Microsoft 365 Outage Sends Saudi and UAE Schools and Firms to WhatsApp

Microsoft said a fault introduced during an earlier network capacity upgrade surfaced after a more recent network change, and that the failure was unrelated to cyber activity or artificial intelligence agents. Microsoft executive Charles Lamanna said in a statement that the company regretted "the impact these outages had on those who depend on us" and that its teams were reviewing how to prevent similar issues. Microsoft said it would publish a full report after reviewing the incident.

In the UAE, the Danube Group said it had to shift some transactions to WhatsApp after the outage complicated financial approvals and bulk sales. Each transaction needed approval from several people, so losing email alone was enough to hold up business.

In Saudi Arabia, a parent, Zainab Rahman, said her daughter struggled to download assessment materials through Teams while the family prepared for exams. The school sent the materials out by WhatsApp instead.

Mohammed Ahmed, who owns a leather business, said the company relies on Outlook for customer enquiries, coordinating orders and talking to suppliers, and that responding to customers promptly had become harder. Sameer Sayed, information technology manager at Giordano, said the company's operations rely heavily on Exchange Online, Microsoft Teams, SharePoint Online and Copilot, and that their unavailability had affected its ability to coordinate activities and carry out routine tasks.

Other businesses were less affected. One company spokesperson said email was disrupted but core sales and logistics operations, which run on SAP, continued as normal. Meshari Hussain, digital head at Tamer Group, said the Saudi company had alternative access through Google accounts alongside its integration with Microsoft services, and had received no reports of a data breach linked to the incident.

Reports from the Gulf described disruption to workplace tools. They did not show widespread failure of payment networks, aviation or electricity supply in the region. The consequences elsewhere were still serious. England's National Health Service activated contingency plans, including alternative systems and paper records, and pharmacies reported trouble communicating with doctors' offices, which delayed prescriptions.

As more Gulf services move online, teams in different departments may depend on the same tools and be exposed to the same fault. Security specialists warn that recovery plans often sit on the platform that has failed. "If your emergency communications, identity management and recovery procedures all depend on the same unavailable cloud provider, your recovery plan has a fundamental weakness," Morey Haber, chief security adviser at BeyondTrust, told Khaleej Times. A backup copy of a document offers little protection if staff still need the failed login service to open it.

Leonid Bezvershenko, senior security researcher at Kaspersky GReAT, warned that scammers could exploit the confusion with phishing messages impersonating Microsoft or internal IT teams, fake password resets and cloned login pages.

Building data centres in the region solves only part of the problem. Microsoft announced in February that customers would be able to use its Saudi Arabia East data centre region from the fourth quarter of 2026, with three zones that have independent power, cooling and networking. Facilities like these can speed up service, support local data storage and protect against some physical failures. Microsoft's own technical guidance, however, notes that separate regions may rely on shared global services.

In July 2024 a faulty CrowdStrike security update affected an estimated 8.5 million Windows devices, according to Microsoft. That incident had a different cause and involved another company's software, but it too spread disruption across organisations that otherwise had little in common.