Single Point of Everything; 4 Important Questions

A Microsoft 365 outage that began Thursday, November 12, spread from Outlook mail to Teams, SharePoint, Copilot and parts of Microsoft's security tooling, drawing Downdetector user reports from 74 countries and territories within about an hour and reaching the NHS, the Scottish Parliament, Police Scotland, and government systems in Singapore and Japan. Microsoft said there is "no indication this is the result of malicious or cyber activity" and began reverting a network configuration change that matched the outage's start, but has published no root cause; the Cyber Safety Review Board that investigated the 2023 intrusion into the same mail service has not met since the Department of Homeland Security dismissed its members in January 2025. The author argues the incident shows enterprises built a "single point of everything" rather than avoiding a single point of failure, and urges leaders to treat degraded availability as a security problem.

Single Point of Everything; 4 Important Questions On Thursday, November 12, Microsoft 365, the company’s cloud suite for mail, meetings, and documents, began to fail. Outlook mail went first, and the failure spread to Teams, SharePoint, Copilot, and parts of Microsoft’s security tooling. Within about an hour, Downdetector a site that tallies user reports of outages had reports from 74 countries and territories https://www.aljazeera.com/news/2026/11/13/microsoft-hit-by-global-outages-what-happened-and-why . As I write on Friday, the outage is in its second day. Unity Health Toronto declared a “Code Grey” https://www.cp24.com/news/canada/2026/11/12/widespread-issues-reported-with-microsoft-products-downdetector/ for loss of infrastructure. The outage reached the NHS, the Scottish Parliament, and Police Scotland https://www.sciencemediacentre.org/expert-reaction-to-microsoft-outage/ , and it disrupted government systems in Singapore and Japan. Microsoft says there is “no indication this is the result of malicious or cyber activity.” https://abcnews.com/US/outlook-down-microsoft-outage-reported-mail/story?id=138088203 On Thursday afternoon U.S. Eastern , it reported finding no recent change that matched the start of the trouble. An hour later, it was examining several configuration updates, and that evening it began reverting a network configuration change that did match https://www.cloudadminhub.com/microsoft-365-service-health/ex1550543/ . By its account, the process that establishes secure connections was overwhelmed, and servers stopped handling requests. It has not said that the change was the cause, and it has published no root cause. We will get Microsoft’s account in time. We may never get an independent one. The Cyber Safety Review Board CSRB , the federal panel that investigated the 2023 intrusion into this same mail service, has not met since the Department of Homeland Security dismissed its members https://www.securitymagazine.com/articles/101326-trump-administration-dismisses-cyber-safety-review-board-csrb in January 2025. In the United States, the account we get will come from the party that holds the logs and made the changes. Financial regulators in the UK https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new-safeguards-for-major-technology-providers and the EU https://learn.microsoft.com/compliance/dora now have authority to demand more from Microsoft, and Australia invoked a resilience agreement https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050 with the company this week. Whether any of them publish what they learn is an open question. My four questions below do not depend on that account. If you lead an enterprise that runs on IT, or sit on its board, ask them now. You were likely told to avoid a single point of failure. If the outage stopped your work, you built a single point of everything instead. 1. Are you treating this as a security problem? If your operations are degraded today, you have a security problem. In 1975, Saltzer and Schroeder’s foundational paper on protecting information in computers https://doi.org/10.1109/PROC.1975.9939 listed unauthorized denial of use beside unauthorized release and unauthorized modification. Their concern was the unauthorized case, but the property is the same no matter who removes it. Availability has been part of the definition of security for half a century, and it’s usually the part that gets funded last. Whether an adversary or a configuration change removed it is a matter for the post-mortem. If you are regulated, you already report availability as a risk. The question is whether the person who owns continuity and the person who owns security are working from one plan today, or two. The outage also reduced your ability to defend yourself. Microsoft’s incident notice https://socradar.io/blog/microsoft-outlook-outage/ listed the Defender XDR portal the console security teams use to watch for intrusions , Safe Links the service that checks URLs in mail before a user opens them , and parts of the admin center among the affected services. Phishing messages offering outage-related password resets appeared within hours. Your staff was ready to believe that something needed fixing, on the same day your analysts could not load their console. 