Nobody gives Microsoft orders, not even the state

On Thursday 12 November, in the early evening, all my work stopped at once. Email, meetings and shared documents go through Microsoft 365 for me, as they do for a good share of my clients, and everything fell together. An email service cannot be redirected to another provider in ten minutes. You check Microsoft's status page, you refresh, you grit your teeth and you wait.

Shortly after 7 p.m., Downdetector was already counting close to 130,000 reports for Outlook. The next morning, in Japan, employees were bringing back the fax machine. In France, several town halls became unreachable and regional health agencies, in Brittany, Occitanie and Hauts-de-France, lost their email.

What Microsoft said, and everything it left out

The official timeline reads in the messages Microsoft published through the night. The first mentions users no longer able to access their Exchange Online mailboxes. On Thursday evening, the company says it is not aware of any malicious activity. More than twelve hours into the incident, it reports marginal success from its first measures. Overnight into Friday, it acknowledges that the changes applied are not working as expected, and that servers brought back into service are failing again.

The explanation arrives in pieces. A large number of servers became unexpectedly unavailable, and their load shifted onto those still holding, with no general rise in traffic. On Friday, Microsoft places the origin in a problem introduced during an earlier upgrade of its network capacity, surfaced by the rollout of a recent change. It promises a full report after analysis. Late on Friday it apologises and speaks of « a technical issue unrelated to cybersecurity or AI agents ».

What Microsoft did not say weighs more. The company described the overload mechanism without explaining why the first servers stopped. It did not say why its fixes failed, nor how many customers were affected: the figure of 74 countries comes from Downdetector, a reporting site, not from it. It did not say how an earlier upgrade could lie dormant in its network until the following change, nor whether that change had gone through its own validation process. After the outage of 22 January, which cut Microsoft 365 for close to ten hours, no detailed root cause analysis had been published three weeks later.

The vocabulary is worth pausing on too. Not being aware of any malicious activity, on Thursday evening, describes Microsoft's state of knowledge at that moment, and nothing more. Friday's denial about AI agents answers a hypothesis that nobody, in the official messages, had put forward. A company only denies what is circulating. For the best part of a day, no customer could tell an outage from an attack from the outside.

Friday morning, three scenarios on the table

On Friday morning, I did not wait. I took stock with my clients around a single question: what do we do if the outage drags on? On internal communication, video conferencing and email, we were covered, because internal procedures designed to replace those services already existed. The question was about the duration and the nature of the incident, and we laid out three scenarios.

In the first, Microsoft had lost control of its infrastructure, with no outside involvement. The outage could then last up to forty-eight hours, while staying confined to Microsoft. The company's statements pointed that way, and they are worth what they are worth: crisis communication binds only the party making it. Microsoft did extend to forty-eight hours the window during which its servers keep trying to send queued emails, which gives an idea of the horizon it was envisaging itself.

The second scenario was a coordinated attack, run by artificial intelligence agents, which would have explained the inability to regain control. The tone of the official messages fed it: fixes that fail, restored servers that fall over again, improvements described as marginal. Microsoft eventually ruled that line out, but on Friday morning nothing allowed anyone to do so.

The third scenario was the most worrying. A zero-day flaw, meaning one previously unknown and without an available fix, lodged in hardware or in software common to the whole industry. Had that been the case, it is highly likely that Google and Amazon, Microsoft's two direct competitors, would in turn have had to take their services offline. The economy would then have entered a cyber blackout lasting a week, perhaps longer.

It is the first scenario that came to pass, in under forty-eight hours. Nothing indicates the other two were at work this week, and it is precisely because they were impossible to rule out during the first hours that they had to be put on the table.

Can one outage take down every cloud at the same time?

The third scenario has a precedent. In January 2018, the disclosure of Meltdown and Spectre, two families of flaws written into the very design of processors, forced Amazon, Microsoft and Google to patch their infrastructure urgently, with Microsoft even bringing forward the reboot of its Azure virtual machines. The three providers shared the same weakness because they bought the same chips. That day, fixes existed. The day they do not, all three will have to choose between staying online while vulnerable and shutting down.

