# Microsoft 365 Went Down in 70+ Countries: Build Your Outage Plan Before Next Time

A Microsoft 365 outage hit email in 70+ countries and Marsh Re expects minimal insurance losses, so you absorb it. Build a free outage plan and check your policy.

Author: J.A. Watte
Published: November 14, 2026
Source: https://jwatte.com/blog/microsoft-365-outage-small-business-continuity-plan/

---

On November 12, a Microsoft 365 and Outlook outage knocked out email and other apps across more than 70 countries. According to NPR, it disrupted Australia's spy agency and federal police. If an intelligence service can't send email for a stretch of a working day, a 12-person firm with no backup isn't going to fare better. The next day, a separate failure in the FAA's legacy telecommunications network grounded flights nationwide for roughly five hours. Two single points of failure in two days, with no connection between them.

Here's why an owner should care now. The people who write the policies that might pay for this expect to pay very little. Marsh Re's read is that the insurance market impact will be minimal, because the losses were uneven and mostly short-term productivity and operational delays. That's an accurate description of the damage and also a warning: the cost of a day without email is real, and it mostly lands on you. Your insurer isn't the backstop here unless you've checked the wording.

This piece walks through what happened, who's exposed, and a plan you can build this week with free tools and about a day of effort. It doesn't require buying anything.

## What happened

The facts below come from public reporting. The framing and the weighing of it come from Apprised.news desk briefs, which are AI-written analysis of that reporting. The most relevant pages are the [tech desk brief](https://apprised.news/desk/tech/2026-11-13) and the [insurance desk brief](https://apprised.news/desk/insurance/2026-11-14). Check the original sources before you rely on any single number.

- **The outage.** [NPR reported](https://www.npr.org/2026/11/12/nx-s1-6039343/is-outlook-down-widespread-outage-hits-microsoft-email-and-other-apps) a widespread Microsoft 365 and Outlook outage hitting email and other apps. [GMA News carried the report](https://www.gmanetwork.com/news/topstories/world/1009366/australia-s-spy-agency-federal-police-hit-by-microsoft-outage/story/) that Australia's spy agency and federal police were affected.
- **The scale claims.** Apprised's tech desk notes that a Univision (KDTV) newscast cited an estimated global economic impact of about $50 billion, and that Telemundo said the outage paralysed essential services for nearly 24 hours, including police reporting systems. Treat those as broadcast estimates, not audited figures. Microsoft's post-incident report, including the cause and Australia's priority-restoration agreement, is still pending, per the [tech desk brief](https://apprised.news/desk/tech/2026-11-13).
- **The insurance view.** [Reinsurance News reported](https://www.reinsurancene.ws/marsh-re-expects-impact-of-microsoft-365-outage-on-insurance-market-to-be-minimal/) that Marsh Re expects minimal market impact, citing the uneven nature of the outage and losses mostly limited to short-term productivity and operational delays. Apprised's insurance desk adds an argument worth keeping in mind: dependency exposure rests on contract wording, not on a catalogue of events. Its stated reversal trigger is a carrier disclosing a single-vendor event that produced aggregated business-interruption claims above ordinary waiting periods. That hasn't happened yet.
- **The FAA stop, which is a separate event.** [Nextgov reported](https://www.nextgov.com/modernization/2026/11/legacy-tech-issue-led-faas-nationwide-ground-stop/417232/) that a legacy telecommunications issue in the FAA network forced a nationwide ground stop of roughly five hours, with more than 10,000 flights delayed and no sign of a cyberattack or any link to the Microsoft outage. [The Washington Examiner reported](https://www.washingtonexaminer.com/policy/infrastructure/4803767/duffy-congress-50-billion-faa-outage/) that the Transportation Secretary urged Congress to provide $50 billion to replace legacy air traffic control systems.
- **The regulatory angle.** [The Federal Reserve announced](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20261113a.htm) that federal bank regulators extended the comment period on interagency third-party risk guidance to December 16. Apprised's insurance desk flags that deadline as relevant to cloud concentration.

One caution from the desk briefs: both events were treated as operational failures, not attacks. Don't read more into either one than the reporting supports.

## What it means for a small business

You're exposed in a specific way: when one vendor carries your email, calendar, files, calls and sign-in, one failure stops all of those at once. Large organisations have a second path. Most small firms don't. The three examples below are hypothetical, with numbers you can swap for your own.

### A 12-person accounting firm in March

Outlook is down for most of a business day. Each of the 12 staff loses about 6 hours of work that depends on email and shared files, at an average billing value of $95 per hour.

12 people × 6 hours × $95 = $6,840. Say a third of that work gets done anyway by phone or on local files, so roughly 4 hours per person is truly delayed: 12 × 4 × $95 = $4,560. Call the real delay somewhere between $4,500 and $6,800 of billable time pushed back or lost.

The firm's policy has a 12-hour waiting period. The outage lasted under 12 hours, so nothing is payable. Now rerun it with a free secondary email path. If staff had a second address and a contact list on their phones, say they recover 3 of those 6 hours. That's 12 × 3 × $95 = $3,420 recovered on one bad day, for a setup that takes an afternoon. The recovery number is your argument for doing the work.

