John McPherson says the Microsoft 365 outage raises concerns about the consequences of depending on a small number of external providers for essential digital services

By John McPherson*

Have we traded control, resilience and financial predictability for convenience, only to discover that the economics and risks have fundamentally changed?

Friday's global Microsoft 365 outage has once again highlighted just how dependent businesses have become on a handful of global technology providers. Across the world, businesses and government agencies experienced disruption to email, collaboration tools and other services that have become fundamental to daily operations. For the majority, there was little to do but wait for Microsoft to restore functionality.

This article is not here to discuss the technical cause of this outage. There will be many smarter people analysing what failed, why it happened and what Microsoft should do differently. What interests me more is how we arrived at a point where an incident within one company's infrastructure can disrupt the operations of businesses across entirely different countries, industries and regulatory environments.

Over the past two decades, we have progressively externalised technology ownership, management and operational responsibility. But in doing so, we also centralised an extraordinary amount of risk. However, I believe the more important question is does the commercial rationale that originally drove this migration still make sense?

The cloud migration was built on a compelling proposition

Up until the mid-2000s, almost all businesses operated their own infrastructure, whether in dedicated data centres, server rooms or privately managed hosting environments. Maintaining that infrastructure was expensive. Hardware required regular replacement, facilities needed power and cooling, and skilled engineering teams were required to manage everything from storage and networking to backups, security and disaster recovery.

However, to solve this concern, along-comes the powers of public cloud and Software-as-a-Service (SaaS) to offer an attractive alternative where these challenges were no longer your own.

Instead of purchasing and maintaining infrastructure, businesses could consume technology as a service. Capital expenditure became operating expenditure, infrastructure could scale with demand, and responsibility for maintaining the underlying platforms was transferred to specialist providers.

For many businesses, this was a sensible decision.

Cloud services reduced barriers to entry, accelerated deployment, offered access to capabilities that smaller businesses could never reasonably build themselves, and often delivered substantially better availability than the infrastructure they replaced.

However, over time, the commercial proposition became something closer to an operating philosophy. Cloud-first became the default. On-premises infrastructure was increasingly treated as legacy, and retaining internal hosting capability could be viewed as unnecessary cost or complexity.

What began as an economic and technical decision increasingly became an assumption that external ownership was inherently preferable, and that assumption deserves another look.

We externalised operations, but not accountability

When businesses operated their own infrastructure, the operational risks were relatively visible.

Hardware could fail, networks could become unavailable, and internal teams could make mistakes. Businesses bore the cost of maintaining those systems and were directly accountable for restoring them when something went wrong.

These arrangements were far from perfect. Many businesses operated infrastructure that was poorly maintained, insufficiently secured or inadequately resilient. However, they retained a degree of direct control over the systems on which they depended.

Today, many businesses have transferred that operational responsibility to external providers. In doing so, they have also accepted (often unknowingly) a different risk profile.

A business may have excellent internal security, comprehensive business continuity documentation and well-tested local infrastructure, yet still lose access to critical services because of an incident thousands of kilometres away. The business cannot repair the underlying platform, determine its restoration priority or independently restore the affected service.

They can only raise a ticket and wait for resolution.

While operating contracts and service-level agreements may provide credits or other contractual remedies, these rarely compensate for the full commercial consequences of an outage, particularly for critical service providers. Employees remain unable to work. Customers cannot access services. Transactions are delayed, contractual obligations remain, and reputational damage is borne by the business rather than its technology supplier.

The operational responsibility may have been outsourced, but the business risk and customer responsibility remains the remit of the business, regardless of external technology vendors. This is the factor I believe many businesses have inadequately considered or understood.

The concentration of risk has become systemic

The concern extends beyond individual relationships with Microsoft, Amazon or Google. These big three players collectively accounted for approximately 61% of global cloud infrastructure services revenue of Q3 2026. With global cloud infrastructure spending reaching over US$168b for the quarter, growing 55% year-on-year.

These figures describe infrastructure services rather than the separate market for products such as Microsoft 365, but they illustrate how much of the world's technology investment is concentrated within a small number of providers. Consolidation has delivered enormous efficiencies. Hyperscalers can invest in infrastructure, security, reliability and innovation on a scale that most businesses could never replicate. However, concentration also changes the consequences of failure.

Historically, an infrastructure failure might primarily affect one business, one facility or one group of customers. Today, a shared dependency can simultaneously affect thousands of otherwise unrelated businesses.

The impact is no longer confined to the customer that made the original technology decision. Banks, insurers, healthcare providers, governments and telecommunications businesses may all depend on the same identity services, productivity platforms, cloud infrastructure or security providers.

Each business may have undertaken appropriate supplier due diligence and concluded that the arrangement was commercially sensible. Yet collectively, those decisions can create systemic dependencies that no individual customer has the ability to control.

