Microsoft 365 Outage: Keeping Operations Running When the Systems Around It Fail

At BlackBerry, one principle sits above the rest. Governments and critical infrastructure operators need their operations to keep going through attacks, outages and crises, without handing control to anyone else. 

The Microsoft 365 outage that began on November 12 was another example of why. The outage didn't just disrupt business systems. It also knocked emergency communications and coordination systems offline. Microsoft says it has no evidence of malicious activity. That said, the cause matters less than the pattern: when communication and coordination all sit in one place, they fail together, often at the moment they are needed most. 

The lesson is simple: one provider should not run all your communications. Mission continuity depends on a separate channel that keeps working when your primary platform goes down, so leaders can still reach their people and direct the response when the main platform fails. 

Plan for Degraded Mode 

Many continuity plans focus on how fast service comes back. Mission continuity plans also need to keep operations running while systems are down, when the network is denied, disconnected, intermittent or limited, whatever the cause. An outage at the primary provider creates that condition inside the organization with no adversary involved. The question in every scenario is the same: when the platform you work on goes down, what keeps working? 

Plans break down when the backup lives on the same platform as the primary. If the crisis call, staff alerts, contact roster and sign-in codes all run through one provider, the backup plan fails with the primary

Closing that gap takes more than a second platform. A contingency path that keeps the mission going has to meet a short list of requirements, and each one must hold while the primary is down. 

What a Mission Continuity Plan Must Deliver 

• Leaders need verified identity on the contingency path. When official tools go down, staff reach for personal email and consumer apps, which have no identity checks and no records.  

• Secure voice and messaging should run on the organization's own servers or in a national cloud. The system also needs to protect information about who talked to whom, because that pattern is intelligence an adversary can use.

• The backup cannot share sign-in, admin tools or devices with the primary. If it does, one outage takes out both, and that includes alerting that sends through email or collaboration tools. 

• Alerting has to reach every channel and device and report back who received it. Command needs to see who is safe and coordinate the response from that picture. 

• Security claims need proof from independent authorities, such as NIAP Common Criteria certification, listing on the NSA CSfC Components List and FedRAMP authorization for cloud services. Users outside the US should ask for the certifications that apply in their own jurisdiction. 

• Coordination needs more than one route. Voice and messaging that adapt across carriers, Wi-Fi, PBX and international networks keep getting through when one route degrades, and on-premises or air-gapped alerting keeps working inside its enclave when outside connectivity fails. 

None of this asks organizations to abandon the primary platform, which is highly reliable. The point is separation. A contingency path the organization controls, whether on premises, in a national cloud or air-gapped, may be susceptible to failure for different reasons than the primary, and that difference keeps the mission going. 

Where to Start 

The next step is small. List which critical workflows depend on the primary platform, including the sign-in and admin tools underneath them. Then run a tabletop exercise that assumes the primary is gone for 24 hours and record every step that stalls. 

Use the exercise to answer these questions: 

• Is your degraded-mode plan tested, or does it assume the primary platform is up? 

• How do you alert staff, and can you confirm who received it? 

• Does your backup share sign-in or admin tools, or devices, with the primary? 

• When the primary is down, how do your leaders talk securely? 

The requirement worth funding is a narrow one. The people running critical operations need a path that does not fail with the primary, so the mission keeps going whatever the systems around it do. 

Start planning for effective degraded-mode operations.