A recent outage in Microsoft 365 prompted technology experts to warn companies in the United Arab Emirates (UAE) about serious operational risks associated with relying on a single cloud platform without a backup plan.
Microsoft reported that its servers failed automated health checks and did not detect signs of an attack. Andreas Hasselfloh, CEO of Ombori, noted that such an event is one concerning reliability that 'can happen with any major provider.'
Experts emphasized that Microsoft 365 underpins much more than just email. According to Hasselfloh, the service is central to communications, document handling, login processes, and approvals, meaning applications dependent on it for access may also halt.
Mori Haber, Chief Security Advisor at BeyondTrust, stated that companies could simultaneously lose access to Outlook, SharePoint, OneDrive, and Teams. For firms in the UAE operating across different time zones, even a few hours of downtime can disrupt transactions, client interaction, and decision-making far beyond a single workday.
Haber expressed concern not about the fact of the Microsoft failure itself, but that many organizations have built their entire productivity ecosystem around one vendor, 'without adequately planning for a failure scenario.'
Chris Miglino, CEO of Axe Compute, added that the outage also disabled Copilot, stopping AI-powered features for drafting, summarizing, and searching documents. This is particularly relevant in the UAE, where a Microsoft study showed that generative AI usage reached 73.3 percent among the working-age population in the second quarter, the highest figure in the global ranking.
Miglino noted: 'The deeper the integration, the larger the portion of work that an outage halts.'
Experts agreed that healthcare and government institutions are among the most vulnerable, although they differed on other sectors. Hasselfloh pointed out that education is at risk because an outage affects many students and teachers simultaneously, and delays occur in real estate regarding documentation, approvals, and client communication.
Haber included the banking sector among the most vulnerable, while Hasselfloh observed that core payment systems usually operate separately, so the impact on them mainly concerns internal workflows and customer service.
They stressed whether the loss of productivity tools or the ability to provide necessary services is the key issue. Haber cited a hospital example: losing collaboration tools is inconvenient, but losing access to systems essential for patient care can become a safety issue.
Hasselfloh believes that the loss of man-hours constitutes the smallest part of financial losses. A more significant expense is business that cannot be conducted during downtime, such as delayed property transfers, missed financial approvals, or unclosed customer request queues. He advised companies to assess downtime costs based on business functions, as one missed approval can cost more than a day's office productivity loss.
Hasselfloh described the level of preparedness as uneven. Haber noted that organizations have invested heavily in cybersecurity and digital transformation, but operational resilience has not received the same attention. Both experts agreed that backups are of little use if employees cannot log in, access applications, or communicate.
Haber warned: 'If your emergency communication, identity management, and recovery procedures depend on the same unavailable cloud provider, your recovery plan has a fundamental weakness.'
Hasselfloh added that AI-driven attacks are accelerating, referencing a CrowdStrike October report stating that probable agent intrusions in this half-year are occurring about three times more frequently than in the first half of the year.
The experts proposed several measures: creating an emergency communication and administrative access channel independent of the failing platform; regularly testing long-term cloud outage scenarios; determining how long the business can function in a degraded mode; and developing continuity plans covering critical AI workloads, including their location and what will take over in case of service failure.
Hasselfloh reported that Ombori's PhyGrid and PhyStack platforms help companies own and control more systems they cannot afford to lose, alongside private infrastructure and locally hosted AI models. He added that cloud providers remain part of the overall picture.
BeyondTrust offers privileged access management, secure remote access, and remote support to maintain the availability of emergency accounts during disruptions. Haber clearly stated that the company does not replace Microsoft 365 or restore inaccessible email.
Miglino, whose company provides dedicated GPU power for AI workloads, said that as enterprises transition from pilot projects to AI production, 'the reliability of the underlying power will carry as much weight as the model itself.'
Haber summarized the lesson: the question is not whether Microsoft will have another outage, but whether enterprises can continue operating when it happens, regardless of which provider is affected.
