Cloud technology has transformed the way businesses operate. We can access emails from almost anywhere, share documents with colleagues, manage customers online and run much of our day-to-day operations without needing servers sitting in the office.
For most businesses, this has made life considerably easier. But what happens when one of those cloud services suddenly becomes unavailable?
Recent disruption to Microsoft services has been a reminder of just how much businesses rely on technology working as expected. For some people, the problem went beyond being unable to access their emails or documents. They couldn't even get through the authentication process needed to access the services in the first place.
It's something I've experienced myself. When multi-factor authentication (MFA) wasn't working, I couldn't access the Microsoft services I needed. And because other applications relied on that same authentication, they were inaccessible too.
It highlights an important point: sometimes a problem with one service can have a much wider impact than you might expect.
But does that mean your business has to grind to a halt every time a cloud service goes down?
Not necessarily.
The businesses that cope best with disruption aren't always those with the most complicated IT systems. They're often the ones that have thought ahead, understand what their business depends on and have sensible arrangements in place if something stops working.
So, what can you do to make sure your business keeps moving, even when the technology you rely on doesn't?
Start by understanding what's actually affected
When a cloud service becomes unavailable, the first reaction is often to assume that everything has stopped working. But that's not always the case.
A problem accessing a service could be caused by several different things. It might be an issue with your internet connection, a local network problem, an authentication service or the cloud provider itself.
Before making changes or trying to find workarounds, it's worth establishing what's actually happening.
Most major cloud providers publish service health information, which can help identify whether an issue is already known. Microsoft, for example, provides service health information through its admin centre and public status channels.
Understanding the source of the problem helps avoid unnecessary changes that could make things worse.
It's also worth remembering that a disruption to one part of a cloud platform doesn't necessarily mean every service within it is affected. If email is unavailable, for example, other applications or services may still be working.
The important thing is to establish what is and isn't available before deciding how to respond.
What happens if you can't get through MFA?
Multi-factor authentication has become an essential part of protecting business accounts. It adds another layer of security, making it much harder for someone to access an account using just a stolen password.
However, as my own experience demonstrated, authentication can also become a dependency.
If your business uses Microsoft 365, for example, Microsoft Entra ID plays a central role in managing user identities and access to services. If the authentication process is disrupted, the consequences can extend beyond Microsoft applications to other systems that rely on the same identity provider.
There are a few things worth considering.
Firstly, make sure users have more than one registered authentication method where appropriate. This could include the Microsoft Authenticator app alongside a FIDO2 security key or passkey.
Having an alternative method can help if a phone is lost, damaged or unavailable. However, it's important to understand that having another MFA method won't necessarily help if the identity provider itself is experiencing an outage.
Businesses should also have secure emergency access arrangements. Microsoft recommends dedicated emergency access accounts for organisations using Microsoft Entra ID. These need to be carefully protected, monitored and tested, rather than treated as ordinary user accounts.
Most importantly, understand which business applications rely on your main identity platform. You may discover that a service you thought was independent actually depends on the same authentication system as everything else.
The answer isn't to weaken security or switch off MFA. It's to make sure your security arrangements include a safe and properly tested recovery route.
Keep communication running
When people think about IT disruption, they often concentrate on files, applications and servers. But one of the first things a business needs to maintain is communication.
If your usual email service becomes unavailable, how will customers contact you? How will staff communicate with each other? And how will you let suppliers know what's happening?
These are simple questions, but they're worth answering before an outage occurs.
For example, your business could have:
- An up-to-date list of important customer and supplier telephone numbers.
- An alternative communication channel for staff.
- A documented procedure for handling urgent customer enquiries.
- A way of forwarding business calls to mobiles if your normal phone system is affected.
If you use a cloud-based VoIP phone system, check what happens if the service or your internet connection becomes unavailable. Can calls be forwarded to mobile numbers? Can staff use an alternative connection? Are there arrangements for handling calls outside the normal system?
You don't necessarily need an elaborate backup communications platform. You just need to know how people will stay in touch when their usual method isn't available.
Make sure essential business information is accessible
Imagine your team arrives at work to discover that they can't access their usual cloud storage.
