workflows that matter most and make sure your team can still do the job when the tools stop.” 

The Australian Computer Society (ACS), meanwhile, used the outage to renew its call for a national review of sovereign risk in Australian IT to identify which critical systems depend on a single provider, and where backup options, including open-source alternatives, can keep essential services running. 

Few other alternatives to Microsoft exist 

The issue, remains, however, that for many organisations, decoupling from years, if not decades, of investment into and implementation of the Microsoft ecosystem is not an easy task – and likely not one that could be done either quickly and/or cheaply. 

In a blog post from earlier this year, Microsoft’s ANZ president laid its scale in the region bare: a network comprising of more than 10,000 local partner companies and 3.6 million customers spread across Australia and New Zealand. 

Dr. Joseph Sweeney, an advisor of the Future of Work for analyst firm IBRS, said that IBRS’ own study from 2024 showed that Microsoft, at the time, held close to 80% of the work productivity market; leaving means re-architecting storage, identity, security and information governance. 

“Google Workspace, the strongest commercial alternative, has no Australian data residency within the Workspace options, which rules it out as a primary document store for organisations with residency obligations. Zoho Workspace is nowhere near ready, but has strong residency options,” he said on LinkedIn. 

“The realistic Australian play is to manage the dependency, not sever it: resilience measures for the next outage, and commercial leverage at the next renewal.” 

According to Dr. Sweeney, those resilience measures include the likes of creating an agreed out-of-band channel, such as SMS broadcast or a secondary platform, for staff and client communication; email continuity services that spool inbound mail and provide emergency inboxes while Exchange Online is down; and independent backups of Microsoft 365 data held outside Microsoft's cloud. 

Little negotiation available for SMBs 

Companies hoping to take Microsoft to task for the outage and the subsequent impacts it caused to their business – or their customer’s businesses – may be out of luck. 

Johnny Chal*, a Sydney-based senior lawyer with experience at the intersection of technology, data, privacy, and risk, said that for many organisations, particularly SMBs, there is little meaningful negotiation with a hyperscale cloud provider.  

The standard terms are designed to define and limit the provider's exposure, “not to compensate customers for their full business losses”, Chal told techpartner.news, with Microsoft's current Online Services SLA being one agreement that illustrates the issue.  

“Exchange Online generally carries a 99.9% monthly uptime commitment, with service credits of 25%, 50% or 100% of the applicable monthly service fee where availability falls below specified thresholds. The customer must submit a claim, and the SLA describes service credits as the sole and exclusive remedy for the availability or performance issues it covers,” he explained. 
 
“That remedy can be very small compared with the customer's actual loss.”  

For smaller customers, Chal advised that practical protection is more likely to come from stronger commitments from their reseller or MSP; the Australian Consumer Law, where applicable, including the consumer guarantees and the unfair contract terms regime for eligible small-business standard-form contracts; and tested business-continuity arrangements. 

He stated that while an MSP is not automatically responsible for an outage occurring entirely within Microsoft's infrastructure, the MSP does remain responsible for its own promises and the parts of the environment it controls.  

“That includes what it sold (if the MSP promised resilience, failover or a guaranteed level of availability, it may be accountable for those representations and contractual commitments); what it configures (tenant configuration, identity controls, backups, logging and recovery processes); what credentials it holds (particularly global administrator and endpoint-management privileges); how it responds (monitoring, customer communications, escalation and the agreed incident and recovery procedures); and how it handles personal information (including the privacy and security obligations allocated under the customer contract),” Chal said. 

Chal shared that overseas, a greater accountability for large companies like Microsoft has been introduced, one such method being via the EU's Digital Operational Resilience Act. 

This means that designated providers – which includes Microsoft, in this instance - are subject to an EU-level oversight framework administered by the European Supervisory Authorities. 

The United Kingdom has gone further - in July, Microsoft, Amazon Web Services, Google Cloud and Oracle were all formally designated as critical third parties to the UK financial sector.  

As a result, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority now directly oversee the resilience of their critical services. 

“Australia still primarily imposes operational-resilience duties on regulated customers rather than creating equivalent direct, cross-sector oversight of major cloud platforms,” Chal told techpartner.news. 

“Scrutiny of cloud platforms is likely to focus on faster and clearer service-status communications; more detailed and useful post-incident reviews; government reporting of major cloud outages; testing of common dependencies and concentration risks; and 
the effectiveness of contractual remedies where customers suffer substantial losses.” 

In August, the Australian Government and Microsoft signed a MOU with the stated aim of strengthening the country’s digital resilience and safeguarding the security of critical systems. 

“Recognising the growing importance of cloud services, data, artificial intelligence and other emerging technologies, the MOU supports closer cooperation between government and industry to address evolving risks and enhance the resilience of Australia's digital ecosystem,” the Department of Home Affairs said at the time. 

Education’s competitive environment called into question 

Janine Arantes, an associate professor at Victoria University and the founder of AI Governance for Education – an ecosystem of research groups, networks, labs and initiatives advancing responsible AI in education – said that Friday’s event was “a fairly confronting illustration of concerns” around the market power of a handful of companies and the commercialisation of education.

She told techpartner.news that part of the issue comes down to the people who use educational technology are frequently not the same people who purchase it.  

“A department negotiates a contract, a school implements the platform, a teacher is required to use it, and a child may need an account to participate in learning. At what point does that child, parent or teacher exercise meaningful choice?” she said. 

“While universities manage extensive teaching and research operations, often with systems developed and integrated over many years, and they may have more control over procurement than individual public schools, that doesn't necessarily translate into bargaining power.” 

Arantes said that while typical technology procurements have been assessed in terms of the benefits a product offers at the time of purchase, much less attention is paid to what happens to a bargaining position five or ten years into the relationship. 

She said this results in a need to “pay much closer attention” to where institutions have retained independent capacity and where one provider has become indispensable.  

“It might also be worthwhile looking at the European Union, who I think has moved to reduce barriers to switching cloud services, including requiring providers to facilitate migration and phasing out switching charges. This might offer a solution - perhaps Australia should be having that conversation at a national level,” she noted. 

Arantes also raised the issue of how much influence existing technology providers will have over the next generation of educational tools – if a school is already dependent on Microsoft's infrastructure, how independently can it evaluate Microsoft's AI offerings against those of smaller competitors?  

“For technology partners, I think this challenges the way we talk about successful implementation. If the objective is to integrate every possible function into one provider's ecosystem, we may be creating excellent commercial outcomes for that provider while making the customer progressively less independent,” she stated to techpartner.news. 

“A serious conversation about resilience should include the possibility that a customer may want to leave. Could they? What would it cost? How much of their institutional knowledge, resources and infrastructure could they take with them? If technology partners cannot answer those questions, they're not giving education as a customer a complete picture of the relationship they're entering.” 

Arantes emphasised that the key takeaway for her was not to see the events of last week as another discussion that puts the burden back on schools, teachers or university IT departments to develop better contingency plans.  

She said that while continuity planning matters, asking institutions to become more resilient while leaving the underlying market conditions untouched has “obvious limitations”.  

“If an entire education system can experience a major disruption and still have little realistic choice but to return to the same provider, how competitive is the market we're operating in?” she said. 

_{*These comments are general commentary and are not legal advice to any particular organisation.}