This year's run shows what a single failure is already enough to produce. On 22 January, Microsoft 365 was unavailable for close to ten hours. On 23 July, a bug in an automated network maintenance tool cut it for close to five hours. On 20 October, a power cut in a London Google Cloud data centre froze Revolut card payments in several European countries. Then came Thursday.

I wrote at the start of the month, describing what I do to last ten days without a network, that every link had already given way somewhere without giving way at the same time as the others. These outages arrive one at a time, and each is repaired before the next. The blackout begins the day two of them overlap, and Friday's third scenario described exactly that overlap.

An email service cannot be redirected

After every outage of this kind, you hear the same recommendation: you should have had a plan B. For corporate email, plan B almost never means switching to another provider. The addresses, the directories, the mailboxes, the security rules, the connections to other tools are all at Microsoft, and none of that moves in a morning. When the mail server goes down, you do not reroute the traffic, you wait.

The plan B that works is a degraded mode: carrying on without the tool, more slowly and less well, but without stopping. My clients held up on Friday because they already knew how the teams would talk to each other, how meetings would happen and how urgent messages would circulate if Microsoft disappeared. The French health ministry was able to state that no impact was observed on healthcare facilities or emergency services thanks to « alternative communication and reporting channels ». The Japanese employees who brought back the fax were doing the same thing with what they had to hand.

The town halls that became unreachable had no degraded mode, or had never tried it. The dependence on Microsoft was known to everyone. The difference was made between those who knew in advance how to work without it and those who found out on Thursday evening.

Who can hold Microsoft to account?

The customer has one lever, and it is contractual. The Microsoft 365 service level agreement promises 99.9 % monthly availability for Exchange Online, Teams, SharePoint or OneDrive. Below that threshold, Microsoft grants a credit of 25 % on the share of the invoice corresponding to the affected service. The credit rises to 50 % below 99 % and to 100 % below 95 %. Email cut for twenty hours in a thirty-day month brings availability to around 97 %, which entitles an organisation whose users were all cut off to a credit of half the month's Exchange share. Provided the administrator claims it, because nothing is automatic. A lost working day is therefore worth a discount on the next invoice, on request.

The state carries no more weight. On 10 June 2025, before a French Senate committee of inquiry, Anton Carniaux, director of public and legal affairs at Microsoft France, had to say under oath whether he could guarantee that French citizens' data would never be handed to US authorities without France's agreement. His answer: « No, I cannot guarantee it ». The same day, Agnès Buzyn, a former health minister, explained that hosting for the Health Data Hub, the national health data platform, could only go to Microsoft: « I was given no choice ». The question then concerned data confidentiality and US law, not availability. It shows that even the state, when it talks to Microsoft, is negotiating with a company that answers first to rules other than its own.

The head of a small business has no way of making Microsoft change anything, and the French government hardly more. With every outage comes the same answer: we should leave it.

Would a sovereign cloud have held?

Digital sovereignty is a real subject, and the June 2025 hearing showed its measure. In July 2026, the National Assembly's committee of inquiry into digital dependencies devoted an entire report to the state's reliance on a handful of American providers. A European host, subject to European law alone, answers that legal risk. It does not thereby answer the outage risk, and confusing the two turns a legitimate debate into a false one.

French providers go down too. Overnight on 9 to 10 March 2021, the fire at the SBG2 data centre of OVHcloud in Strasbourg destroyed servers and customer data. One of them, Bati Courtage, had taken out a backup option supposedly stored separately. The three copies sat in the same building as the main server, and they burned with it. The Lille Métropole commercial court ordered OVHcloud in 2023 to pay it more than 100,000 euros, for a loss money did not make reversible. On 16 July, a power failure on an internal dependency of a Paris data centre belonging to Scaleway, which I consider a very good service, left some of its virtual servers out of action for around two hours. Clever Cloud is another excellent French provider, and neither claims to be infallible.