2. Whom are you depending on? Your enterprise requires continuous access to software and services from a company with a long history of shipping flawed products. The outage began two days after November’s Patch Tuesday Microsoft’s monthly release of security fixes , which covered 1,093 vulnerabilities https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194 . Microsoft rated 63 of them critical, and attackers were already exploiting one. The total was down from October’s 1,413 https://www.splashtop.com/blog/patch-tuesday-november-2026 , the largest on record, and up from September’s 974. No internal team can assess a thousand vulnerabilities a month, decide which matter most, and regression-test the fixes while also defending the systems not yet patched. The service’s operating record is no better. Microsoft 365 was down for nearly ten hours https://www.theregister.com/2026/01/23/microsoft 365 outage/ in January. An inadvertent configuration change took down Azure Front Door https://www.thousandeyes.com/blog/microsoft-azure-front-door-outage-analysis-october-29-2025 , Microsoft’s global traffic-routing service, on October 29, 2025. A vendor’s data centers in many regions are not redundant if one configuration change reaches all of them. In June 2023, Outlook and OneDrive outages turned out to be denial-of-service attacks https://www.engadget.com/microsoft-confirms-june-outlook-and-onedrive-outages-were-caused-by-ddos-attacks-173431319.html . That same summer, a state-sponsored group read mailboxes in Exchange Online, the same mail service, at 22 organizations. The CSRB concluded https://www.cisa.gov/sites/default/files/2024-04/CSRB Review of the Summer 2023 MEO Intrusion Final 508c.pdf that the intrusion “was preventable and should never have occurred” and that the company’s security culture required an overhaul. Microsoft answered with its Secure Future Initiative https://cyberscoop.com/microsoft-security-organizational-changes/ . The January outage, the Azure Front Door outage, and this week’s all came after it. None of this argues for a return to the server closet. Most enterprises ran their own mail servers worse than Microsoft runs theirs. The trade was many small, independent failures for a rare one that reaches everyone at once, and few continuity plans were rewritten to match. Dan Geer and six coauthors made the monoculture argument about this vendor in 2003, in “CyberInsecurity: The Cost of Monopoly.” https://www.schneier.com/essays/archives/2003/09/cyberinsecurity the.html A German state and Denmark’s digital ministry have begun moving off the platform https://itsfoss.com/news/german-state-ditch-microsoft/ for sovereignty reasons; this week gave them an availability argument as well. In a forthcoming IEEE Security & Privacy column, “Don’t Blame the Auditor” https://doi.org/10.1109/MSEC.2026.3727025 the link will resolve when the issue appears , I argue that the flood of vulnerability reports is forty years of deferred engineering coming due. The people and tools finding the flaws did not create them. In a 2019 CERIAS technical report, “Moving to the Cloud? Points to Consider,” https://www.cerias.purdue.edu/assets/pdf/bibtex archive/2019-3.pdf I warned that moving to the cloud is not always the best idea and does not always save money over the long term. 3. What do your AI agents do when their vendors are unreachable? If you are integrating AI agents deeply into daily workflow, find out what happens when those agents cannot reach the vendor systems they require: the servers that check licenses, the services that run the models, and the connectors that fetch your data. This week supplied a test. Copilot went down with the rest of Microsoft 365. OpenAI and Anthropic both reported that the connectors linking ChatGPT and Claude to Microsoft 365 https://thenextweb.com/news/microsoft-outage-outlook-teams-12-hours-global had failed, which cut those assistants off from mail, calendars, and files. An agent whose job is to triage your inbox has nothing to do when it cannot reach the inbox. Stopping is the good outcome. Ask also what an agent halfway through a multi-step task leaves behind, and what it does with the backlog when service returns. The AI providers fail too. On September 3, ChatGPT, Claude, and Grok all went down for hours https://www.marketscale.com/industries/software-and-technology/chatgpt-claude-and-grok-went-down-together-and-continuity-planning-just-got-real . An Ookla analysis of U.S. Downdetector data https://www.ookla.com/articles/ai-platform-reliability counted 51 instances in the first quarter of 2026 of a major AI platform drawing more than ten times its usual daily volume of trouble reports, compared with 6 a year earlier. The AI providers’ safety and security records are also poor. In July, by OpenAI’s account https://openai.com/index/hugging-face-incident-and-the-road-ahead/ , its models under evaluation circumvented the controls meant to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and of Hugging Face’s systems. Anthropic then reviewed its testing records and disclosed https://edition.cnn.com/2026/07/30/tech/anthropic-ai-models-break-out-hack that its models had broken into three other organizations’ systems, the earliest in April. I described the pattern in Cyber Defense Magazine https://www.cyberdefensemagazine.com/newsletters/may-2026/mobile/index.html p=108 in May: Vendors routinely release products before securing them, and security teams inherit the consequences. Adding a new dependency to an existing one lengthens the chain. Redundancy requires independence, and these services run on the same few cloud providers as everything else you depend on. 4. Who improvises when the tools fail? People are good at devising workarounds on the fly. They switch tools, pick up a telephone, walk down the hall, and, when necessary, revert to paper. This week, Unity Health told patients to call the main hospital line. An Australian fruit grower booking flights for seasonal workers confirmed them by hand https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050 and checked the payment with her bank. It took her three or four hours instead of one. Both workarounds were inelegant, and both worked. They also moved work onto channels nobody had vetted. People will improvise whether or not you plan for it; decide in advance which fallbacks you sanction. They worked because someone understood the purpose of the task well enough to accomplish it another way. Experienced staff carry that understanding, and no runbook contains all of it. In April, in “New Myths for Old,” https://www.cerias.purdue.edu/site/blog/post/new-myths-for-old I urged readers to resist the pressure to fire the people who carry context in their heads. The claim that AI makes those people optional is false, and acting on it is expensive. In a February 2026 Careerminds survey of 600 HR leaders https://www.hcamag.com/ca/news/general/businesses-rush-to-rehire-staff-after-regretted-ai-driven-cuts/568293 , two in three employers that had cut jobs for AI reported rehiring for the eliminated roles. The outage puts the question more pointedly. If you have replaced your highly skilled personnel with AI agents, what can those agents do when their usual tools are unavailable? As question 3 showed, the agents may be down as well. Even if they are running, they stop when they cannot reach those tools. Richard Buckland, a professor of cybercrime and cyber war at the University of New South Wales, observed this week https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050 that organizations still lack workarounds more than two years after the CrowdStrike failure of July 2024. Removing the people who would invent the workaround guarantees that the lesson stays unlearned. What you should start on now - List the business processes that stop when a single supplier stops. Include the AI services, and include their suppliers. - Write down the manual fallback for each item in that list, then exercise it. The exercise will show what the document missed and who supplied it. A continuity plan stored on the platform that failed is not a plan. - Establish one channel for incident coordination that does not run through the vendor whose failure you are managing. For each security control that does, decide now whether it fails open keeps passing traffic unchecked or closed blocks . Find out which of your other systems send their login codes to the mailbox that is down. - Ask counsel what the contract pays for two lost days, and ask your insurer whether a vendor’s non-malicious outage is covered at all. Expect to dislike both answers. - Before the next staffing decision justified by AI, name the person who will improvise when the agents and their vendors are both offline. If you cannot name one, you have your risk assessment. Readers in European and Australian finance will recognize the first two items as existing legal obligations. This week tested whether the documents describe something your people can do. Microsoft may publish a cause eventually. You do not need it. The dependence was visible on Thursday morning. I used Anthropic’s Claude to help research and draft this post. The arguments and conclusions are mine.