Why China barely felt Microsoft’s outage, and what it means for data sovereignty - CGTN
By continuing to browse our site you agree to our use of cookies, revised Privacy Policy and Terms of Use. You can change your cookie settings through your browser.
An error message is shown when trying to access Microsoft's Outlook in Chicago, Illinois, US, November 12, 2026. /VCG
Microsoft's latest failure was global in reach, but not global in impact.
From around 4.17 p.m. UTC on Thursday, the US tech giant's services including Outlook, Teams, Exchange Online, SharePoint, OneDrive and Copilot, were degraded for more than 10 hours. The disruption reached at least 74 countries, with Outlook complaints on Downdetector – a third-party outage-monitoring platform that aggregates user reports – peaking near 140,000.
The damage was heavily concentrated in the Americas, Europe and Australia. Governments didn't treat it as a purely private-sector issue. Germany's federal cybersecurity authority, BSI, said it was in contact with Microsoft and that "numerous companies" had been cut off from core cloud services. Australia's Home Affairs Minister Tony Burke said he had activated a mechanism requiring Microsoft to prioritize the country's recovery, after both the Australian Federal Police and the domestic intelligence agency ASIO confirmed they were hit. Japan's government said its shared administrative IT backbone, GSS, was disrupted forcing some ministries back to phone communication. The Philippines' Supreme Court warned that email responses and online transactions would be delayed.
China sat in a blank space on that map.
Multinationals in Shanghai on Microsoft's global platform were hit, as were Chinese exporters whose partners live on Outlook. Some foreign firms and foreign-related personnel in China using the global version were still affected. But the broader country didn't blink.
Microsoft 365 in the Chinese mainland isn't run by Microsoft. It's licensed to 21Vianet – a Chinese data center and cloud provider, which runs a physically and logically isolated instance inside the country. Accounts hosted by 21Vianet are kept separate from Microsoft’s global cloud, so they weren't caught up in the global failure.
Government agencies and state-owned enterprises have been actively migrating to domastic services – WPS office suite, DingTalk enterprise collaboration platform, WeCom for internal communication and customer contact, and Feishu, an integrated collaboration platform for documents, meetings, tasks and management – with many replacements due by 2027. So an incident at Microsoft's headquarters in Redmond doesn't constitute a national incident in China.
China's strict data laws forced data and operations onshore, making cross-border transfers conditional rather than default, subject to security assessment, certification or standard contract.
Over the past decade, China has built a legal framework through the Cybersecurity Law, Data Security Law and Personal Information Protection Law. In practice, this means data is protected according to how sensitive it is, operators of key infrastructure face extra safeguards, and sending data abroad is not the default. Companies must first pass a security review, obtain certification or sign standard contracts.
The goal isn't to switch off the internet but to make the legal and technical basis of connectivity a matter of sovereign choice.
But the immunity is partial and should not be mythologized. The underlying risk – extreme concentration in a handful of massive cloud providers – applies equally to Chinese services like Alibaba Cloud, Huawei Cloud and Tencent Cloud.
That is the real takeaway here. True digital sovereignty is not autarky. An isolated stack can fail alone, quietly, with no external scrutiny. What matters is having an exit startegy: data you can pack up and move, interoperable standards, contractual rights to audit and migrate, and mandatory disclosure when systems go down.
The outage proved that putting all your eggs in one basket comes at a cost. China is trying to strike a balance between staying open to the world without ceding its national cyber sovereignty.