### A dental office with 4 front-desk staff

The office books through Microsoft Bookings and confirms by Outlook. During a 5-hour outage it can't send 40 same-day or next-day confirmations. Suppose 6 of those 40 patients no-show because nobody reached them. At $250 per missed appointment, that's 6 × $250 = $1,500.

The fallback is a phone tree and text script. Printing tomorrow's schedule each afternoon (a standing 15-minute task) lets staff call or text without the booking system. Fifteen minutes a day for a front-desk person at, say, $22 an hour is about $5.50 a day, or roughly $1,400 over a 250-day working year. That's close to the cost of one bad outage day in no-shows. It's a judgement call, and the sensible middle path is to do the printout only on days with heavy bookings.

### A 30-person contractor with everything in OneDrive and SharePoint

Estimates, plans and invoices all live in the cloud. When access drops, crews on site can't open plans and the office can't send invoices. Map what each person can still do offline: estimators need current plan sets, project managers need the schedule and contact sheet, the office needs the invoice template and the open-invoices list.

The practical fix is a short list. Pick the 20 files people can't work without (active plans, the master schedule, the client contact sheet, templates), and keep a synced local copy on each laptop and a printed copy of the contact sheet in the truck. Twenty files is a number a person can actually maintain. Two hundred is not.

### A 5-person marketing agency reading its cyber policy

The question is whether the policy covers dependent business interruption, meaning loss caused by a third-party provider's outage, not your own network. Take a sample policy with an 8-hour waiting period against a 5-hour outage. The outage never crosses the waiting period, so the payout is zero regardless of how much work was disrupted.

Also check the sub-limit. If dependent-business-interruption cover is sub-limited to, say, $25,000 and your daily gross margin at risk is $6,000, a multi-day outage hits the ceiling quickly. Many policies also exclude or narrow cloud and provider failures. Don't guess. The cover, the waiting period (often 8 to 24 hours), the sub-limit and the exclusions are all in the document, and your broker can confirm them in writing.

## What to do this week

1. **List what stops.** Write down every function that stops if Microsoft 365 is down: email, calendar, Teams calls, file shares, your phone system if it runs on Teams, e-signature, invoicing, booking.
2. **Set a fallback for each.** A second free email address staff can use, a shared contact list exported to phones, a text and voicemail script for clients, and an offline-synced copy of your 20 most-used files.
3. **Write the notices now.** One page: an outage message for clients and a short status line staff all use, so everyone says the same thing. Templates are in the kit below.
4. **Learn to tell provider from network.** Bookmark the Microsoft 365 service health page and one third-party status monitor, and subscribe to alerts. Then you know it's the provider before you start rebooting routers.
5. **Read your policies.** Look at your cyber and business-interruption cover for dependent business interruption, the waiting period, sub-limits, and exclusions for cloud or provider outages. Then email your broker the specific question and keep the reply.
6. **Run a one-hour test.** Block an hour with email and Teams unavailable and record what breaks. Cost it using the arithmetic above. A test beats a plan nobody has tried.
7. **Check your email setup while you're at it.** If your fallback address will send from your domain, make sure your records are right with the [DNS and email audit](/tools/dns-email-audit/), and use the [DNS records generator](/tools/dns-records-generator/) if you need to fix anything. Check whether your staff addresses have shown up in a known breach with the [email breach check](/tools/email-breach-check/).
8. **If you serve banks or regulated clients,** expect third-party and cloud-concentration questions. The December 16 comment deadline on the interagency guidance suggests those questions are coming.
9. **Don't assume an outage is an attack.** Wait for provider confirmation before resetting passwords or taking systems offline. Neither the Microsoft outage nor the FAA stop was reported as an attack, and a panicked password reset during a provider outage creates its own mess.

## Copy-paste prompts

Work from your own documents and numbers. Each prompt tells the AI to say when it's unsure, so you can catch it guessing.

Use this when you want a first draft of the plan:

```text
Act as a business continuity consultant. I run a [type of business] with [number] employees and use Microsoft 365 for email, files, Teams and phones. Build a one-page outage plan covering the first hour, a 4-hour outage and a 24-hour outage, with who does what and what clients are told. Base it only on the details I give you. If you need a fact I haven't provided, ask me instead of assuming it, and tell me which parts of the plan you're least sure of.
```

Use this when you have your policy text in front of you:

```text
Here is the text of my cyber insurance policy: [paste]. Identify the sections on business interruption, dependent or contingent business interruption, waiting period, sub-limits and exclusions for third-party or cloud provider failure. Explain in plain English whether a 6-hour Microsoft 365 outage would be paid. Quote the exact wording you're relying on for each point. If the policy text is unclear or a section is missing from what I pasted, say so rather than guessing, and list the questions I should put to my broker in writing.
```

