Microsoft disruption exposes risks of relying on single provider: Experts

Microsoft 365 outage disrupted workplace services worldwide and in India, exposing cloud dependency risks as experts urged Indian businesses to strengthen disaster recovery and diversify providers

The global disruption of select Microsoft services beginning November 12 has once again raised questions about the reliability of cloud-based infrastructure and the risks of businesses depending on a handful of technology providers. The outage affected Microsoft 365 Business and Enterprise, and Consumer products, including Outlook, Exchange Online, SharePoint, and more. As the outage stretches to November 13, users across multiple regions face difficulties accessing essential workplace tools.

 

According to outage-tracking platform Downdetector, reports of problems with Outlook peaked at 138,058 on November 13. Microsoft acknowledged the outage and said its affected servers were unexpectedly becoming unavailable after failing automated health checks, adding to the load on the remaining infrastructure. The company said it was restarting affected servers and redistributing traffic, but recovery remained limited.

 

 

The outage also affected OpenAI's and Anthropic's Microsoft 365 connectors. Indian airline IndiGo reported disruptions to its email support services, although its flight operations remained unaffected.

 

Padma Reddy Sama, co-founder of Hyderabad-based cloud services provider BharathCloud, said the incident highlighted the risks of businesses depending on a limited number of technology platforms for essential operations such as email, collaboration and file sharing.

 

Why are technology outages becoming harder to contain

 

According to Padma, the increasing complexity of modern cloud infrastructure is one of the reasons large-scale outages are difficult to prevent and contain. Cloud platforms depend on interconnected systems involving software, networking, storage, virtualisation, security and automation. A failure in one component can affect several other systems that rely on it.

 

He identified configuration errors, software upgrades, inadequate change management, network failures, power disruptions, cooling system failures and hardware problems among the possible causes of infrastructure outages.

 

The 2026 Annual Outage Analysis by the Uptime Institute identified power outages as the leading cause of data centre disruptions. The report also noted deviations from established procedures as one reason for outages linked to human error. It also found that around two-thirds of publicly reported outages over the previous nine years involved third-party IT or data centre service providers.

 

Padma explained that the growing interdependence between applications and infrastructure components increases the possibility of disruptions spreading beyond the system where a failure originates. 

 

What are the impact of cloud outages

 

Cloud outages can affect several business functions because companies increasingly use the same infrastructure for communication, data storage, applications and other operations.

 

Padma said the immediate impact of a prolonged cloud outage is often felt in internal communication and collaboration. When employees lose access to email, video conferencing, shared files and enterprise applications, decision-making and coordination become difficult.

 

The impact can extend beyond office productivity. According to him, e-commerce companies may face transaction errors on their websites, healthcare providers may experience difficulties accessing patient systems, while logistics companies could face problems with tracking and scheduling.

 

Prolonged disruptions can also delay transactions, affect deadlines, reduce employee productivity and leave customers dissatisfied. Businesses may have to undertake additional work to reconcile transactions, integrate systems and process backlogs once services are restored.

 

He said disaster recovery planning should not focus only on how quickly systems can be brought back online. Companies must also consider the Recovery Time Objective (RTO), which determines how quickly services should be restored, and the Recovery Point Objective (RPO), which defines how much data loss a business can tolerate following a disruption.

 

Can AI help prevent outages or create new risks

 

As companies increasingly use artificial intelligence (AI) to develop software and manage technology infrastructure, the technology could help identify system failures but also introduce new risks.

 

Sunit Parekh, chief technology officer (CTO) for India at Thoughtworks, said AI-powered monitoring tools can identify unusual latency patterns, rising retry rates and configuration changes that conventional monitoring systems may miss. They can also correlate events across different services to help technology teams identify the likely cause of a disruption faster.

 

However, he said the effectiveness of such systems depends on the quality of monitoring data and clear human oversight. AI can reduce the time taken to detect and diagnose problems, but it cannot replace established engineering practices such as gradual software deployment and the ability to quickly reverse changes.

 

He also cautioned that AI-generated code could introduce defects, inconsistent coding practices or insecure dependencies into production systems if it is not properly reviewed.

 

Autonomous AI agents could add another layer of risk if they are given access to infrastructure and configuration tools. An incorrect action by an agent could spread across systems quickly.

 

Parekh said companies should retain human accountability for software deployments, enforce automated testing and security checks, and restrict AI agents' access to only the permissions required for their tasks. 

 

What does this mean for Indian businesses

 

The Microsoft outage has brought attention to the dependence of Indian businesses on global technology providers for everyday operations. Padma said Indian cloud providers could play a larger role in building the country's digital infrastructure and reducing dependence on a limited number of foreign cloud providers. However, he said the objective should not be to replace global hyperscalers but to diversify the cloud ecosystem by combining domestic and international providers for critical applications.

 

He added that domestic cloud providers would need to invest in highly available infrastructure, geographically diversified data centres, redundant network connectivity, security systems, disaster recovery facilities and customer support.

 

Physical presence in India alone would not be enough to make a domestic provider a reliable alternative, he said. Other requirements include greater interoperability, migration flexibility and stronger service-level agreements (SLAs). Businesses should be able to move applications between cloud providers without becoming dependent on the proprietary technologies of a single vendor.

 

India needs to develop a multi-cloud and hybrid-cloud ecosystem that allows businesses to manage costs, data and operational continuity more effectively. For companies, adopting a multi-cloud strategy can reduce dependence on a single provider, but it also involves additional costs and technical complexity. Businesses need to assess which applications require independent backups, alternative infrastructure and disaster recovery arrangements.

 

The Microsoft disruption has highlighted that adopting cloud services does not automatically eliminate operational risks. As Padma pointed out, no IT infrastructure is completely protected against failure. The focus, therefore, needs to shift from depending on a single provider to building systems that can continue functioning when one part of the infrastructure goes down.

 

Parekh, on the other hand, said companies should reduce single points of failure through multi-region infrastructure, backup options and multi-cloud arrangements for critical workloads. However, he cautioned that using multiple providers can increase costs and complexity.

 

Parekh also called for regular failure drills, reviews of service-level agreements and clear customer communication plans. He said resilience should become a board-level priority, particularly for India's financial services and public sector.