The Microsoft outage on November 13 left businesses and governments around the world scrambling as they found themselves hamstrung and unable to carry out routine operational functions. The incident teaches us three lessons: One obvious, the other two perhaps less so.First, public-facing services, particularly high-volume, time-sensitive, or high-risk ones, must incorporate redundancies. Airlines and trading desks worldwide felt the pinch. Some got inventive, finding low-tech workarounds. Trading firms in Japan reportedly fell back on fax machines, while Air India temporarily rerouted emails to ensure customer communications continued. But such stopgap measures cannot be relied upon repeatedly as legitimate backups for critical services.AdvertisementHow these redundancies should be incorporated becomes the central question. For many organisations, the problem stemmed from their dependence on Microsoft’s 365 suite of products. Typically, organisations enter into enterprise-wide licensing arrangements covering email, document management, collaboration tools and other services. These arrangements offer considerable efficiencies, but also create dependencies.So, what is the alternative? Are organisations going to maintain parallel subscriptions to competing software suites? Or should employees fall back on online messaging applications, which already informally serve as substitutes for email? Neither is really straightforward. Maintaining duplicate systems is expensive, while informal messaging applications introduce challenges around security, accountability, and record-keeping. During the outage, HSBC reportedly warned employees against using unauthorised communication channels.Also Read | Microsoft global outage: How one cloud failure disrupted businesses worldwideOr should redundancy be built at the infrastructure level, where the problem originated in the first place? After all, if a failure in the underlying infrastructure can bring down multiple services simultaneously, shouldn’t that be where the backup arrangements are made? Should public services demand that Microsoft’s products be made interoperable with competing cloud infrastructure? Such proposals may seem neat on paper but are messy in practice. They raise difficult questions of accountability when something goes wrong and complicate providers’ ability to guarantee the security and integrity of their systems. Some competition hawks may push this line, but mandatory interoperability is not a substitute for carefully designed contingency arrangements.AdvertisementThe second lesson is that countries should resist knee-jerk reactions demanding greater localisation of digital services. Local does not automatically mean better, more secure or cost-effective. China provides a useful example. In November 2023, an Alibaba Cloud outage disrupted widely used Chinese applications, including Taobao and DingTalk. Later that month, another outage affected its database services across several regions.Replacing global technology providers with domestic champions does not eliminate concentration risk. It merely changes who manages it. There may be legitimate strategic or security reasons for developing domestic technological capabilities. But these objectives should not be confused with operational resilience. Ultimately, where a provider comes from tells us remarkably little about the reliability of its services.This brings us to the third, and perhaps most important, lesson. Coming back to the preferences of competition hawks, the Microsoft outage will almost certainly be used to reinforce the narrative about the pitfalls of concentrating key digital services in the hands of a few large global players. However, recognising concentration risk is one thing, and assuming that interventions designed to weaken large platforms will automatically make digital ecosystems more resilient is quite another.Much of the competition policy targeting concentration focuses on tinkering with platform architecture and design to accommodate competitors. The European Union’s Digital Markets Act (DMA), for instance, requires certain large messaging platforms to interoperate with competing services. But competition and resilience are not the same thing. An intervention that makes room for a competitor does not necessarily make the underlying service more reliable. It may instead weaken integration, introduce complexity, and impose costs on existing users.you may likeImagine creating the functional equivalent of an outage on an incumbent platform in the hope of triggering an immediate shift to its competitors, just for the sake of doing so. You would cause considerable pain to stakeholders without any guarantee of a corresponding upside, having potentially wiped out the efficiencies that drew users to the incumbent in the first place. These advantages are not trivial. Large platforms provide Indian MSMEs and start-ups access to global markets, customers and services that would otherwise remain out of reach. The OECD has documented how these platforms reduce transaction costs and expand cross-border market access for smaller businesses. These considerations are important for India, which is also considering introducing its version of the DMA, the Digital Competition Bill.The Microsoft outage is a reminder that governments and businesses need to take operational resilience seriously. However, it should not become an excuse for localisation mandates or poorly designed competition interventions that undermine the very efficiencies users benefit from. The lesson we must draw from this incident is that the services we depend on must be able to withstand failure, regardless of who provides them.Meghna Bal is Director of the Esya Centre, a tech policy-focused think tank based in New Delhi