Use this when you want to cost an outage with your own figures:

```text
Help me estimate the cost of a 6-hour email and file outage. I have [number] staff, an average loaded hourly cost of [amount], [percent] of their work depends on Microsoft 365, and [number] client appointments or deadlines per day. Show the math step by step and separate what is lost from what is only delayed and recoverable. State every assumption you make, and flag any figure that would change the result a lot if I got it wrong.
```

Use this when an outage is happening or you want messages ready in advance:

```text
Draft a short client message and a short staff message for use when our email provider has a widespread outage. Include an alternate contact method [insert phone or second email], a promise of follow-up by [time], and no technical jargon. Keep each under 90 words. Do not state a cause or an expected restoration time, because we won't know them. Offer two tone options, calm and apologetic, and note which suits a [type of business].
```

Use this when you're building the dependency inventory:

```text
Make a dependency map of my business tools. I will list the tools, who uses them and what happens when each fails: [paste your list]. Rank them by impact on revenue and on client contact, and suggest the cheapest fallback for the top five. Use only the tools and facts I've listed. If something I've told you is ambiguous, ask a question before ranking, and mark any ranking that is a judgement call.
```

## Download the kit

The kit is a printable markdown file with a dependency checklist, an outage cost worksheet using the formulas above, a one-page response runbook, client and staff message templates, a policy-review list of questions for your broker, and an offline-copy checklist for your critical files. It also includes the prompts. Download it here: [Single-Vendor Outage Kit for Small Business](/downloads/microsoft-365-outage-small-business-continuity-plan-kit.md).

## Fact-check notes and sources

- **Apprised tech desk, 2026-11-13**: analysis page covering the Microsoft 365 outage, the broadcast cost and duration claims, and the pending Microsoft post-incident report. [link](https://apprised.news/desk/tech/2026-11-13)
- **Apprised insurance desk, 2026-11-14**: analysis page covering Marsh Re's minimal-impact read, the contract-wording argument on dependency exposure, and the reversal trigger. [link](https://apprised.news/desk/insurance/2026-11-14)
- **Apprised defense desk, 2026-11-14**: analysis page noting the FAA stop and the DHS statement that there was no threat to the public. [link](https://apprised.news/desk/defense/2026-11-14)
- **Outage reporting**: NPR on the widespread Microsoft 365 and Outlook outage. [link](https://www.npr.org/2026/11/12/nx-s1-6039343/is-outlook-down-widespread-outage-hits-microsoft-email-and-other-apps)
- **Government agencies affected**: GMA News on Australia's spy agency and federal police. [link](https://www.gmanetwork.com/news/topstories/world/1009366/australia-s-spy-agency-federal-police-hit-by-microsoft-outage/story/)
- **Insurance impact**: Reinsurance News on Marsh Re's minimal-impact expectation. [link](https://www.reinsurancene.ws/marsh-re-expects-impact-of-microsoft-365-outage-on-insurance-market-to-be-minimal/)
- **FAA ground stop**: Nextgov on the legacy telecommunications cause, roughly five hours, more than 10,000 flights delayed, and no sign of a cyberattack. [link](https://www.nextgov.com/modernization/2026/11/legacy-tech-issue-led-faas-nationwide-ground-stop/417232/)
- **FAA funding request**: The Washington Examiner on the $50 billion request. [link](https://www.washingtonexaminer.com/policy/infrastructure/4803767/duffy-congress-50-billion-faa-outage/)
- **Third-party risk guidance**: Federal Reserve press release on the extended comment period to December 16. [link](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20261113a.htm)
- **Illustrative figures**: every dollar figure in the three worked examples and the policy example is a hypothetical for demonstrating the arithmetic. The $50 billion global impact estimate comes from a television newscast cited by the tech desk and is unaudited.

## Related reading

- [The FBI Logged $20.9 Billion In Internet Crime Losses Last Year](/blog/blog-ai-fraud-reflexes-smb-2026/): the other half of keeping staff calm during an incident, which is not acting on a panicked message.
- [Build a Small-Business AI Front Desk](/blog/blog-ai-agents-inbox-small-business/): useful if your fallback plan includes a sorted shared inbox.
- [Wall Street Is Betting on the Wrong AI Layer](/blog/blog-boring-ai-layer-decides-smb-margin/): a related look at where small-business dependency and margin actually sit.
- [Isolating IoT Devices On A Consumer Router](/blog/iot-network-isolation-consumer-router/): if you test an offline hour, your own network layout matters, and this helps you understand it.
- [MyClaw, Microsoft, And The Honest Answer For Small Operators Who Want An AI Assistant](/blog/blog-myclaw-openclaw-small-business-ai/): worth reading before you add one more vendor dependency.

*This post is informational, not legal, financial or security-consulting advice. It draws on AI-written Apprised.news analysis of public reporting; check the linked sources before acting. Mentions of third parties are nominative fair use. No affiliation is implied.*


---

Canonical HTML: https://jwatte.com/blog/microsoft-365-outage-small-business-continuity-plan/
RSS: https://jwatte.com/feed.xml
JSON Feed: https://jwatte.com/feed.json
Hero image: https://jwatte.com/images/microsoft-365-outage-small-business-continuity-plan.webp