The Microsoft 365 Outage Is A Wake-Up Call to Prioritize Business Continuity

Yesterday’s Microsoft 365 and Exchange Online outage impacted 430+ million users across 74 countries for 18+ hours, making it likely the biggest one to hit enterprises since the Crowdstrike outage of 2024. Like other recent disruptions to hyperscalers and major SaaS providers, it serves as a wake-up call for enterprises. When a critical, highly relied-upon cloud dependency goes dark, can your business continue to operate?

Zscaler Digital Experience (ZDX) showing downtime of Outlook Online

This outage offers important lessons for our resilience strategy:

Lesson #1: Identify & Prioritize Your Mission-Critical Services and Ensure You Have a Business Continuity Plan 

Not all enterprise systems are created equal. If your HR portal goes offline for an hour, it’s an inconvenience, but the business survives. You can live with a standard 99.9% availability SLA for non-critical systems.

Critical systems are different. They require 99.999% resilience, however mission-critical systems must have a 100% availability through business continuity/disaster recovery strategy, as any minute of downtime can cost the business millions and reputational damage. Research from Oxford Economics puts the total cost of unplanned downtime for Global 2000 companies at $400 billion annually — $540,000 per hour.

Regulators agree. Under DORA, CPS 230, and ISO 22301, “Our cloud provider went down,” is no longer an acceptable defense. Enterprises must prove operational resilience across every critical dependency.

This is why CIOs are building toward a minimum viable IT stack — the three services that every organization needs to maintain during any disruption:

• Identity services
• Zero trust connectivity services
• Business-critical applications 

Together, these three form the complete resilience chain. Miss any one, and your business will be disrupted.

Lesson #2: Don’t Take Shortcuts With Cloud Services

In the "good old days" of mainframe computing and corporate data centers, IBM and IT leaders had strict separation between their active production data centers and physically isolated backup data centers. If an unforeseen issue or outage occurred at the primary site, customers switched over to the disaster recovery data center in minutes, allowing business to carry on.

In the cloud era, we must maintain these same principles rather than relying purely on high-availability SLAs. The biggest and best platforms in the world still have disruptions. An architecturally independent business continuity cloud follows the same principles as the separate data center infrastructure, and provides insurance against cloud outages to maintain uptime and business productivity.

Lesson #3: Don’t Buy Your Applications and Security From the Same Place

Under massive suite licensing agreements, enterprises have increasingly consolidated their productivity, collaboration, and security tools under a single provider and hosted them on connected architecture, leading to increased risk.

Microsoft Defender for Office 365 and critical Microsoft security services, such as Intune and Purview were also impacted yesterday due to the weave of infrastructure interdependencies underlying Microsoft’s services. 

Using security services that rely on your application infrastructure to function is the digital equivalent of letting the fox watch the hen house.

Zscaler Business Continuity Cloud: Continuous Security, Zero Shared Fate

This instinct to route around security is dangerous. Bad actors actively exploit these moments. As we saw during the Crowdstrike incident in 2024, once the safeguards were down, threat campaigns were organized in record time. Now with AI, the same can be done in minutes and so the option of being insecure during a major failure is not an option. 

That’s why we built the Zscaler Business Continuity Cloud to maintain continuity and security at the same time without impacting end user posture or behavior. We know how critical it is to keep your security services operational during disruption, even as you perform troubleshooting and root cause analysis of the disruption. Availability of service is the core foundation of the Zscaler Business Continuity Cloud.

Built on independent global infrastructure, the Business Continuity Cloud is a dedicated, time and fault gapped private cloud that is not connected to our standard production cloud, providing architectural and operational separation:

• Physically and logically isolated: It operates on dedicated infrastructure with separate private data planes, private control planes, isolated DNS services, and distinct Autonomous System Numbers (ASNs).
• Time-gapped updates: To prevent software-induced regressions, code releases and security updates on BCC are intentionally offset from our primary cloud.
• Delayed continuous policy sync with zero drift: Business Continuity Cloud is a parallel, read-only environment that continuously synchronizes active zero trust policies. During a failover, your last known good posture, threat prevention, and other policies remain consistent.

Zscaler Business Continuity Cloud keeps your business running during disruptions.

When the Zero Trust Exchange is unreachable or unavailable, Zscaler Connectors automatically connects endpoints to the business continuity cloud: 

• For your end users, there is no manual intervention, no re-logins, no help desk tickets.
• For your security team, it's not a degraded fallback: same policies, same inspection engines, logs still streaming. Consistent Zero Trust posture maintained through the disruption. 
• For your IT team, deployment is a natural extension of your existing Zscaler environment with flexible deployment options: a Zscaler-managed service across 9+ global data centers, customer-hosted, or hybrid. 

Further, you can test Zscaler Business Continuity in peacetime, so the first time you activate it isn't during an actual incident.

We cannot control when a major cloud provider or critical infrastructure dependency will fail. But we can control how our systems respond. Enterprises should look for a dedicated business continuity cloud for each of their mission critical services. By decoupling your zero trust security from your application layer and establishing true architectural independence with the Zscaler Business Continuity Cloud, you ensure your business remains resilient, compliant, and unstoppable—no matter what.

Hear Zscaler senior leadership explain how the Business Continuity Cloud delivers architectural independence — and why customers are deploying it now. Watch the webinar →