The outage affecting Microsoft 365 since Thursday has expanded well beyond the scope of a typical office or enterprise disruption. While recovery efforts were still underway on Friday morning, the fallout had spread to government agencies, hospitals, banks, law enforcement, schools, and courts across multiple countries. Email, cloud platforms, and several Microsoft artificial intelligence-based services experienced outages or anomalies, complicating the handling of daily operations reliant on these tools.
Microsoft has not quantified the number of affected users. The potential blast radius, however, is vast: in January, the company reported more than 450 million paid commercial seats for Microsoft 365. While this does not equate to the number of individuals affected by this incident, it underscores how quickly a multi-region issue can ripple through public administrations and the broader economy.
According to Ciaran Martin, former head of the UK's National Cyber Security Centre, the incident could rank among the largest tech blackouts ever recorded. Speaking to NBC News, Martin suggested its impact could potentially surpass recent crises involving Amazon Web Services and CrowdStrike. The comparison should be taken for what it is: an assessment of the event's potential scale, rather than a definitive damage estimate or final tally.
The cause cited by Microsoft: automated server health checks
At this stage, Microsoft states it has no evidence linking the outage to malicious activity. The company promised a post-incident review following full mitigation, detailing the root cause analysis and planned defensive measures. The initial hypothesis made public points instead to an internal infrastructure issue: a portion of the servers began failing automated health checks, effectively rendering them unavailable.
Traffic spikes do not appear to have triggered the emergency. Microsoft described high load across multiple regions resulting from a malfunction that pulled machines deemed unhealthy by monitoring systems out of service. The company subsequently pinpointed an essential process on the affected servers that was reaching saturation, leading to a loss of available capacity.
This dynamic also explains the difficulty in finding a quick fix. Initially, Microsoft tried to prevent further servers from dropping out of service and to validate alternative controls. These initial actions did not yield the expected relief. The company then isolated a portion of the infrastructure, restarted the affected components, and gradually reintroduced traffic to verify stability before rolling out the changes to the rest of the network.
Even bringing individual servers back online was not a definitive solution: some restored systems stopped responding again once they received traffic. This is a significant factor because it highlights that recovery does not depend merely on rebooting technical resources, but on the resilience of the entire path users take to reach services. Microsoft warned that intermittent issues may persist even during recovery.
Email, banking verifications, and essential activities
Among the most concrete measures adopted so far is extending the expiration threshold for delayed emails to 48 hours. Under normal conditions, a message that fails to be delivered within a certain window can be bounced back to the sender; extending that limit aims to prevent communications from being permanently lost during a prolonged outage. It is also a sign that Microsoft had to brace for a disruption that could not be resolved in a matter of minutes.
The reported fallout demonstrates why the suite's availability is no longer an issue limited to internal productivity. In Japan, the problem interfered with government IT infrastructure, according to Deputy Chief Cabinet Secretary Masanao Ozaki. Healthcare facilities struggled to transmit important updates regarding treatments and follow-up care to patients. In the financial sector, some users were unable to complete wire transfers because they were not receiving verification codes.
The justice system was also affected by the outage. The Supreme Court of the Philippines saw its legal activities disrupted. In the United States, a sheriff's office in Colorado reported difficulties for those posting bail required for the immediate release of detainees. These are different situations, but they share a common thread: when communication, digital identity, messaging, and document access rely on the same platform, an infrastructure failure can turn into an operational standstill with tangible consequences for people.
Why the comparison with AWS and CrowdStrike is useful, but not directly comparable
The comparison drawn by Martin brings to mind two recent incidents of very different natures. Outages on a major cloud platform can trigger a cascade of disruptions across websites, applications, and services built on top of that infrastructure. The CrowdStrike incident, on the other hand, showed how a faulty update in a security product can render countless Windows endpoints unusable simultaneously. The Microsoft 365 incident presents a different scenario: an issue that, according to the company's initial account, affects the mechanisms by which a global platform assesses the health of its servers and manages capacity.
There is still no comparable public data on costs, total downtime, or the actual number of organizations affected. Stating definitively at this stage that this is a worse incident than the others would therefore be premature. It is reasonable, however, to observe that Microsoft 365 occupies a cross-cutting position: it is used for email, collaboration, document management, and, in many organizations, for processes tied to identity, permissions, and administrative workflows. This concentration of functions makes it harder to separate the technical disruption from the organization's core operations.
The outage also raises a resilience issue that concerns both Microsoft and its customers. A continuity strategy does not simply mean having file backups: it requires alternative communication channels, procedures that operate without codes sent via email, and manual workflows for public-facing services. This does not eliminate reliance on the platform, but it can reduce the amount of time an outage completely halts operations.
What to expect from the recovery and the final report
In the immediate term, stabilization remains the primary focus. Microsoft is trying to restore capacity without triggering new issues on servers that begin receiving traffic again. For users and organizations, this means service recovery may not be uniform: one feature may reappear while another continues to show delays or errors, and conditions may vary depending on region and load.
The next phase will be the post-incident report promised by the company. It will need to clarify which process caused the saturation, why automated checks led to the unavailability of parts of the infrastructure, which safeguards failed, and what changes will be introduced. Until that document is published, the timeline remains based on the operational updates released during the emergency.
For Microsoft, the priority is restoring the service to stable levels and preserving queued messages. For customers, particularly those running public services or healthcare operations, the incident is a severe test of business continuity plans. The ultimate impact of the outage will depend on the duration of the recovery, the accumulated effects on stalled processes, and the ability to prevent measures taken to resolve the failure from generating further instability.
