Ing. Calogero Bono
The Microsoft outage of November 12 and 13, 2026 blocked Outlook, Teams, Copilot and other services in more than 70 countries, according to Wired. Microsoft rules out a cyberattack and points to a network problem. Once the emergency passes, the most uncomfortable question remains. How many functions in your company depend on a single vendor, and who decided it should be that way.
A few terms before we get into the facts. NIS2 is the European directive on the security of networks and systems, transposed in Italy by Legislative Decree 138/2024. Lock-in refers to how hard it is to leave a vendor. Non-fungible supplier is one that cannot easily be replaced. Entra ID and Intune are Microsoft's services for identity and device management. Governance is the way an organization makes decisions and takes on risk.
What happened to Microsoft 365?
According to TechCrunch, the problem began on Thursday with Outlook and Teams, then spread to email, files and documents. Copilot, Defender and the administrators' Intune panels were also hit. Kentik measured the return of traffic after about 18 hours.
Wired reports that Downdetector reports began shortly after 12 noon Eastern time. We followed its evolution in our article on the recovery after almost two days.
What cause did the vendor declare?
A Microsoft spokesperson said it was a technical problem unrelated to attacks or AI. The incident reportedly stemmed from a problem during an earlier network capacity update, surfacing after a recent change. These are the company's statements, not independent verifications.
Microsoft promises a full report after its analysis. Earlier it had spoken of "a large number of servers suddenly becoming unavailable". For the initial technical details you can read our piece on servers going down after health checks.
Who suffered the heaviest consequences?
Wired cites governments from Japan to the United States, airlines, emergency services and hospitals. Punto Informatico, citing Reuters, reports a Taiwanese financial firm reverting to fax to confirm transactions. In the United Kingdom the National Health Service and the Metropolitan Police could not manage bookings and databases.
Also according to Punto Informatico, it is the longest Microsoft outage on record. A precedent is the Exchange Online incident lasting over 12 hours.
Why does NIS2 hold those who chose dependence accountable?
For Cybersecurity360, concentration risk often arises from many correct decisions taken separately. Mail, Teams, Entra ID, Intune and Defender each have a good reason to exist, but nobody evaluates the sum.
Article 23 of Legislative Decree 138/2024 recalls the responsibilities of administrative bodies. The text clarifies that the board does not have to choose the vendor, but understand how much it costs, in terms of risk, to be unable to do without it. Non-fungibility, it adds, is often a condition the company has built up over the years.
Limits to know
The full cause has not been confirmed. We only have Microsoft's statements, pending the post-incident report. It is not clear whether the company has logs to rule out malicious activity, since it did not respond to TechCrunch. The overall impact, Wired notes, may never be fully known. The governance reading is an opinion from Cybersecurity360, not a specific regulatory obligation.
What changes for those who work digitally
If you use Microsoft 365, the first step is to map your dependencies, from business functions to services and vendors. Hidden links often surface, such as apps that rely on centralized identity. Then you need to estimate the time and cost of an exit, without duplicating everything, because redundancy is expensive and adds complexity. Also check your SLA credits and compare alternatives, for example with the guide on Google Workspace and Microsoft 365.
Our take
We share the basic approach. Blaming the cloud alone is convenient, but a vendor can fail and the company remains responsible for its own choices. The risk is turning NIS2 into paperwork to file away. The weak point is that for a small business a complete exit plan can be impractical. Even so, writing down what you accept is better than discovering it during an outage.
Frequently asked questions
Was Microsoft's November 2026 outage a cyberattack?
No, according to Microsoft. The company described a technical problem unrelated to cyber threats or AI and said it has no evidence of malicious activity. These are statements pending the full report.
How long did the outage last?
Kentik measured the return of traffic after about 18 hours of disruption. Wired reports a 24-hour interruption, with recovery still partial. Timing varies by region and service.
Which Microsoft services were affected?
Many. TechCrunch cites Outlook, Teams, files and documents, Copilot, Defender and the Intune admin panels. Some users also had problems with Windows cloud PCs.
Does NIS2 forbid relying on a single major vendor?
No. According to Cybersecurity360, NIS2 does not impose a technology model nor prohibit concentration. It requires structured management of risks, the supply chain and the responsibilities of governing bodies.
Do you need a multi-cloud plan?
Not necessarily. The source explains that redundancy has costs and can add complexity and security risks. What matters is knowing the alternatives and deciding consciously which dependencies to accept.
The post-incident report and the choices to put in writing
In the coming weeks, the full report Microsoft has promised will matter. So will how well your company can document its own dependencies.
- Read Microsoft's post-incident report as soon as it is published and compare the stated cause with what has emerged so far.
- Ask management to approve in writing which dependencies you accept and which you want to reduce.
- Run an exit test on identity or email alone, to estimate real timelines and resources.
Sources
- cybersecurity360.it, Microsoft down, il vero problema non è il cloud – è chi ha deciso di dipenderne
- wired.com, Microsoft 365 Crawls Back to Life After a 24-Hour Outage
- punto-informatico.it, Il down di Microsoft ha riportato in vita i fax
- techcrunch.com, Microsoft’s latest email outage turned into a full-blown global cloud crisis