The information is still there, but the service needed to retrieve it isn't currently available.
What happens next?
For some businesses, this might be a minor inconvenience. For others, it could prevent staff from accessing customer details, schedules, quotations, project information or documents needed to complete their work.
One option worth considering is making selected files available offline.
Services such as OneDrive allow users to synchronise files to their devices so that certain information remains accessible even when they cannot connect to the cloud service.
Of course, this needs to be planned properly. Not every file needs to be available offline, and sensitive information still needs to be protected. Devices should be encrypted, access controlled and managed appropriately.
It's also important to understand that synchronisation is not the same as backup. If a file is deleted or corrupted and that change synchronises across devices, you may still need a separate backup to recover it.
The aim is to identify the information your staff genuinely need to keep working and make sure there is a sensible way of accessing it.
Don't overlook DNS and domain services
This is one of those areas that can easily be overlooked until something goes wrong.
DNS, or Domain Name System, is essentially the internet's address book. It helps direct users and applications to the correct online services.
If your DNS provider experiences problems, or your domain settings are changed incorrectly, services that appear completely unrelated can become inaccessible.
Your website, email, remote access and other business applications may all depend on DNS working correctly.
For businesses that rely heavily on online services, it's worth understanding who manages their domain and DNS hosting, where those services are hosted and how they can be accessed if the normal route becomes unavailable.
Keep a secure record of important domain and DNS configuration details, and make sure the relevant administrative accounts are accessible to the right people.
For organisations where DNS availability is particularly critical, using resilient DNS hosting or a properly configured secondary DNS service may also be worth considering.
As with any contingency arrangement, it needs to be configured and tested in advance. Having a secondary service that nobody knows how to use isn't much help when an outage occurs.
Consider what happens if your internet connection fails
Not every disruption starts with a cloud provider.
Sometimes the problem is much closer to home.
If your office loses its internet connection, access to almost every cloud-based service could disappear, even though the services themselves are working perfectly.
For businesses that depend on cloud applications, a secondary internet connection can make a real difference.
This could be a backup broadband connection or a 4G or 5G connection that automatically takes over if the main connection fails.
The important consideration is independence. If both connections rely on the same physical infrastructure, a single fault could affect them both.
A properly configured failover arrangement can help keep staff connected and allow essential services to continue operating.
It won't solve an outage affecting the cloud provider itself, but it removes one more potential point of failure from your business.
Understand the difference between backup and business continuity
This is probably one of the most important points to understand.
Many businesses assume that because their data is backed up, they're protected if something goes wrong.
Backups are essential, but they don't necessarily keep your business running during an outage.
There are three related but different areas to consider:
Backup protects your information.
It provides a way to recover files, emails and other data if they are deleted, corrupted, damaged or lost.
Disaster recovery gets your systems back.
It covers the processes and technology needed to restore services and get your IT environment operating again after a significant disruption.
Business continuity helps your business keep operating.
It considers what people need to do while normal systems are unavailable, so that essential business activities can continue.
For example, imagine your cloud-based customer management system becomes unavailable.
A backup may allow you to restore the information if it has been lost. Disaster recovery may help get the system running again. But neither necessarily tells your staff how to deal with customer enquiries in the meantime.
That's where business continuity comes in.
It might mean having access to essential customer contact information, an agreed process for recording urgent enquiries or a temporary way of managing orders.
The important thing is to think beyond simply getting your data back. You also need to consider how your business will function while that is happening.
Do you know what your business can't operate without?
Every business is different, and there isn't a single solution that works for everyone.
For one company, losing access to email for a few hours might be inconvenient but manageable. For another, losing access to its booking system, payment platform or production software could bring operations to a standstill.
Before investing in additional technology or complicated backup arrangements, take a step back and look at how your business actually works.
Ask yourself:
- Which systems are absolutely essential to our daily operations?
- Which services do our employees rely on to do their jobs?
- What happens if we can't access email, shared files or customer records?
- Which applications depend on the same cloud provider or authentication service?
- How long could we realistically operate without each system?
- What information would we need to continue serving customers?
This exercise can reveal dependencies you might not have considered.
For example, you may discover that your website, customer management system and staff applications all depend on the same identity provider or cloud platform.
