Last updated 8.30am GMT, Friday 13 November
Where things stand: Microsoft still hasn't said when Outlook will be fully working. It is rolling out a fix that appears to be stabilising its servers, so expect email to come back in stages and not everywhere at once. Teams calls are largely working; Outlook, calendars and scheduling are the weak spots.
Anyone hoping to start Friday with a clean inbox has been disappointed. About 43,000 Outlook problem reports were still arriving at Downdetector at 7am UK time, down from a peak of around 140,000 on Thursday evening but still far above normal, and Microsoft's own update shortly before 7.30am warned that users might still be unable to connect to Outlook on the web or desktop.
The outage started at about 6.26pm GMT on Thursday, according to Microsoft's service advisory. By 8.30am on Friday it had been running for roughly 14 hours, which takes it past the eight- and 12-hour waiting periods common in business interruption cover, a point we return to below.
This isn't a case of flicking a switch back on. Microsoft has described a cascade: some servers went down unexpectedly, the survivors took on their traffic, and they buckled under the extra load. Each time engineers brought machines back overnight, the flood of reconnecting users knocked them over again. Microsoft has also admitted that some of its own traffic rerouting added to the strain on its back-end servers early on Friday.
The current fix targets a component that handles authentication and routing. Microsoft says it is seeing positive results where the patch has gone in and is now applying it across the affected regions, while setting up automated systems to spot and restart any server that stops responding. Once recovery is underway, users' apps reconnect gradually, which is why one office may be back up while another, served from a different set of servers, still isn't.
Microsoft maintains there is no sign of malicious activity and has promised a full account of the root cause once the incident is under control. Until it marks the incident resolved on its service status page, any return of service should be treated as provisional.
Read next: Microsoft's Friday 13th outage continues with fraud and employee risk warnings
For most of Thursday night the question was simply when email would return. By Friday morning, the length of the outage had become a coverage question too.
Cyber policies that extend business interruption cover to a failure at a third-party provider usually apply a time excess before anything is payable. Waiting periods of eight to 24 hours are common, and dependent business interruption sublimits are often a fraction of the main limit, as UK brokers pointed out when a Google Cloud outage hit UK banks, retailers and public services in October. At 14 hours and counting, this outage has already run past the shorter of those waiting periods.
That doesn't mean claims will follow. Many cyber wordings only respond to an actual or suspected security breach or a defined system failure at a named type of provider, and an outage that Microsoft says has nothing to do with an attack may fall outside them. For UK clients, the timing also helps: the trouble began after most offices had closed on Thursday, so many will have lost far fewer working hours than the headline duration suggests. But clients with round-the-clock operations, online sales or overseas customers could be closer to the line, and brokers will want to know which wording each of them actually holds.
There is a regulatory dimension too. Since 13 July, Microsoft Ireland Operations Limited has been one of four critical third parties to the UK financial sector, alongside Amazon Web Services, Google Cloud and Oracle, putting them under direct oversight by the Bank of England, the PRA and the FCA. An outage of this length is an early test of that regime, and the way it is handled is likely to draw close attention from supervisors. Insurers and brokers that rely on Microsoft for important business services should also expect questions about whether they stayed within their own impact tolerances under the UK operational resilience rules.
Read next: Broad cyber dependency cover may need limits to last
For brokers, the immediate job is keeping clients and markets moving without email. A phone call to clients with renewals, claims or mid-term changes due today will go further than a message sitting in an outbox, and it's worth agreeing with insurers and MGAs how you'll confirm cover, binders and premium instructions until Outlook is stable. When email does come back, overnight messages may arrive in a rush or out of order, so check that anything time-sensitive sent since Thursday evening was actually received.
Keep a record. Clients who might later look at a business interruption or cyber claim, and firms that may need to explain the outage to a regulator, will both be helped by a simple log of when systems failed, what workarounds were used and when service returned.
Watch the workarounds as well as the outage. Staff moving client files to personal email or messaging apps can create a data protection problem that outlasts the outage itself, and fraudsters are already using the disruption as cover for fake IT-support calls and changed bank details. Any request to change payment details should be checked by phone on a known number.
Microsoft is posting updates on its service status page, where business customers can follow incidents EX1550543 and MO1550821. Reinstalling Outlook or resetting passwords won't help while the fault is on Microsoft's side.
Read next: £3.4M BI case highlights gaps in cover for upstream cyber disruption