The European Union has already recognised this challenge through its Digital Operational Resilience Act, introducing direct oversight of technology providers considered critical to the financial system.

We have become exceptionally good at assessing the risks of individual suppliers, but perhaps less effective at understanding the consequences when entire industries depend on the same suppliers.

Despite best efforts of many businesses, this is not a risk that can always be resolved by negotiating better contractual terms.

The financial equation is changing

The original financial case for cloud was compelling partly because businesses could avoid significant upfront infrastructure investments, reduce their reliance on specialist engineering teams and, in many cases, lower their operating costs.

Today, the cost comparison has changed considerably.

Over the past several years, we have seen significant increases in enterprise licensing and hosting costs, alongside a fundamental shift in how technology providers package and commercialise their services.

Capabilities that were once included within standard licensing arrangements are increasingly separated into additional products, premium tiers and specialised subscriptions. Security, compliance, identity management, administrative controls, email and collaboration capabilities, advanced reporting and, more recently, AI functionality can all introduce additional licensing requirements.

In some cases, businesses find themselves moving to more expensive licensing tiers simply to retain capabilities they previously enjoyed, meet evolving security and compliance requirements, or maintain functionality across their existing environment. What was once a relatively straightforward subscription has become an increasingly complex collection of interdependent products and services.

The result is not simply higher licensing costs, but a commercial model where maintaining the same operational capability can require progressively greater expenditure each year, even before introducing new functionality or delivering additional business value.

For businesses with thousands of users, these incremental changes compound quickly. Add cloud hosting, storage, backups, data transfer, consumption-based charges and the growing cost of third-party integrations, and the long-term financial commitment can look very different from the original business case that justified moving away from internally owned infrastructure.

More concerning is the limited control customers retain over these changes. Once a business has built its operations around a particular technology ecosystem, changes to licensing structures, product packaging, pricing and service availability are largely dictated by the provider. Moving away becomes increasingly difficult, not necessarily because the alternatives are unsuitable, but because the cost and complexity of disentangling years of technical and operational dependencies can be substantial.

This is not exclusively a Microsoft issue. Across the wider cloud and SaaS industry, recurring subscriptions, increasingly granular licensing tiers, bundled and unbundled capabilities, and consumption-based pricing have materially changed the economics of technology ownership.

The outcome is a challenge beyond whether cloud is cheaper than operating infrastructure internally. It is whether businesses still have sufficient control over their technology expenditure, and whether the commercial assumptions behind decisions made years ago, remain valid today.

Flexera's 2026 State of the Cloud report found that 85% of respondents identified managing cloud expenditure as a major challenge, while businesses estimated that 29% of their Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) expenditure was wasted.

Neither figure proves that cloud is inherently more expensive than running equivalent infrastructure internally. But both challenge the assumption that moving to cloud automatically produces a more efficient cost structure.

An fantastic example of this comes from software company 37signals, which moved several major applications away from AWS and onto owned hardware, and chose to publish their outcomes.

In their financial assessment, the company reported reducing its annual cloud spending from approximately US$3.2m to US$1.3m, with nearly US$2m in annual savings. Its additional hardware expenditure was approximately US$700,000.

Additionally, in recent years we've heard a similar story from a different and larger player, Dropbox, who migrated all of their SaaS and IaaS back to self owned services. Later, publishing that this migration had saved them roughly US$75m over the following two years.

While these remain only a few cherry-picked examples of varying scale, it nevertheless, demonstrates something important.

The financial benefit of renting infrastructure indefinitely is no longer something that should be taken for granted.

Cloud remains attractive for rapidly changing demand, geographically distributed workloads, specialised managed services and businesses that cannot economically maintain equivalent capability.

However, an honest comparison should account for the complete cost of both approaches: infrastructure, staffing, licensing, security, resilience, maintenance, integration and future replacement.

It should also include the financial exposure created by dependency on a provider whose commercial terms the customer does not control.

What concerns me is how often the decision to migrate was justified through detailed financial analysis, while the decision to remain appears to have become automatic.

Privacy and sovereignty are changing the conversation

There is another dimension that has become increasingly difficult to ignore: ownership and control of information.

Cloud providers have invested heavily in data protection and security, and many deliver technical safeguards that exceed what their customers could reasonably implement independently. However, technical security and data sovereignty are not the same thing.

Despite these investments and the extensive security, compliance and assurance frameworks surrounding major technology providers, we continue to see breach after breach exposing customer information and compromising individual privacy. In many cases, the businesses and individuals affected have little visibility into the underlying failures, limited ability to influence the response, and even less practical recourse against the large corporations responsible for protecting their information.

This raises an uncomfortable question about the accountability of providers entrusted with increasingly significant volumes of sensitive information. Customers may have contractual protections, regulatory rights and assurances of compliance, but these offer limited comfort once personal information has been exposed. Financial penalties and regulatory enforcement may follow, yet the consequences for affected individuals can persist long after the incident has been resolved.

