The Microsoft outage offers three lessons. Disrupting what works isn’t one of them

On November 13, Microsoft experienced a major outage, leaving businesses and governments worldwide scrambling to maintain operational functions. This incident provides three key lessons:

Firstly, critical public-facing services, especially those involving high volume, time sensitivity, or high risk, must have built-in redundancies. Airlines and trading firms encountered significant disruptions, with some resorting to low-tech alternatives like fax machines, while air travel was temporarily rerouted via email. However, these temporary fixes are not reliable long-term solutions for vital services.

The core issue lies in organizations' reliance on Microsoft's 365 suite, which offers efficiency but also creates dependency risks.

Secondly, nations should refrain from hastily demanding greater localization of digital services. While localisation may seem appealing, it doesn't necessarily equate to better, more secure, or cost-effective outcomes. The Chinese example illustrates this, as their Alibaba Cloud outages in 2023 disrupted widely used applications like Taobao and DingTalk.

Simply switching to domestic providers doesn't eliminate concentration risks; it merely shifts the responsibility. While there may be strategic or security reasons for developing domestic technology, these objectives shouldn't be conflated with operational resilience. Ultimately, a provider's origin offers little insight into the reliability of its services.

Lastly, the Microsoft outage underscores that regulators and businesses must prioritize operational resilience. However, this should not be an excuse for localization mandates or poorly conceived competition interventions that undermine the very efficiencies users rely on. The critical takeaway is that the services we depend on must be resilient to failure, irrespective of their provider.

Meghna Bal, Director of the Esya Centre, emphasizes the importance of learning from this incident to ensure that dependant services can withstand disruptions, regardless of the entity providing them.