Data location protects no better. In early March 2026, drones struck Amazon Web Services data centres in Bahrain and the United Arab Emirates, in retaliation for American and Israeli strikes on Iran. On 15 September, AWS acknowledged it could not restore resources and data hosted solely in its Bahrain region. Customers lost their data because it was in the wrong place at the wrong time, and no choice of provider would have protected them from having a single copy.

The risk doubles when sovereignty arrives without the skills. Microsoft, a giant that is a problem rightly or wrongly, took close to two days to get its services fully back on their feet. A sovereign ecosystem unable to run an equivalent service with the same depth of engineering would see more frequent incidents, and just as serious. Being sovereign first means giving yourself the means.

Those means are built over a decade. Choosing such a course is a change of paradigm for a country, and it is not decided like resurfacing a road or launching a motorway project. ANSSI has 670 staff, where its German counterpart fields between 1,800 and 2,000. Henri Verdier, the former interministerial director for digital affairs, reminded members of parliament in March that DINUM, which is meant to steer the state's digital transformation, has 50 million euros and no authority over the ministries' IT departments. That turn should have been taken ten years ago, and it must not wait for the presidential election. I have already said why cybersecurity must not become a campaign issue: an electoral promise, whatever the figure attached, does not train engineers and does not bring a data centre back up in forty-eight hours.

The law voted on Tuesday will ask it nothing

On Tuesday 17 November, the National Assembly holds the formal vote on the Resilience bill, which transposes NIS2 two years late. The minister for digital affairs now speaks of more than 18,000 entities concerned, across eighteen sectors. I wrote last week about what the state will demand of directors without applying it to itself. Thursday's outage adds a wider blind spot still.

NIS2 assigns supervision of cloud providers to the country where they have their main establishment in the Union. The European entity of Microsoft that financial supervisors singled out, Microsoft Ireland Operations Limited, is Irish. As of 28 October 2026, Ireland had not even tabled its transposition bill in parliament, and the European Commission referred it to the Court of Justice on 8 July, the same day as France. In the meantime, Ireland still applies the lighter rules from the first NIS directive. The law voted on Tuesday will give ANSSI no hold over the company on which many of the 18,000 entities it is to supervise depend.

It will, on the other hand, place the burden on the customer. Article 21 of the directive requires entities to ensure their business continuity, with backups, recovery and crisis management, and to manage the security of their suppliers. The town hall or the regional health agency that went down on Thursday will therefore have to answer, before ANSSI, for the continuity of a service it does not control, provided by a company nobody in France controls. The law cannot reach the provider, so it turns to the customer.

One sector alone escapes that pattern. On 18 November 2025, the European financial supervisory authorities designated Microsoft Ireland Operations Limited a critical provider under DORA, the regulation on digital operational resilience in the financial sector, placing it under their direct supervision. They can request information, carry out inspections, issue recommendations, and impose penalty payments of up to 1 % of its average daily worldwide turnover, every day for up to six months, to compel compliance. It is the only serious lever that exists in Europe against Microsoft, and it protects only banks, insurers and markets. France regulates the victims, and Europe supervises the provider only on behalf of its banks.

The « what if » exercise to run before the next outage

An organisation can decide neither the date of the next outage nor its duration. It can decide what it will do during it. In the impact analyses and crisis exercises I run, I willingly set aside the spectacular ones, those staging ransomware in the middle of the night with a journalist on the phone, in favour of far simpler questions. What if Microsoft were unavailable for eight hours? How do the teams keep working together, how do we stay in touch with clients, how do we deliver the service we promised?

Those three questions are enough to produce a plan. The first step is to list the activities that stop if Microsoft 365 stops, at three horizons: eight hours, twenty-four hours, forty-eight hours. For each one, the degraded mode has to be written down, on one page, with a named owner. That assumes a backup channel agreed in advance, which every employee knows before the outage, and lists of contacts, clients, suppliers and colleagues, kept outside the Microsoft environment, since the directory falls with the email. It also assumes a written decision rule, setting how many hours without visibility trigger the switch to degraded mode, so that at 8 a.m. nobody spends two hours waiting for the status page to update.

