Since Thursday afternoon, Microsoft 365 has been falling over. As I write this on Friday it is close to 24 hours, and Microsoft's updates still talk about "incremental improvement" with capacity not yet back to normal. Outlook, Teams, SharePoint, OneDrive, Copilot and Defender have all been on the list of affected services.

Companies everywhere are spending the day trying to stay signed in to Teams long enough to hold their meetings, and plenty of people can't get into Outlook to read their email. Claude had trouble with authentication this morning, and Cloudflare gave me an error page. I don't know whether either of those has anything to do with Microsoft, and that is part of the problem. When a handful of companies sit underneath everything, you can't tell whose failure you are looking at.

Cloudflare had its own bad night. Its status page shows Durable Objects, one of its developer services, returning errors in North America from 22:39 on Thursday to 03:44 on Friday. At 09:56 this morning Claude Code stopped me with "API Error: 403 Attention Required! | Cloudflare", which is Cloudflare's security page standing in front of Anthropic. Given its record, my first suspicion was that Cloudflare sat behind all of it. The timeline, as both companies tell it, points the other way: Microsoft's trouble started about six hours before Cloudflare's, and Microsoft describes a fault inside its own servers. Two of the companies everything rests on had a bad night at once, and from where I sit they looked like one outage.

Meanwhile my own meetings run on a Jitsi server I host myself, and it hasn't noticed a thing. The email that doesn't go through Microsoft keeps flowing.

Too big to fall over

We think of Microsoft, Google and Cloudflare as part of the landscape. They are everywhere, and surely nothing that size can be brought down. It can, and more often than we remember. An AWS fault in October last year took a large part of the web with it, and Cloudflare did the same a month later. Australia's Home Affairs minister has already compared this week to the CrowdStrike update of July 2024.

Microsoft's explanation has shifted as the hours went by. On Thursday it pointed to a surge of traffic in part of its infrastructure. By Friday it was saying that a large number of servers had failed their automated health checks and dropped out of rotation, overloading the ones left, and that an external surge in demand was not the cause. Restarting servers bought only brief relief, because the restored ones were swamped again. It says it has seen no sign of malicious activity.

Finding a fault in a system that size is hard, and I don't envy the engineers on it. Still, if Microsoft knew for certain what was wrong, I suspect it would have been fixed by now.

Two questions nobody can answer yet

At the end of October Microsoft offered voluntary redundancy to a group of staff that reportedly numbers about 60,000, roughly a quarter of the company. Is there a connection? I don't know, and nobody outside Microsoft does either. A company in the middle of asking a quarter of its people whether they would like to leave does have its attention on more than its servers.

The second question is about AI. Microsoft has put Copilot into everything it sells, and in April 2025 Satya Nadella said that maybe 20 to 30 percent of the code in the company's repositories was written by software. I'm not claiming that caused this, and there is no evidence it did. It is fair to ask how many people still know these systems well enough to fix them by hand when the assistant is down as well. The joke writes itself:

"Hey Copilot, what is wrong with my environment?"
"I'm sorry, Copilot has encountered an error."

What GitHub taught me

I learned this the hard way three weeks ago, when GitHub suspended my account without telling me. Within a minute I found out how much of my business I had tied to one vendor. Source, deploys, tests and releases all went dark together. By the next day this site was deploying from a Gitea server under my own roof.

Things break here too. In October the AI provider behind the chat on this site stopped accepting connections, and moving the chat to another provider needed a shell. Now it is a form in the admin pages. When my things break I find out why and fix them, on my own timetable.

Here is where things stand now. My meetings run on my own Jitsi. My code lives on my own Gitea. This site doesn't sit behind Cloudflare: nginx answers on its own address. My mail and my server are both with IONOS in the UK, which is still one provider, and I know it. The domain is mine, though, so if IONOS ever has a week like Microsoft's, the mail can move.

What owning it means

People call this sovereignty, or data sovereignty when they mean the data. In plain terms it means you decide where your data lives and which country's law can reach it.

