What Infotech advised
Infotech advised CIOs to confirm that business-critical workflows, integrations and security controls had recovered before telling their organisations that normal operations were restored, the company said. The research and advisory firm set out the guidance in a note, Microsoft 365 Outage: Immediate Actions for CIOs, and also recommended that organisations document disruption and keep evidence for possible service level agreement claims.
Kate Wood, AVP of Research Development at Infotech, said CIOs needed a clear basis for telling the business it could return to normal operations, including which critical processes had been tested, where security coverage still needed checking, and which teams would keep using workarounds.
What went down, and when
The outage began on the afternoon of November 12 with Exchange Online mailbox access failures in the Americas and affected functions in Teams, SharePoint, Copilot and Defender. That night, servers that had returned to service failed again under load, and Microsoft added capacity and began rolling back a recent network change. In a midday ET update on November 13 cited in the note, availability was improving but intermittent issues persisted and Microsoft had given no restoration time. Microsoft had reported no evidence of malicious activity and the root cause was still under investigation, according to the note.
Phishing risk and SLA claims
Infotech warned that during previous large-scale outages threat actors had impersonated Microsoft support staff and promised to restore access, and advised organisations to warn employees about phishing, credential harvesting and deepfake voice and video calls. It said security monitoring and policy enforcement functions, including service-related logging and policies, should be checked for coverage gaps. Service credits are not automatic, the firm said, and claims generally require evidence of customer-specific impact rather than confirmation of a widespread outage, so service-health advisories and records of actual disruption should be preserved and reviewed by vendor management and legal teams.
Where continuity held
The note said contingency plans held where a manual route existed and stalled where email was the only channel, and that core Teams messaging and meetings and direct SharePoint file access remained largely operational. News reports cited in the note described delays to patient referrals and court communications. Infotech recommended logging unresolved issues and failed workarounds throughout recovery, and testing continuity procedures against prolonged outages spanning several cloud services to find where reliance on a single cloud environment creates shared points of failure.
