The Microsoft 365 disruption that began on 12 November 2026 has affected Exchange Online, with users reporting problems accessing email through Outlook and other connection methods. Microsoft has also reported connectivity problems affecting additional Microsoft 365 services. For organisations that depend on these tools throughout the working day, even a limited interruption can be costly.
Microsoft operates infrastructure on an enormous scale and provides services that businesses have good reason to use. However, the latest incident gives IT teams another opportunity to examine how far a problem with one supplier could interrupt access to systems elsewhere in their organisation.
How problems spread beyond the original service
In July 2024, a network misconfiguration during DDoS mitigation disrupted Azure Front Door, affecting connections to services including the Azure portal and some Microsoft 365 applications (Microsoft’s incident review, 30 July 2024). In October 2025, a separate Azure Front Door incident caused connection failures and DNS problems across regions, affecting Microsoft services and other customers using that infrastructure (Microsoft’s incident review, 29 October 2025).
The causes were different, but both incidents show what can happen when numerous services share underlying infrastructure. This is not a problem exclusive to Microsoft. Any major cloud provider can experience an outage, and organisations should plan accordingly.
Why authentication needs particular attention
A business might use Microsoft 365 for email, Microsoft Entra ID for identity management and several other services for its applications. It may also deliver one-time authentication codes, account recovery instructions or verification links by email. If that mailbox cannot be reached, a user could be prevented from accessing an otherwise healthy application.
That is a dependency in the organisation’s authentication design, not necessarily a failure of the identity provider itself. There is no need to suggest that Entra ID failed during this latest incident to recognise the risk. The practical question is whether staff can still authenticate to essential systems when email, an external identity service or another supporting component is unavailable.
Where Swivel Secure can help
Swivel Secure’s AuthControl Sentry® provides multi-factor authentication that can operate independently of Microsoft infrastructure, while still integrating with Microsoft services where customers want that integration. Organisations can retain their existing Microsoft applications without making Microsoft a requirement for every authentication process.
AuthControl Sentry can be deployed on-premise, in cloud or hybrid environments, and in air-gapped networks. It supports a range of authentication methods, including PINsafe®, PINpad, mobile authentication and hardware tokens. These options help businesses design authentication around their users, their applications and their requirements for continuity, rather than relying solely on one supplier or on codes delivered by email.
For example, where an organisation has configured AuthControl Sentry and its identity sources to operate independently, staff may continue authenticating to internal applications during an Exchange Online outage without waiting for an email-based code. The same principle can apply to other applications that remain available when a third-party service experiences disruption.
There are limits worth being clear about. An independent authentication platform cannot restore an unavailable Microsoft 365 application, and continued access depends on the availability of the application, identity data and other components involved. The benefit is the ability to remove avoidable dependencies from the authentication process, not a promise that outages will never affect users.
A sensible place to review your resilience
For IT and security teams, the immediate task is to check which systems rely on external authentication services, where email is still used to complete sign-in, and whether alternative methods have been configured and tested. Organisations running a mixture of cloud and on-premise applications may find particular value in retaining control over how those systems authenticate users.
Swivel Secure can help organisations assess these dependencies and deploy authentication that integrates with their existing estate without requiring Microsoft infrastructure to be available for every sign-in.
