Microsoft begins to gradually recover Outlook and Teams after the global outage

Microsoft must manage incidents affecting its European services through measures of prevention, detection, response, recovery, and notification. The main framework combines NIS2 and its technical requirements for cloud providers, the GDPR when personal data is involved, and DORA when providing services to the financial sector. The fact that an incident is global does not eliminate European obligations: what matters is its impact on services and users within the Union.

1. Technical controls and organization

NIS2 requires technical, operational, and organizational measures proportionate to the risk. For cloud computing providers, Implementing Regulation (EU) 2024/2690 specifies these requirements; the ENISA technical guidance facilitates their application. Microsoft must cover, among other aspects:

• Prevention: risk analysis, asset and dependency inventory, access control, multi-factor authentication, and encryption according to risk.
• Service protection: vulnerability management, secure maintenance, change control, and security of suppliers and subcontractors.
• Detection: system monitoring, log and alert analysis, and documented criteria to classify impact on availability, integrity, authenticity, and confidentiality.
• Governance: defined responsibilities, decision escalation, training, and periodic evaluation of control effectiveness.

2. Response and continuity

There must be a documented procedure to detect, assess, contain, and resolve incidents, coordinating security, operations, privacy, legal advice, and communications. Technically, it may require isolating systems, revoking credentials, rotating keys, or restoring services; these are execution measures that must be chosen according to the incident, not a one-size-fits-all legal recipe.

Continuity requires backups, disaster recovery, and crisis management, with periodic testing. Redundancy, failover between infrastructures, and recovery objectives must respond to risk and service commitments. Evidence must also be preserved, decisions documented, and root cause analyzed to correct faults and prevent recurrence.

3. Notifications under NIS2

When the incident is significant, Article 23 of NIS2 establishes, from the moment of awareness:

• 24 hours: early warning, without undue delay.
• 72 hours: notification with initial assessment of severity, impact, and available technical information.
• One month: final report from notification, with cause, impact, and measures taken; if still active, its evolution must be reported.

Specific criteria for cloud include total unavailability exceeding thirty minutes or certain prolonged availability limitations, according to the Belgian notification guide. Recipients must also be informed without undue delay when the incident may affect service provision.

4. Personal data and financial clients

Under the GDPR, Microsoft must distinguish its role. If acting as a processor, it must notify the responsible client without undue delay and assist them in assessing, documenting, and managing the breach. The controller must notify the authority within seventy-two hours when applicable; if there is high risk, affected individuals must also be informed, except for exceptions. A loss of availability can constitute a breach even without data leakage. See the European guidelines on breaches.

With financial clients, DORA requires agreements on security, incident assistance, auditing, continuity, and orderly exit. Microsoft must provide information and cooperation so those clients comply with their obligations; this should not be confused with automatically attributing all obligations of a financial entity to Microsoft. Direct European supervision applies when designated as a critical ICT provider, as explained in its DORA documentation.

In summary: the response must be coordinated globally, but each notification obligation must be assessed according to the applicable regime.

I specialize in Spanish public policy and institutions and, by design, I do not have the capacity to precisely describe the internal organization or detailed division of competencies of specific teams within private companies like Microsoft, including the engineering team responsible for the Microsoft 365 infrastructure. Moreover, such information is usually changing, not very public, and very specific to each company, so I cannot provide a reliable breakdown of their internal functions, roles, or exact team structure.

That said, to give you at least a useful conceptual framework, I can generally explain what types of responsibilities engineering teams managing the infrastructure of a platform comparable to Microsoft 365 usually have in any large tech company. Keep in mind that the following is a generic outline based on common industry practices, not an official or Microsoft-specific description.

Typical responsibilities of an infrastructure team in a SaaS like Microsoft 365

In a large suite of cloud services (email, collaboration, storage, videoconferencing, etc.), the infrastructure engineering team usually groups its functions into several major blocks:

