What the airlines said
ITWeb reported that the airlines posted separate notices on X on 13 November, telling passengers to use alternative contact channels while the disruption lasted. The two notices differ in how specific they are.
- SAA described a "temporary disruption to certain Microsoft-based systems." That could affect some of its digital platforms and customer service channels. It asked passengers with urgent travel, booking or service questions to contact its departments directly. ITWeb's report doesn't say which SAA systems were affected, so this shouldn't be read as "all SAA online services are down."
- FlySafair was more specific. It said the outage was disrupting its email, so it was temporarily unable to send or receive messages. It directed customers to its call centre on 087 357 0030 or WhatsApp on 072 940 4565.
Both airlines apologised or expressed regret. Both asked customers to keep using the alternative channels "until further notice." ITWeb gave no restoration time for either. Check each airline's own channels for current status before relying on any of this.
Flight operations: ITWeb noted that neither notice said flights were grounded or schedules were affected. The reported impact is on customer-facing communications, not aircraft or flight operations.
The outage behind the notices
The problem didn't start on Friday. NBC News reported it began around 12:50 p.m. ET on Thursday, 12 November, with hundreds of thousands of people flagging email problems in Outlook. By Friday morning, ABC News reported, Microsoft said it was seeing early stabilization and capacity improvements as recovery actions continued.
- Services affected: Microsoft said a wide range of Microsoft 365 offerings that interact with Exchange Online and email were affected. Users reported Outlook, Teams and Copilot as down. NBC also listed SharePoint.
- Cause: Variety reported Microsoft said at 6:11 a.m. ET on 13 November that it had no evidence of malicious activity. It promised a full Post-Incident Report with root cause and defense-in-depth actions once mitigation is complete. No root cause had been published at the time of reporting.
- Recovery: Microsoft's updates described improving service availability and email delivery across a growing portion of affected infrastructure. Some users might still see intermittent issues. Microsoft said a 48-hour email timeout window remained in place so delayed messages are protected while delivery catches up. That is useful for admins worrying about bounced or lost mail. Recovery was uneven by region, so "restored" depends on tenant and location.
The security portal concern
ITWeb quoted security firm Integrity360 saying the front-end portal used to manage Microsoft security services and view alerts also appeared to be affected. The firm said the security services kept running in the background, but customers couldn't manage their security estate or see alerts through the portal.
This is Integrity360's assessment. ITWeb's report didn't include a Microsoft confirmation, and it doesn't name the products or tenants involved. It doesn't show that protections stopped working. It does show a real operational gap: if the console is dark, your team is blind even when the tooling is working.
What the experts said
Integrity360 argued that many organisations "have put all their eggs in the Microsoft basket" and should limit single-vendor exposure where they can. It also floated whether AI demand on compute, and a scramble for RAM, could mean more outages ahead. That is speculation. Nothing reviewed ties AI demand or hardware prices to this outage, and Microsoft hasn't given a cause.
Steven Cohen, founder of South African firm iSteve, framed it as a boardroom risk. In his words, an email outage can become "a sales problem, a customer-service problem and a cash-flow problem." He singled out medical practices, law firms and accounting firms as especially exposed to prolonged disruption. His advice:
- Assess how much you rely on cloud platforms.
- Keep critical information reachable during an outage.
- Test backup and recovery regularly. A backup is only useful if you can access and restore it.
- Know who controls your data, how recovery works, and which critical activities can continue while services are restored.
He also warned that switching providers doesn't remove outage risk. Any provider, including a smaller one, needs the same scrutiny on security, hosting, backups and recovery.
Putting the costs in context
ITWeb cited Uptime Institute's Annual Outage Analysis 2026. That report was announced on 13 May 2026. Its survey figures: 57% of respondents said their most recent major outage cost more than $100,000, and one in five reported costs above $1 million. These are broad infrastructure-outage statistics. They are not estimates of losses at SAA, FlySafair or from this incident.
Uptime also found that over nine years, third-party IT and data-center providers, including cloud giants, accounted for about two-thirds of publicly reported outages it tracked. That supports the dependency argument in general terms. It says nothing about this specific failure.
Practical takeaways for IT admins
These are general continuity practices, not steps either airline is confirmed to have taken.
- Publish a fallback contact route that doesn't depend on your email tenant. FlySafair's phone and WhatsApp numbers are a simple example.
- Keep an out-of-band status plan. Microsoft warned that admins might be unable to reach the admin center for service health. Follow Microsoft's social channels and use a non-Microsoft communication tool for incident coordination.
- Check mail-flow expectations. With the extended 48-hour timeout in place, senders may not see immediate bounces. Confirm with key partners before resending or assuming lost mail.
- Don't treat a dark portal as an all-clear. Verify through other means that your security tooling is still protecting you.
- Rehearse restore and access, not just backup creation.
Bottom line
Based on what the airlines said, passengers lost some convenience and customers lost email contact, but no flight disruption has been reported. The bigger lesson is concentration risk. When one vendor carries email, collaboration and the console for your security tools, one bad day can reach every part of the business. Microsoft's promised Post-Incident Report will be the document to watch for an actual cause.