Understanding those connections makes it much easier to decide where additional protection is worthwhile.
It also helps avoid spending money protecting systems that aren't particularly important while overlooking the services your business genuinely depends on.
Understand how quickly you need to recover
Once you've identified your essential systems, the next step is to decide how quickly you need them back.
This is where two terms are useful: Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
They sound technical, but the concepts are relatively straightforward.
Recovery Time Objective (RTO) is how long your business can tolerate a service being unavailable before it needs to be restored.
Recovery Point Objective (RPO) is how much data your business can afford to lose, measured in time.
For example, imagine your business decides that its main customer system must be restored within four hours. That's an RTO of four hours.
If it can only afford to lose a maximum of 30 minutes' worth of data, that's an RPO of 30 minutes.
Not every system needs the same recovery targets. Your email, accounts software and production systems may all have different priorities.
The important thing is to make those decisions based on what your business actually needs, rather than simply choosing whatever recovery options happen to be included with a service.
Don't introduce unnecessary complexity
It's tempting to think that the answer to cloud disruption is to use several different cloud providers, duplicate every system or create an elaborate backup environment.
Sometimes additional services are worthwhile, but more technology doesn't automatically mean greater resilience.
For example, having two cloud applications might not help if both rely on the same identity provider. Similarly, having a backup internet connection won't help if the problem is with the cloud platform you're trying to access.
The key is understanding where your dependencies are.
A sensible resilience strategy should focus on protecting the things that matter most, identifying genuine single points of failure and providing practical alternatives where they make sense.
For some businesses, that might mean a secondary internet connection and reliable backups. For others, it could involve alternative communications, offline access to essential information or a more comprehensive recovery arrangement.
The right solution depends on the business, its systems and how much disruption it can reasonably tolerate.
Test your arrangements before you need them
Having a plan is a good start, but it's only useful if it works.
It's surprisingly easy to assume that everything is in place without ever checking.
Perhaps the backup is running, but nobody has tested whether the data can actually be restored. Maybe the alternative authentication method was registered years ago and no longer works. Or perhaps the person who knows how to access an important system is no longer with the business.
These are the sorts of problems you want to discover before an outage, not during one.
You don't necessarily need to simulate a major disaster. Even a few straightforward exercises can highlight weaknesses.
For example:
- Check that important backups can be restored.
- Test alternative authentication and emergency access arrangements.
- Confirm that essential contacts can be reached without business email.
- Check that internet failover works as expected.
- Make sure staff know what to do if an important service becomes unavailable.
It's also worth reviewing these arrangements when your business changes. New software, additional employees, new locations and changes to cloud services can all introduce dependencies that weren't there previously.
A little preparation now can save a considerable amount of frustration later.
A cloud outage doesn't have to become a business outage
Cloud services are an incredibly valuable part of modern business, and for most organisations, moving to the cloud makes perfect sense.
They provide flexibility, accessibility and opportunities that would have been much harder or more expensive to achieve with traditional IT infrastructure.
But relying on cloud technology doesn't mean having to rely on everything working perfectly, all of the time.
The businesses that cope best with disruption aren't necessarily those with the most complicated IT systems. They're the ones that understand what they depend on, know which services are most important and have sensible arrangements in place when something goes wrong.
That might mean having alternative ways to communicate, keeping essential information accessible, protecting business data properly or simply making sure staff know what to do when their usual systems aren't available.
You don't have to duplicate your entire IT environment or build an expensive alternative infrastructure. You just need to understand the risks and put the right measures in place for your business.
How Qdos can help
At Qdos, we believe good IT support is about more than fixing things when they go wrong. It's about understanding how your business operates, identifying where it might be vulnerable and putting sensible measures in place to keep things running.
Whether that's reviewing your cloud environment, improving backup arrangements, looking at alternative ways of accessing essential services or developing a business continuity plan, a little preparation can make a considerable difference when disruption occurs.
We work with businesses to make sure their IT systems support the way they operate, while helping them prepare for the things that don't always go to plan.
Because technology should help your business keep moving forward.
And when one part of it stops working, that shouldn't automatically mean everything else has to stop too.
