If your team cannot sign in to Microsoft 365, it does not matter how well you have trained people on Teams or how tidy your SharePoint sites are. Work stops in odd places first, approvals, invoices, customer replies, then it spreads.

The recent Microsoft 365 incidents tied to authentication are a good reminder of a simple truth: cloud apps are reliable, until they are not, and identity is the shared front door. When that door sticks, email, Teams, files, and even admin tools can feel “down” at the same time.

What an “authentication outage” really breaks

When Microsoft Entra ID (the sign-in layer behind Microsoft 365) has trouble, the impact is often messy. Some people might still be working on cached sessions, others cannot sign in at all, and new logins fail first.

A few practical implications to plan around:

  • Existing sessions may limp along. Someone already signed in on their laptop might keep working for a while, while a colleague who rebooted or changed devices is locked out.
  • Email and Teams can fail differently. Outlook desktop might behave differently than Outlook on the web, and Teams might connect on mobile but not desktop (or vice versa).
  • Admin visibility can be limited. If your admins cannot sign in, you lose your normal “control panel” right when you want it most.

This is why your continuity plan should not be “wait for Microsoft”. It should be “keep the business moving while we wait”.

First 15 minutes: confirm, communicate, contain the confusion

The first goal is clarity. Your team needs to know whether this is a local issue (one user, one office, one ISP) or a wider service incident.

  • Check service health in the right place. Use the Microsoft 365 admin centre Service health page if you can, and know where to look for a public status view when you cannot.
  • Turn on notifications before you need them. Microsoft lets you subscribe to email updates for a specific incident, and the Microsoft 365 Admin mobile app can provide push notifications. Set this up now so you are not relying on the very email service that might be impacted.
  • Send one short internal update. A single message that says “we are seeing sign-in issues, we are checking service health, next update at 10:30” prevents ten side conversations.

If Teams is affected too, you need an out-of-band way to send that first update.

Your “Plan B” communications: pick it, practise it, write it down

Most businesses do not need a fancy secondary collaboration platform. You do need one dependable channel that does not depend on Microsoft 365 authentication.

Options that work well in real life:

  • A non-Microsoft group messaging app. A locked-down WhatsApp or Signal group for leaders, or a Slack free workspace used only for incidents. Keep it boring and limited, the goal is coordination, not a second digital headquarters.
  • Phone trees for key roles. Not everyone needs a call. Decide who must be reachable (owners, ops, finance, customer service lead, IT contact) and keep that list current.
  • Status page for your customers. If you serve customers who expect fast replies, a simple hosted status page (outside Microsoft 365) can reduce inbound pressure by setting expectations.

Whatever you choose, document two rules:

  • Where to go. “If you cannot access email or Teams, check the incident channel and wait for instructions.”
  • What not to do. No ad hoc personal Gmail forwarding, no uploading customer files to random consumer apps, no “just text me the spreadsheet”.

Keep customer data reachable, without making a mess

During an outage, people will try to recreate access by any means necessary. Your job is to give them a safe, pre-approved path.

Start by deciding what “must be accessible” even if Microsoft 365 is not:

  • Customer contact list. Key phone numbers and escalation contacts should exist outside Outlook.
  • Current jobs and commitments. Work orders, project status, delivery schedules.
  • Credentials and vendor access. A password manager that is not tied to Entra sign-in is often the difference between “annoying day” and “total stop”.

Then choose how you will provide that access:

  • Offline exports for the essentials. A weekly export of your key customer list and open invoices to a secured location can be enough for many teams.
  • A second identity path for critical systems. If your accounting platform, PSA, or line-of-business app supports local accounts or an alternate identity provider, consider it for a small set of emergency users.
  • Clear data handling rules. If you need to share a file during an outage, decide where it goes and how it is cleaned up afterwards.

Continuity is not “everyone can do everything”. It is “the business can still serve customers and take money while core tools recover”.

Billing and operations: the minimum viable workflow

Authentication outages hurt most when they stall approvals and cash flow. Build a skinny version of your workflows that works without email and Teams.

  • A manual approvals fallback. For example, purchase approvals happen by phone call with a short note logged in your ticketing system or accounting tool.
  • Invoice sending plan. If your invoices normally go out of Outlook, make sure your accounting platform can send invoices directly, or have a pre-approved alternate method for that day.
  • Customer support intake. If support tickets normally arrive via email, keep a phone number and web form (hosted outside Microsoft 365) ready as a temporary intake path.

Write this as a one-page “when Microsoft 365 sign-in is down” runbook. Your team should not be inventing process under pressure.

The prep that makes outages feel smaller

You cannot prevent a Microsoft-side incident, but you can reduce how much it disrupts you.

  • Make admin access resilient. Keep at least two emergency admin accounts, strongly protected, documented, and tested. The point is not daily use, it is being able to act when normal sign-in paths are unreliable.
  • Know how you will monitor incidents. Service health in the admin centre is useful, and Microsoft also provides ways to pull service health via APIs for monitoring and alerting.
  • Decide what “good enough” looks like. For many businesses, the target is “we can communicate with customers, take payments, and coordinate internally within 30 minutes, even if Microsoft 365 is partially down”.

Want a continuity plan you will actually use?

A good Microsoft 365 continuity plan is short, specific, and tested on a normal week, not written once and forgotten.

If you would like help building a Microsoft 365 authentication outage playbook for your business, the Flexnet Networks team can put one in place with you.

Sources