Microsoft 365 outage spares flights but exposes airline dependencies

By Sophie Lindqvist

A Microsoft 365 failure that began at about 18:00 UTC on Thursday ran past 20 hours and affected users in at least 74 countries. Most flights continued, and no British or European airline reported cancellations. The clearest airline disruption sat in India, where SpiceJet grounded three departures from Delhi and delayed two more.

Exchange Online and Outlook failed first, and Teams, SharePoint and Copilot followed. According to Airlive, the outage largely spared core air traffic and flight dispatch systems, which separated this event from the CrowdStrike crash of 19 July 2024.

What did airlines lose, and what kept working?

Airlines lost support channels far more often than they lost aircraft. Their responses differed sharply:

• SpiceJet cancelled three Friday morning departures from Delhi to Pune, Leh and Mumbai, and delayed two more, blaming internal coordination systems that were struggling with the outage.
• IndiGo and Akasa Air lost their email support services. IndiGo directed customers to its website, app and AI assistant; Akasa Air pointed them to a 24-hour call centre and social media.
• Air India kept its flights on schedule and rerouted incoming email through alternative servers.
• Delta's customer services stayed up, but staff struggled to send and receive internal email.
• Cathay Pacific warned that passengers using Microsoft email services might not receive flight notifications, and issued boarding passes through its app, SMS and email.
• Scoot warned of slower responses to enquiries.

Travel agencies, hotels and airport service providers across Europe, North America and Asia Pacific reported delays to booking correspondence, refunds and last-minute changes. In the UK, the BBC reported Liverpool and Manchester airports operating normally.

"Microsoft outage" became one of the biggest trending searches on Google in the UK over the past day, with more than a million searches according to Google Trends. The search volume tracked public attention rather than any collapse in flying.

Why was this not another CrowdStrike?

In 2024, a faulty CrowdStrike update crashed roughly 8.5 million Windows computers. Among them sat machines running check-in, baggage and gate systems at airports worldwide.

At Gatwick, some airlines' check-in, baggage, security and eGate (self-service boarding) systems failed. Stansted and Manchester reverted to manual check-in for some airlines, Ryanair asked passengers to arrive three hours early, and Wizz Air waived airport check-in fees.

Cirium counted 167 UK departures and 171 UK arrivals cancelled on the first day, within 5,078 cancellations worldwide. Delta bore the heaviest load: more than 7,000 flights cancelled over five days, around 1.3 million passengers disrupted and an estimated cost of about $550m.

Its crew tracking system was overwhelmed by the backlog of schedule changes, and the airline struggled for days to match crews to aircraft. This week's failure reached cloud email and collaboration services instead of airport desktops, which explains why the aviation impact stayed an inconvenience rather than a meltdown.

Where has the risk moved?

Email has quietly become an operational channel for many airlines. Booking confirmations, schedule changes, disruption notices and boarding passes all travel by email, and refunds and rebookings rely on it.

When that channel fails, passengers miss information, call centres fill, and staff lose the tools they use to coordinate with each other. Airlines and aviation authorities advised Friday's passengers to check flight status through airline apps and airport departure boards rather than email.

The pattern of the response matters more than the cancellation count. Carriers able to reach customers through an app, SMS, a website, an AI assistant or a 24-hour call centre kept more of their operation intact than those whose internal coordination depended on the failed services.

SpiceJet is the warning. Its cancellations came because internal coordination depended on systems that stopped working, and few airlines can say with confidence which operational processes still rely on email or Teams behind the scenes.

What does this change for airline resilience?

This was the second major global IT failure to hit aviation in under two and a half years, and both centred on the Microsoft ecosystem. In 2024 a security product crashed Windows computers; this time Microsoft's own cloud service failed.

Microsoft's difficulty fixing the problem should concern airlines as much as the interruption itself. The company said "actions taken thus far have not provided the anticipated relief," reported that attempts to add capacity got stuck, and found no evidence of a cyberattack. It later reverted a recent network configuration change, and by Friday afternoon reported improvements across North America and much of Europe.

The concentration risk is structural. Airlines, like most large businesses, depend on a small number of technology suppliers for systems they cannot run without. When one supplier fails, every customer fails at once, and none can fix it alone.

That points to three preparations: passenger notifications that work without a single email provider; crew and operations communications with a fallback that does not depend on the same cloud; and manual processes that staff have actually practised. Contracts should also reflect how much a supplier failure can cost.

The legal pressure is already visible. Delta sued CrowdStrike over its 2024 losses, and in May 2025 a Georgia court allowed its gross negligence claims (allegations that a supplier failed to exercise reasonable care) to proceed.

The practical question for airlines is simple: what changes if the next failure reaches check-in desks as well as inboxes? Mapping hidden email and Teams dependencies now would cost less than grounding aircraft later.