The rest plays out after the outage. The administrator should claim the credit the contract provides for, keeping timestamps of the interruptions observed, which costs an hour. Entities that will fall within the scope of NIS2 have every interest in recording this dependency in their risk analysis now, with the scenario played and its date, because that is exactly what ANSSI will come and ask for.

An exercise of this kind takes half a day. It requires neither budget nor consultant, only that somebody agrees to ask the question before the next outage.

On Tuesday 17 November, the National Assembly votes on the Resilience bill in the afternoon, and Microsoft opens its Ignite conference in San Francisco the same day. Neither will change what happened on Thursday. The blackout has never been closer.

Further reading

• Cyber blackout: lasting ten days without a network
• NIS2: the state will demand of directors the seriousness it spares itself
• Parliament has never been your CISO
• The only backup that counts is the one you have already restored
• Cybersecurity must not become an election issue
• The practical steps, without the jargon, on etrecyber.fr

Sources

• Microsoft 365 Status, messages published from 12 to 13 November 2026 on X and on the service status page, reported by CNN (Microsoft says email service is approaching normal levels following widespread global outage, 13 November 2026), ABC News and Presse-citron; apology statement of 13 November 2026 reported by AFP.
• Franceinfo, Ce que l'on sait de la panne mondiale qui touche le géant américain depuis jeudi, 13 November 2026, for the Downdetector reports; Ouest-France, Panne de Microsoft : « Aucun impact à ce stade » sur l'activité des établissements de santé en France, 13 November 2026; Phonandroid and Europe Business News, 13 and 14 November 2026, for the town halls and regional health agencies.
• Microsoft, Service Level Agreement for Microsoft Online Services and Microsoft Learn documentation on service credits.
• French Senate, committee of inquiry into public procurement, hearing of Anton Carniaux and Pierre Lagarde (Microsoft France), 10 June 2025; Techniques de l'ingénieur, Microsoft avoue ne pas garantir la confidentialité des données, for the Agnès Buzyn statement.
• Le Monde Informatique, Incendie SBG2 à Strasbourg : OVH condamné à verser plus de 100 000 €, February 2023 (Lille Métropole commercial court); Scaleway status page, incident of 16 July 2026 on fr-par-2 DC5, relayed by IsDown; DCmag, AWS ne peut plus rétablir une partie de son cloud frappée par la guerre en Iran, 17 September 2026, and Génération NT, September 2026.
• French National Assembly, committee of inquiry into structural dependencies and systemic vulnerabilities in the digital sector, report adopted 8 July 2026; Banque des Territoires, Souveraineté numérique : l'État victime de dépendances qu'il a lui-même créées, hearing of Henri Verdier of 10 March 2026; Alliancy, hearing of Vincent Strubel of 1 October 2026, for the ANSSI and BSI headcounts.
• Directive (EU) 2022/2555, known as NIS2, Articles 21 and 26; Solutions Numériques, NIS2 : la loi Résilience avance à l'Assemblée, November 2026, for the formal vote of 17 November and the figure of 18,000 entities.
• National Cyber Security Centre (Ireland) and the state of Irish transposition as of 28 October 2026; European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026.
• Regulation (EU) 2022/2554, known as DORA, Articles 31 and 35; European supervisory authorities (EBA, EIOPA, ESMA), list of designated critical ICT third-party providers, 18 November 2025.
• The Register, Microsoft 365 outage of 22 January 2026; BleepingComputer, Microsoft blames massive Microsoft 365 outage on maintenance bug, 24 July 2026; the London Google Cloud region outage of 20 October 2026 and the Revolut freeze, reported by Reuters and Tech Insider.
• Silicon UK, Meltdown & Spectre: AWS, Azure & GCP Take Measures To Protect Cloud Customers, January 2018, for the emergency patches and the accelerated Azure maintenance.
• Microsoft Ignite 2026, 17 to 20 November 2026, Moscone Center, San Francisco.