Don’t Outlook Up. The Microsoft blackout and the digital sovereignty that Europe lacks

After a week spent looking over our shoulders for hackers, false alarms and sabotaged fridges, the hardest blow to European digital life came from within. On Thursday evening, around 6.30 pm Italian time, Outlook, Teams and Copilot went down in 74 countries, with over 130,000 reports on Downdetector at the peak of the outage. Overnight, the service was partially restored, but this morning entire offices, including those in Italy, were still opening empty inboxes. Microsoft has ruled out malicious activity. No Mikhail Andropov this time: the enemy was the thermometer.

The dynamics of the incident are worth noting: they are more instructive for Italy and for Europe than a hacker attack would be. A large number of servers failed the automatic health checks and were taken offline. The remaining servers had to cope with the traffic normally handled by the others and subsequently crashed themselves. The process responsible for establishing secure connections became overloaded. Servers that were brought back online would crash again as soon as traffic resumed. Microsoft suspects the very component that handles the health checks, but has not yet published the definitive cause. A cloud that becomes ‘ill’ due to excessive diagnostics resembles an autoimmune disease: the system designed to protect the organism ends up attacking it.

Here we see an old economic paradox at work. Concentration breeds efficiency: a single giant spreads the cost of fixed expenses, updates security for everyone and distributes the load on a global scale. But that very concentration transforms independent failures into interconnected ones. When thousands of organisations purchase the same service, they also purchase the same risk. Microsoft 365 contracts provide for service credits – that is, discounts on future invoices – rather than compensation for lost productivity, postponed court hearings or undelivered medical reports. The real damage falls on customers and the wider community: a textbook example of a negative externality. Since 2008, banks have been obliged to measure their systemic risk. Digital service providers, so far, have done so only to a limited extent.

The problem for Europe is one of scale. According to a study by Compass Lexecon for the Open Cloud Coalition, Microsoft holds 77 per cent of the productivity software market in the European public sector, with figures as high as 84 per cent for collaboration tools. The coalition is backed by Google, which has every interest in saying so, but that interest does not make the figure false. Ministries, courts, schools and hospitals speak the same digital language, written in Redmond. When that language breaks down, the administration falls silent. And the risks are not merely technical: in the French Senate in 2025, a Microsoft executive admitted that he could not guarantee that European data would remain safe from requests by the US authorities.

The temptation that follows every blackout is a form of sovereignist self-sufficiency: let’s build our own Outlook. It is the wrong answer to the right question. A single national provider, perhaps a public one, would be a single point of failure flying the tricolour: less efficient, less secure and just as vulnerable. Technological sovereignty does not consist in owning the machines, but in retaining the option to walk away. In economic terms, sovereignty means reducing the costs of switching to the point where the threat of leaving becomes credible. A provider that knows it can be dropped behaves better than one that knows it is irreplaceable.

This gives rise to a number of practical consequences, which do not require billions but rather discipline. The first concerns procurement. Every public contract for critical services should include a verified exit plan, open and interoperable data formats, and periodic migration tests, just as is done with fire drills. The second is redundancy for essential functions. A public administration with only one email channel has none at all the day that channel goes down. Italian schools have just discovered this, having been inundated with threats via a single ministerial channel. An independent emergency channel costs little and is worth a great deal. The third is to assess the risk of concentration using the tools that already exist. The DORA Regulation requires the financial sector to map its dependence on ICT suppliers and subjects the most critical ones – including Microsoft – to the supervision of the European authorities. The same logic should be extended to healthcare, the justice system and public administration, without reinventing the wheel.

That leaves the fourth consequence, the most ambitious: using European public procurement – worth hundreds of billions a year – as a lever for industrial policy. Not to exclude the American giants, but to force them to compete on open standards, alongside European suppliers who currently lack the scale to make their mark. This is the real difference between protectionism and a competitive market. The cloud remains one of the great productivity achievements of the century, and no one can imagine wanting to go back to a server in the cellar. But digital productivity is not a gift of nature: it is an infrastructure with an owner, a point of failure and a hidden price. On Thursday, the servers in Redmond failed their health check. It is high time that Europe and Italy – both their institutions and their businesses – subjected their technological dependence to a radical strategic review.