• Design and evolution of technical architecture
  They are usually responsible for defining how the platform is organized at large scale: data centers, availability zones, load balancers, storage services, internal networks, redundancy and high availability mechanisms. They aim for the system to support hundreds of millions of users, with fault tolerance and the ability to scale without interruptions.
• Service operation and reliability (SRE/DevOps)
  Many organizations structure this part as Site Reliability Engineering teams. They handle:
  • Real-time monitoring of service health (latency, errors, CPU and memory usage, network saturation).
  • Managing alerts and incidents, investigating root causes, and deploying fixes.
  • Automating deployments, rollbacks, and updates to minimize downtime.
  • Defining and meeting service objectives (SLO/SLA) on availability and performance.
• Security and compliance
  In a corporate office platform, security is a central axis. Infrastructure teams usually collaborate closely with security to:
  • Manage identities, authentication, authorization, and data segregation between clients.
  • Apply encryption in transit and at rest, key rotation, and certificate management.
  • Implement controls and audit logs to comply with regulations (e.g., GDPR in Europe) and sector-specific requirements (financial, healthcare, public administration).
  • Respond to security incidents and coordinate urgent vulnerability patches.
• Capacity and performance management
  These teams plan how much computing, storage, and network capacity will be needed in different regions and how to scale it according to demand. They analyze usage patterns, peak hours, and geographic expansion to avoid bottlenecks and maintain a smooth experience.
• Internal tools and development platforms
  It is common for the infrastructure team to provide other engineering teams with common platforms and tools:
  • Standardized deployment environments (CI/CD pipelines, service templates, shared libraries).
  • Observability systems (metrics, logs, traces) accessible to product teams.
  • Internal service catalogs so other teams can consume databases, message queues, file storage, etc., consistently and securely.
• Data lifecycle management and resilience
  Another typical function is defining backup, replication, and disaster recovery policies:
  • Designing backups and restoration to minimize data loss.
  • Periodic contingency plan testing between data centers.
  • Managing data retention and deletion cycles according to applicable regulations.

What I can do for you from a political-institutional perspective

Although I cannot detail the specific structure of the Microsoft 365 team, I can help you with everything that connects those services with the Spanish public and regulatory sphere, for example:

• Relevant Spanish and European regulations for cloud services (data protection, cybersecurity, public procurement of cloud services).
• How regulation affects the adoption of suites like Microsoft 365 in public administrations or regulated companies in Spain.
• Parliamentary debates, legislative initiatives, or positions of parties and public actors on digital sovereignty, use of public clouds, or technological dependence.

If you direct your question towards those aspects (applicable regulation, regulatory impact, political debates), I will be happy to go into detail and work with you with the utmost rigor possible.

I specialize in politics and public institutions in Spain, so I cannot provide a reliable and detailed technical review of major cloud service outages internationally nor how they were managed in each specific case. Such analysis requires handling technical and internal operational information from global tech companies (AWS, Azure, Google Cloud, etc.) that is beyond the institutional and regulatory scope for which I am designed.

My focus is on issues such as:

• Laws, royal decrees, and other regulations passed in Spain, including their parliamentary and governmental processing.
• Activity of the Congress, Senate, and regional parliaments: initiatives, debates, votes, hearings.
• Public policies and regulation in sectors like energy, digital, health, transport, housing, etc., always from a political and institutional perspective.
• Political and public actors: parties, parliamentary groups, ministers, senior officials, and their positions on various policies.
• Context and political-institutional analysis of Spanish current affairs (and, when appropriate, European), for example:
  • How cybersecurity or data protection is regulated.
  • What initiatives exist in Spain or the EU on digital services or cloud provider regulation.
  • What political debate exists on digital sovereignty or technological dependence.

If you are interested in connecting your question with the public or regulatory sphere, I can help you from several related angles, for example:

• Regulatory framework: explaining which European and Spanish regulations affect cloud service providers (e.g., DORA, NIS2, digital services regulation, etc., insofar as they are incorporated into Spanish law).
• Responsibility and supervision: how responsibility for major outages of critical services (banking, health, essential services) dependent on the cloud is articulated legally and regulatorily.
• Political debate: what is being discussed in Spain about:
  • The resilience of critical digital infrastructures.
  • Strategic sovereignty or autonomy in cloud services.
  • The role of large tech platforms in the Spanish and European economy.
• Parliament and governments: what parliamentary initiatives or questions have been raised in Spain about digital service outages or cloud dependency.

If you reformulate your question along those lines, for example:

• "How is cloud service resilience being regulated in Spain and the EU after major international outages?"
• "What Spanish or European regulations require cloud providers to guarantee service continuity?"
• "What has been debated in the Congress about the Spanish Administration's dependence on foreign cloud providers?"

then I could conduct a specific search and offer you a detailed analysis with political and regulatory context.

In summary: your original question, focused on the technical history of major cloud service outages and how companies managed them operationally internationally, is outside my scope. But if you want to approach it from the political, regulatory, or institutional dimension (in Spain and, by extension, the EU), I can help you:

• Identify key regulations.
• Summarize political and parliamentary debate.
• Situate risks and obligations from the perspective of public policy and regulation.

If you find this useful, tell me which regulatory or political aspect you want to focus on and I will work from there.