When a global technology platform stops responding, the disruption extends far beyond IT. It reveals how dependent modern business operations have become on shared infrastructure.
A significant Microsoft 365 service disruption was reported on 12–13 November 2026, affecting access to cloud services and disrupting communication and collaboration for organisations dependent on Microsoft's ecosystem.
Reports described problems involving Outlook and Exchange Online, with knock-on effects for workflows connected to other Microsoft 365 services. Microsoft's investigation and restoration work were continuing during the incident. The final technical cause and full scale of impact should be distinguished from preliminary updates.
A shared platform, a shared business risk
Microsoft 365 is more than an email platform. For many organisations it supports communication, approvals, document collaboration and processes spanning departments, subsidiaries and external partners.
When one widely used service is disrupted, operational consequences can spread across companies and countries—even where internal business applications remain available.
This raises a question of governance: how much essential activity depends on technology infrastructure that a business does not directly control?
Why controls matter at a global level
A major outage highlights that technology control extends beyond preventing malicious attacks. It includes service availability, accountability, operational resilience, third-party dependencies, change governance and the reliability of business-critical processes.
International organisations face an additional challenge: different regions and subsidiaries may depend on the same cloud platform while operating under different local practices, policies and responsibilities.
Frameworks such as COSO, COBIT and ISO/IEC 27001 provide perspectives on governance, risk management, accountability and control effectiveness. They do not guarantee uninterrupted service, but they help clarify what must be governed, assessed and evidenced.
The IT audit perspective
An IT audit is not limited to checking whether applications function normally. It examines how technology dependencies are understood, who owns the associated risks, and whether oversight and control arrangements can be demonstrated.
The Microsoft 365 incident is a reminder that reliance on a common provider can create concentrated operational exposure across the global economy.
Global connectivity creates global dependencies—and those dependencies demand mature, consistent governance.
Sources and further reading - Associated Press — Microsoft outage reporting - University of Pennsylvania — Microsoft 365 incident notices - Deutsche Welle — Microsoft outage coverage - NIST — Cybersecurity Framework
.....................................