Microsoft Outage Exposes Britain's Single-Vendor Critical Infrastructure Bet

A global Microsoft 365 outage knocked out email and data access across hundreds of NHS sites, courts, police forces, and schools — revealing that the UK has stacked its entire public-service digital spine on one vendor with no meaningful fallback.

A global outage of Microsoft's 365 suite that began late Thursday evening cascaded through Britain's public sector on Friday, hitting hundreds of hospitals, GP surgeries, police forces, courts, schools, and universities. NHS staff lost access to the NHS.net Connect system — the email, calendar, and file-sharing backbone used by more than one million workers — and were forced to revert to paper records and phone-based workarounds. Police told the public to call 101 or 999 instead of using online crime-reporting forms. Court proceedings stalled as staff searched for fax machines. The disruption was not caused by a cyber-attack, according to Microsoft executive vice-president Charles Lamanna, but by an internal failure that the company said began stabilising Friday morning.

The UK government disclosed it spent roughly £1.9bn on Microsoft software licences in 2025, with hundreds of millions more going to Amazon and Google. Crucially, there are no publicly available figures showing how much critical infrastructure is hosted on these platforms — a gap that Dame Chi Onwurah, chair of the Commons science and technology committee, called indefensible. Her committee found earlier this year that Britain was hugely dependent on a small number of US-based technology providers for public services, and that the government could not even quantify its own IT spending by vendor. The structural vulnerability is not new intelligence. Documents previously obtained by the Guardian showed that senior police officials had already accepted the risk that a "US government insider" or foreign actors could compromise sensitive data hosted on Microsoft, and had acknowledged the risk of exactly this kind of global outage disrupting first-responder services. Lord Tim Clement-Jones, a former chair of the House of Lords AI select committee, called the outage an "I-told-you-so moment," arguing the government had "just blindly procured" without thinking seriously about resilience. The downstream friction was broad. National Rail warned passengers they might not be able to access emailed tickets. Mortgage completions — concentrated on Fridays — faced delays. Cheltenham racecourse told visitors to arrive early in case digital tickets failed. Ofsted could not receive emails, disrupting school inspections. Universities, which rely heavily on Outlook and OneDrive, were among the hardest hit. The Bank of England and Financial Conduct Authority were affected, though both said critical operations continued. The government's response was cautious to the point of opacity. Downing Street said the PM was being kept updated and that departments had contingency plans, but declined to say whether No 10 itself was affected. Defence readiness minister Luke Pollard acknowledged the need for "greater resilience" but offered no specifics. Cybersecurity minister Liz Lloyd characterised the impact as mainly back-office, insisting 999 and NHS 111 remained functional. The Liberal Democrats called the episode a "national resilience failure" and demanded an urgent parliamentary briefing. What the outage revealed is not a technology problem but a procurement architecture problem. The UK has built a monoculture: a single cloud provider underpinning email, calendars, file access, patient data, crime reporting, and court operations across virtually every arm of the state. When that provider fails — for any reason — the entire apparatus degrades simultaneously. There is no second path. The government's inability to even disclose how much infrastructure sits on which platform means it cannot model its own systemic risk, let alone manage it. Microsoft apologised and pledged a full post-incident report. The more important question is whether Whitehall will treat this as the stress test it was — a non-hostile, non-targeted, hours-long interruption that sent sectors "back to the 1990s" — and restructure procurement accordingly, or whether the convenience and cost savings of the full-suite buy will once again override the resilience imperative.