Your continuity plan probably assumes Microsoft never goes down

Thousands of New Zealand workers opened their laptops this morning to find email, chat, files and AI tools all unavailable at once. That simultaneous failure is the real story. A global Microsoft 365 outage is easy to dismiss as an IT inconvenience, but it shows how many firms have quietly let their entire operation run through a single vendor’s login layer.

One fault, every tool

NZ reports spiked at 6.30am NZT, with Stuff citing an estimated 130,000 users worldwide logging problems on Downdetector. NZ Police confirmed operations were affected, although frontline services were not. 2Degrees reported email issues, and Air New Zealand said its corporate office was hit while flights kept running.

RNZ counted more than 130,000 Outlook-related reports by Friday morning, with Teams, Exchange Online, SharePoint Online, Copilot 365 and Defender XDR all potentially affected. Microsoft blamed infrastructure “experiencing elevated load across multiple regions”. It had already resolved a separate Teams disruption in North America before the broader connectivity failure emerged, which suggests the problems were compounding rather than isolated.

The Microsoft 365 Status account said the company was “aggressively pursuing all pathways to reduce impact”, confirming Exchange Online mailboxes were failing across multiple connection methods. That is reassuring in tone. It does nothing for a business that cannot send an invoice, find a contract or join a client call.

This keeps happening

This is not a freak event. In March 2025, a global Outlook outage affected nearly 75,000 people worldwide. In October 2025, an Azure failure disrupted Air NZ’s payment processing and digital boarding, forcing manual processing, according to then-chief customer and digital officer Jeremy O’Brien. Police websites went down in the same incident, as did services as unrelated as Xbox Live, Costco and Starbucks.

The scope keeps widening. In 2025 it was mostly Outlook. Now it is the whole stack, including the AI tools businesses have spent the past year building workflows around.

The state has doubled down

Government shows how fast the dependency is deepening. The Post reported in July that spending on Microsoft software through the all-of-government arrangement had more than tripled over seven years to $306 million in the last full year, with $307 million already spent in the nine months to March 2026. The Public Service Commission credits uptake of Teams, Copilot and security tools, and notes vendors increasingly bundle AI features by default, then charge for them.

Inland Revenue went further. A briefing note released in February 2026 detailed a staged Copilot rollout from October 2025 aiming to give every staff member access by mid-2026. IR said then that it might be the only large agency doing so across its entire workforce. Productivity gains may be real. But the tax department has now wired its daily work into the same identity and infrastructure layer that just fell over.

Analysts have named the problem

Gartner told security chiefs in September that repeated multiservice Microsoft 365 incidents signal genuine concentration risk, and that organisations consolidating productivity, security and compliance into one vendor should reassess whether the convenience is still worth it.

Nikki Stone, principal at YQ Advisory, puts it bluntly. “You cannot blindly outsource operational continuity to a single vendor’s shared identity layer,” she says. Matthew Carr of Atumcell proposes a simple test: can your organisation function if its primary identity platform disappears for six hours? Tim Burke of Quest Technology Management adds the uncomfortable part. Most mid-market firms lack the leverage to negotiate custom resilience terms with Microsoft, so architecture, not contracts, is the only lever they have.

Heise’s Dr Oliver Diedrich frames it as sovereignty. “Sovereign is one who can continue to work when a provider fails,” he writes, arguing for independent communication channels, accessible emergency documentation and some software diversity.

A board question, not a helpdesk ticket

None of this calls for regulators to break up Microsoft or for businesses to abandon tools that make them more productive. Microsoft 365 is popular because it works most of the time, and bundling is cheaper and simpler than juggling five vendors. The answer is ordinary risk management.

That means keeping at least one communications channel outside the Microsoft ecosystem, so staff and key clients can be reached when Teams and Outlook are dark. It means storing offline copies of incident response plans and critical contacts, rather than in the SharePoint folder you cannot open. It means mapping which processes now depend on Copilot, because an outage now also takes out the meeting summaries, drafting and automation that teams have come to rely on. And it means running Carr’s six-hour test before the next outage runs it for you.

If your continuity plan assumes Outlook, Teams, OneDrive and Copilot will always be there, it is not a continuity plan. It is a dependency statement. Directors who would never accept a single supplier for a critical physical input have, in many cases, accepted exactly that for the systems their whole business runs on. With three major NZ-affecting incidents in under two years, the next one is a matter of when. The firms that treat today as a free rehearsal will be the ones still working when it arrives.

Sources

• Stuff: Global Microsoft outage hits NZ, with Outlook, Teams and other services affected (2026-11-13)
• RNZ: Global outage hits Microsoft’s Outlook (2026-11-13)
• 1News: Outlook down, global outage hits Microsoft apps (2026-11-13)
• RNZ: Tens of thousands affected as Microsoft Outlook, 365 down in global outage (2025-03-02)
• 1News: Air NZ systems disrupted by global Microsoft outage (2025-10-30)
• The Post: Government’s Microsoft bill balloons as tools become widespread (2026-07-23)
• Inland Revenue: Microsoft 365 Copilot rollout briefing note (2026-02-13)
• Reworked: Why your entire enterprise shouldn’t rely on a single login layer (2026-09-16)