Where information is physically stored is only one consideration. Businesses also need to understand who can administer or access it, which legal jurisdictions may apply, how subcontractors are involved, and how much practical control the customer retains over the information and the services processing it. This becomes particularly relevant when businesses depend on technology companies headquartered outside their own jurisdiction.

The concern is not necessarily that these companies are inherently insecure or untrustworthy. It is that their commercial incentives, legal obligations and geopolitical circumstances may not always align with those of their customers.

That said, Europe is beginning to respond.

In January 2026, France announced plans to extend its government-developed Visio videoconferencing platform across state services by 2027, reducing dependence on non-European collaboration providers.

Germany's Schleswig-Holstein state government has taken a more extensive approach. In 2025, it completed the migration of more than 40,000 government email accounts away from Microsoft Exchange and Outlook to Open-Xchange and Thunderbird, as part of a broader move towards open-source workplace technology.

These are not nationwide prohibitions on Microsoft, nor do they represent a wholesale rejection of cloud computing. What they demonstrate is a changing view of digital sovereignty.

Governments are increasingly prepared to reconsider established technology arrangements in order to improve control over critical services, sensitive information and strategic dependencies.

The objective is not simply to host everything internally. It is to ensure that control of essential information and services remains aligned with the interests and obligations of the businesses and communities that depend on them.

I think this perspective will become increasingly important outside government as well, particularly for businesses handling sensitive personal information or delivering essential services.

What happened to internal capability?

There is also a less visible consequence of the transition towards fully managed external services.

Over time, businesses have reduced the teams, infrastructure and expertise previously required to operate their own technology environments, this was an intentional part of the expected efficiency benefit. Why maintain specialist infrastructure teams when a global provider can operate the platform more efficiently?

However, the longer-term consequence is that businesses can become increasingly dependent on external providers not only for the technology itself, but for the expertise required to understand, operate and replace it. Vendor dependency is therefore no longer exclusively a contractual or architectural issue, it is also a capability problem.

A business may theoretically have the right to move its data, migrate to a competing provider or bring a service back under internal ownership, but does it retain the people, systems, architecture and institutional knowledge to make that a realistic option? And how quickly could that change be executed?

A contractual exit clause does not necessarily translate into practical independence.

Likewise, maintaining copies of critical information is not the same as maintaining the ability to use that information when the primary service is unavailable.

A backup may preserve the data without restoring the application, identity services, communications systems or processes required to operate the business.

In some cases, businesses have reduced their internal capability to the point where the service provider is not merely an efficient option, it is the only viable option.

This should be a board-level discussion, not simply a Technology decision

I don't believe the answer is to abandon cloud computing or return every business to operating its own data centre.

That would disregard two decades of genuine improvements in technology capability, accessibility, security and operational efficiency.

Nor does owning infrastructure automatically make it cheaper, more secure or more resilient.

The argument is that these decisions deserve to be revisited.

Businesses should be able to explain not only why a particular platform is technically suitable, but why its long-term financial model, operational dependencies and risk profile remain acceptable.

Boards should understand the concentration of critical services within common providers, the practical consequences of an extended outage, and the businesses ability to operate independently during a disruption.

They should also understand whether the business has realistically assessed alternative delivery models, including owned infrastructure, private or sovereign cloud, hybrid arrangements and independent fallback capabilities.

For some businesses, the right answer will remain an almost entirely cloud-based operating model. For others, a more deliberate balance between external services and internally controlled capability may be commercially and operationally preferable, but either outcome should be the result of an informed decision.

A Cloud-first technology strategy should not be a substitute for financial analysis or risk acceptance.

The question is no longer whether cloud works

It clearly does.

Cloud computing has enabled enormous advances in technology accessibility, scalability, security and the speed at which businesses can deliver services.

The concern I see is whether we have become too comfortable accepting the consequences of depending on a relatively small number of external providers.

Recent outages demonstrate the operational consequences of that dependency. Rising software and hosting costs challenge some of the financial assumptions that originally encouraged migration. Europe's sovereignty initiatives are beginning to question how much control governments should surrender over essential digital services.

These factors are connected, they point towards a broader reconsideration of the relationship between efficiency, ownership, privacy, resilience and risk.

For boards and executives, I think the important question is no longer simply whether moving a workload to cloud will reduce operating costs or improve availability.

It is whether the overall financial return and the concentration of externalised risk remain acceptable, and whether the business genuinely understands the alternatives available to it.

For many businesses, that calculation has not been revisited for years.

Perhaps the latest Microsoft outage is a useful reason to do so.

*John McPherson is a Christchurch-based lead in technology, financial services, security and health. His work spans executives and boards on technology strategy, cybersecurity and operational resilience, helping them weigh the costs and risks of major technology decisions.