One outage, many institutions: Microsoft failure exposes Britain’s dependence on a single provider

A fault in Microsoft’s email infrastructure has disrupted hospitals, police forces, councils and businesses in the UK and across the world. Many people only discovered how much they relied on one American technology company when it stopped working.

Customers began losing the ability to send and receive Outlook emails at around 6pm UK time on Thursday. Downdetector registered a spike in Teams problems at roughly 6.15pm. At its peak, Downdetector logged more than 130,000 Outlook problem reports in the US alone. Users in 74 countries reported problems within a single hour.

Public services under strain

Hospitals, GPs and police forces across the UK were hit, and NHS staff arriving for work on Friday morning could not access email. In NHS Grampian, some GP practices reportedly lost access to their patient-record systems around the peak. NHS England said staff were “enacting long-standing measures”, including paper records, and asked patients to attend appointments as normal. The National Pharmacy Association warned that some prescriptions could be delayed.

Police forces said they could not receive online crime reports and urged the public to call 101 or 999. National Rail warned that customers might struggle to reach tickets sent by email. Councils also reported disruption. Local authorities from Shetland to Wrexham were affected.

The problem was global. Government agencies in Australia, Japan and the United States were disrupted, including Australia’s federal police and intelligence service. The US House of Representatives said its users were affected. Indian airlines IndiGo and Akasa Air reported problems with email support. Taiwanese financial firms had fund-management disruption, and one company reportedly cancelled a bond repurchase transaction it had already scheduled. US electric truck maker Workhorse delayed its quarterly results, citing the outage. Even AI services, including ChatGPT and Anthropic’s Claude, were reported disrupted, and both companies said their Microsoft connectors had been affected.

What Microsoft says

Microsoft has said it has no evidence of malicious activity. Australia’s Home Affairs Minister, Tony Burke, compared the situation to the 2024 CrowdStrike failure, in which a faulty update caused global disruption. Microsoft said fixes applied to affected servers had produced only partial recovery in some regions, and that it was reviewing further steps to stabilise its infrastructure.

By Friday lunchtime, Microsoft said traffic was being “gradually restored”, with improvements to mailbox access, though some users could still see intermittent problems. It promised a full post-incident report with root cause once recovery is complete.

A concentration risk

The outage was not a failure of one product. It showed how many essential services rely on the same cloud-hosted email and productivity suite, and that is a concentration risk. A single faulty change at one provider can affect clinical communication, emergency reporting and financial transactions at the same moment.

It is also not the first warning. This is the second major disruption to Microsoft 365 this year, following one in January, and Microsoft reported an Azure outage last month. Analysts quoted by Reuters suggested customers are unlikely to leave Microsoft quickly, but that repeated failures give IT departments reason to think twice before placing even more of their business with one provider.

The UK’s institutions did have fallbacks, such as paper records and telephone lines. Those plans worked, but they show that resilience depends on tools older than the cloud.

What businesses should do now

Companies that were caught out should treat this as a prompt to act. In practice, that means:

1. Map your dependencies. List every process that relies on Microsoft 365, Exchange Online, Teams or Azure, including the less obvious ones such as booking confirmations, payment approvals and customer-service workflows.
2. Set up an out-of-band communications channel. Keep a pre-agreed alternative for staff and customers, such as a second messaging platform, an SMS broadcast tool or a phone tree. It should not run on the same provider’s identity or email system.
3. Keep email continuity in place. Consider a secondary mail-filtering or archiving service that can queue and deliver mail during an outage. Publish a fallback contact route for customers.
4. Hold offline copies of critical information. Contact lists, incident procedures, key contracts and clinical or operational essentials should be accessible without cloud login.
5. Rehearse the failure. Run a tabletop exercise that assumes your core productivity suite is unavailable for 24 to 48 hours. Check that decision-makers know who to call and how.
6. Review supplier resilience. Ask vendors and critical suppliers how they would cope with the same outage, and check your own contracts for service-level and compensation terms.
7. Prepare for opportunistic fraud. The Federation of Small Businesses has warned that criminals may exploit the confusion with fake offers of “help”. Remind staff to verify any unsolicited support requests.
8. Review your risk register. Record reliance on a single provider as a concentration risk and track it at board level.

Businesses cannot realistically abandon Microsoft overnight. They can, though, decide in advance how they will keep working when it fails.

Feature image by Simon Ray on Unsplash