Day 2 without Microsoft

Here’s a question for your next business continuity review. You lose access to Microsoft 365 for 30 days, because Microsoft can’t or won’t serve you any more. What still works?

I pick Microsoft because it’s what most Swiss organisations run on. Nothing here argues for leaving it. The test asks what you’d do on the second day if you had to.

Thirty days is an illustration. In a real exercise, use the disruption tolerance your organisation has set for each critical process.

Day 2 isn’t an outage

I wrote this section the day after Microsoft’s long outage on 12 November 2026. Outlook, Teams, SharePoint and Copilot stopped working for many users, and it ran for more than 12 hours into the next morning. Microsoft posted its updates on X, because its own admin centre wasn’t reachable either.¹

Annoying as it was, that’s the kind of day we know how to handle. Microsoft publishes its uptime every quarter, the SLA is financially backed, and when Exchange Online goes down, a lot of engineers work to bring it back. Your part on that day is mostly waiting.²

On Day 2 nobody at the provider is working for you. The provider is the cause. A government order, sanctions or export controls stop the service, and the provider follows the law it’s subject to. Uptime figures, SLAs and supervision under DORA describe how well a provider runs the service. They say nothing about whether it’s still allowed to.

It has happened outside the workplace already. In June 2026, US export controls led Anthropic to suspend access to two of its AI models for almost three weeks.³ Many of us are now building AI into core processes, and access to the best models may become a real advantage.

The workplace has its own example, with a caveat. In May 2025, AP reported that the chief prosecutor of the International Criminal Court had lost access to his Microsoft email after US sanctions. Microsoft’s president denied that the company had stopped or suspended its services to the court, and the details remain unclear.⁴ I doubt the story surprised anyone who has followed the news in recent years.

What breaks first is what you’d use to respond

Walk through the first morning. The crisis team would normally meet in Teams. Its contact list is in Outlook or a SharePoint list, and the checklists that say who does what are on a SharePoint site or in OneNote. All of it sits in the tenant you’ve just lost.

Then the devices. In a modern Microsoft 365 estate, laptops are Entra joined and managed with Intune. Their BitLocker recovery keys are backed up to Entra ID automatically,⁵ and if you use Windows LAPS, so are the local administrator passwords.⁶ Most laptops will keep starting and signing in for a while with cached credentials. The one that asks for its recovery key stays locked, and the help desk has no local password to fix it with.

None of this is bad design. Keeping keys and checklists where everyone can find them is good practice on a normal day. On Day 2 it means the tools for the crisis are inside the crisis.

The second channel

Most organisations already have one, even if nobody calls it that: mobile phones. Calls and SMS over the mobile network don’t depend on your tenant. Desk numbers on Teams Phone do.

The trouble is the contacts. People have the numbers of their own team, but not always of everyone they suddenly need, and the checklists that would tell them what to do next are in the platform that’s gone.

Setting up a second channel is technically easy: a messaging service that doesn’t sign in through Entra, or a printed card in the crisis folder. The work is organisational. Someone has to decide when to switch, usually whoever leads the crisis staff. The contact list and the checklists need a home outside the platform and an owner who keeps them current. And people need to have practised it once, or they’ll spend the first morning working out how it works.

I once suggested asking someone with a senior rank in the army for help. With Switzerland’s militia system, you often find them in companies, and they’re probably more used to planning for the day the normal channels are gone than most of us in IT.

The federal administration is building a second channel at a larger scale. In September 2026 the Federal Chancellery started a programme for a fallback workplace for about 3,000 staff in critical processes, next to Microsoft 365.⁷

FINMA already asks for it

If you’re FINMA-regulated, this isn’t a new exercise. Circular 2018/3 asks banks and insurers for a contingency plan that keeps an outsourced function running in an emergency (margin no. 25).⁸ Circular 2023/1 requires larger banks (categories 1 to 3) to test their operational resilience, and a footnote to that requirement names the scenarios: foreign governments prohibiting foreign-based cloud providers from serving Swiss firms over the long term, and a stressed exit after a key provider’s insolvency.⁹

That’s the same scenario as the Day-2 test. If you’re not a bank, it’s still a useful argument when someone calls the scenario far-fetched.

Run it as a tabletop

You don’t need a project for this. Book two hours with whoever owns business continuity, pick one critical process and walk through the first week without the platform. Keep coming back to these questions:

• Who decides? Who switches to the second channel, and when? Does that channel sign in through Entra, or need Intune to work?
• Where’s the copy? Is there a usable copy of the data outside the provider, and when did you last restore it somewhere else?
• What could be read? If the provider were compelled to disclose your data, what would they find, and would you know?

Write down every question nobody in the room could answer, and take that list away as the result.

→ Read the Sovereign Workplace page