Late on Thursday afternoon, UK time, Outlook and much of Microsoft 365 stopped working for customers in dozens of countries, and on Friday the service was still only partly restored. What does a business actually do when email stops? Often the honest answer is that the system it can least do without is one it neither owns nor controls, and has no plan for losing.
Microsoft's first public line was that it was "investigating reports of users experiencing issues". That undersold an incident that drew more than 120,000 Downdetector reports in the US alone, with reports coming from 74 countries and territories, disrupted government systems in Australia, Japan and the US House of Representatives, and led Richemont to delay its results announcement slightly. Later updates were more candid, and Microsoft said it was not aware of any malicious activity.
Email became the system of record by default
A generation ago, client instructions arrived by phone and documents by fax. Email replaced both, gradually, and somewhere along the way it stopped being a way of communicating and became the place where the work lives: instructions, approvals, invoices, supplier confirmations and the audit trail. Very few firms decided that. It happened by habit.
It is also how other systems check who you are. A business whose own work has nothing to do with Outlook may still have services that send login codes, two-factor prompts or password resets to an inbox. Where they do, an email outage can block sign-in or account recovery for the bank portal, the accounting package or the CRM. The NCSC's guidance treats the email account as the recovery route for everything else, warning that anyone who gets into it could "reset all your other account passwords".
The infrastructure underneath has concentrated too. The CMA found that Microsoft and AWS each held 30 to 40% of UK cloud infrastructure supply in 2024, and that fewer than 1% of cloud customers switch provider in a year. Those figures cover the infrastructure layer rather than office software, but they show how concentrated the layer underneath has become.
So what caused Thursday's outage? Well, very briefly, Microsoft said the problem was not a surge in traffic but "a large number of servers being unexpectedly unavailable", which pushed the load onto the machines that were left. For an owner-manager the cause matters less than the duration, and the duration is set entirely by someone else.
Now the same is happening with AI
The same migration is now underway with AI, taking on tasks that used to need a person. In my conversations this year, the firms using AI's most advanced features are buying them rather than building their own, either Claude Enterprise from Anthropic or Microsoft Copilot's agentic features, and fitting their processes around what those products do well.
Buying is usually the sensible choice for a firm without its own AI team. The cost is that the vendor's way of working gradually becomes the firm's operating model, and nobody ever signs that decision off. Stacklok, which sells tooling designed to reduce this kind of lock-in, surveyed 520 technology leaders at large North American companies last month: 81% said the big AI labs and cloud providers make it hard to move between vendors, and 53% named integrations as one of the two hardest things to move. Smaller UK firms building Copilot agents around client work are likely to face the same pull with far less IT support.
This matters most when AI starts to drive decisions on headcount and spend. If a firm stops replacing the person who knew how invoices were chased, because an agent now does it, the process knowledge has moved to a supplier. That may be the right trade. It should be made knowing who keeps the know-how and how the work continues on the day the agent is unavailable.
Adoption is already broad. The ONS found that 30% of UK businesses used at least one AI technology in September 2026, broadly stable since June but up from 9% in 2023, and Microsoft passed 30 million paid Copilot seats in the quarter to June. My own view is that the operational change firms go through in the next five to ten years will be bigger than anything in the last 50, the dot-com boom included. The OBR's November 2025 assessment is more measured, treating AI as a gradual lift to productivity rather than a step change, but those are different measures. Modest gains in national productivity can sit alongside a great deal of restructuring inside individual firms, and that restructuring lands first in processes and job roles, which is why change management is going to be key.
Microsoft is usually very reliable
I appreciate that, on average, it is. Microsoft 365's worldwide uptime was at or above 99.9% in every quarter from 2013 to 2025, and it recovered to 99.994% in the second quarter of this year. Running two of everything costs money and adds failure points of its own.
However, average reliability is materially different from the bad day. Uptime fell to 99.526% in the first quarter of 2026, the lowest since Office 365 for IT Pros began tracking it in 2013, equivalent to roughly ten hours of interruption across the worldwide service. Between 31 August and 3 September an authentication fault hit Exchange Online hardest, with Teams, OneDrive, SharePoint and Copilot also affected, and by Microsoft's own timestamps it was about 73 hours from acknowledging the incident to declaring it fully mitigated. Microsoft's service level agreement pays out in service credits against the subscription, which is a refund on the fee rather than cover for a lost day's work. So the useful question for an owner-manager is which parts of the business stop when Microsoft stops, and for how long the business can live with that.
What owner-managers should do
Every business has parts of its operating model it can't live without. Find out which they are, and plan for the day they are unavailable.
- Write down what stopped on Thursday while it is fresh: what the team could not do, which logins failed, how long it took to notice, and what workarounds people used.
- Document the procedures for the processes that keep cash moving (quoting, onboarding, invoicing, credit control, payroll), including the manual route, and keep a copy somewhere that does not depend on the same platform.
- Draw the operating model on one page: who does what, on which system, and what depends on what, including which systems send their login codes to which inbox. If the honest answer to "where does this live?" is "in someone's inbox", that process has a single point of failure.
- Build a list of critical suppliers and the sub-processors behind them. Data processing contracts are a good starting point, since UK GDPR (Article 28) requires processors to have the controller's specific or general written authorisation before engaging another processor, but the list should cover every supplier the business cannot operate without, including which AI tools sit on top of which platforms.
- Pick one critical process, name the person responsible, decide how long the business could tolerate it being down, and test the fallback with the main platform switched off. Until it has been tried, the plan is just a document.
- Before the next big decision on spend, hiring or systems, get an independent view of that one-page model. Someone from outside is more likely to notice a dependency the team takes for granted.
A note for accountants, lawyers and IFAs
You see inside more owner-managed businesses than most outsiders do. A resilience review can be a hard sell, but three questions from a trusted adviser at the next review meeting are not: are the procedures documented, is there an operating model, and does the firm know who its critical suppliers and sub-processors are? Any critical process that has never been tested without its main platform is a reason to look further.
Apex Intelligence provides that independent view of an owner-managed business's operating model: where the single points of failure are, what a workable fallback looks like, and what to settle before committing spend or changing headcount. If Thursday raised questions about your own business, or you would like to introduce a client, request a conversation.
This article is general commentary and does not constitute financial, legal or tax advice.