That second part matters more than it sounds. Under the US CLOUD Act, an American provider can be ordered to hand over data it holds wherever the server stands, a data centre in the UK included. In June 2025 Microsoft France's director of public and legal affairs was asked under oath, in the French Senate, whether he could guarantee that French citizens' data would never reach the US authorities without France's agreement. He said: "No, I cannot guarantee it." Self-hosting doesn't make the question go away, because somebody still owns the building your server sits in. You do get to choose who that is, and to move when the answer changes.

It is also a financial decision. A subscription is rent: you pay every month for as long as you use it, and the landlord sets the price. On 1 July 2026 Microsoft raised the US list price of Microsoft 365 Business Basic from $6 to $7 per user per month, and Business Standard from $12.50 to $14. Open-source software you run yourself has no licence fee and no price per seat. You pay for the server and for the time it takes to look after it. That time is a real cost, and for a business with nobody to look after its systems, renting can still come out cheaper. In my experience, for most of what a small business runs, owning costs less over the years once someone knows how to look after it.

Then there is the contract. Microsoft 365 is usually bought on an annual commitment, and under Microsoft's current terms you can cancel or reduce your licences only in the seven days after you buy or renew. After that you pay for every seat until the year is up. A monthly plan avoids this and costs more for the privilege. Other suppliers write early exit fees into their contracts, or hold you to the end of the term.

Owning your systems also means owning the way out. Vendors are keen to build tools that bring a competitor's customers in. Tools that take you out to a competitor are much rarer, and even the good ones move the data and leave behind what made it work: the rules, the permissions, the automations and the links to everything else. Self-hosted software tends to speak open standards, and that is what makes it movable. My calendars are CalDAV, so any calendar server can take them. My code is Git, so it can go anywhere Git goes. That is why, when GitHub switched me off, the move took a day.

Small pieces, replaced one at a time

When everything comes from one supplier, it fails as one thing. Think about what a small business needs to stay reachable: email, the website and its contact form, perhaps an AI assistant answering questions, and a calendar for bookings. If all of that runs through Microsoft, Thursday took all of it at once.

Run them as separate pieces and each can fail, and be replaced, on its own. The chat on this site can be moved to another AI provider from a form. My calendars run on their own calendar server. If one piece goes down the rest carry on, and a backup or a second provider can take its place without anything else being touched. Running your own mail server is the hardest piece of all, and it deserves an article of its own.

Separate pieces are also easier to watch. Each gets its own check, so when an alarm goes off it says which part of the business has stopped, and the alarms can be ranked by how much that part matters: a contact form down for an hour can wait, email down cannot.

Programmers have a name for building a single application this way, microservices, and it has a price. More pieces means more to keep updated and watched, and splitting only helps when the pieces are separate in fact. My own website, chat, booking page and meeting server share one machine, so for those four that machine is still a single basket.

What I'd tell a small business

None of this means leaving Microsoft. For most of my clients Microsoft 365 is still the right tool, and I set it up for them. What matters is knowing what you would do on the day it isn't there.

  • Own your domain, and register it somewhere other than the company that runs your email. Then the email can move.
  • Have a second way to hold a meeting. A Jitsi link costs nothing and nobody needs an account to join.
  • Know which of your systems sign in through the same account. If everything logs in with Microsoft, an outage at Microsoft can lock you out of the things that are still working.
  • Keep the phone numbers of the people you rely on somewhere other than Outlook.
  • Before you sign anything, find out how you would leave: what it costs, and how your data comes out.
  • If you pay for Microsoft 365 annually, put the renewal date in your diary. The week after it is the only time each year you can reduce your licences or leave.

If mail to your business has been held up, Microsoft says it has extended the timeout for queued messages to 48 hours, so most of it should still be delivered once things recover.

I love hosting my own stuff. When it breaks, I am the one responsible, and I can take that responsibility and start fixing it. Today a lot of people can only refresh a status page and wait.

If you'd like to know how your business would have coped this week, book a call. It will be on my own Jitsi server.