SaaS Concentration Risk Scorer: One Provider, How Many Eggs?
The Microsoft 365 outage that began on 12 November 2026 started with Exchange Online mailbox access failures in the Americas, then affected Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR in multiple regions, per Microsoft and press reports. Microsoft said it is not aware of malicious activity causing it. If your email, chat, sign-in, security monitoring and incident channel all live with one provider, find out what stops working together, and what to set up before the next outage. Read what we know about the Microsoft 365 outage.
Fill every row with one provider, then change the rows that differ. Or answer row by row below.
1. Who runs each capability?
For each one, pick the provider and say whether a fallback exists and has been tested (used in a drill or a real outage).
- Identity, SSO and MFAweight 3
Where people sign in, and where MFA is checked (e.g. Microsoft Entra ID, Google sign-in, Okta).
- Endpoint / XDR security monitoringweight 3
The tool that detects and responds on laptops and servers (e.g. Microsoft Defender XDR).
- SIEM / log collectionweight 2
Where security logs land and alerts are raised (e.g. Microsoft Sentinel, Google SecOps, Splunk).
- Incident communications channelweight 3
Where the incident team actually talks during an incident.
- Status and contact listsweight 2
Who to call, phone numbers, escalation tree, customer and regulator contacts.
- Backup of that SaaS dataweight 3
Copies of mail, files and chat, and where they are stored and restored from.
- Emailweight 2
Staff mailboxes (e.g. Exchange Online, Gmail).
- Chat and meetingsweight 2
Day-to-day chat and video calls (e.g. Teams, Google Chat and Meet, Slack, Zoom).
- File storageweight 2
Documents and shared drives (e.g. SharePoint and OneDrive, Google Drive, Box).
- Phone / telephonyweight 2
Desk and call-centre phones (e.g. Teams Phone, Google Voice, a separate carrier).
- AI assistantweight 1
The assistant staff lean on day to day (e.g. Copilot, Gemini, another).
2. Your concentration score
Answer every row to see your score (0 of 11 done).
How the score is worked out
- Each capability has a weight for how much losing it hurts in an outage: 3 for identity, endpoint security, incident comms and backup; 2 for SIEM, contact lists, email, chat, files and phone; 1 for the AI assistant.
- The main provider is whichever of Microsoft 365 or Google Workspace carries the most weight in your answers. "Other" counts as independent, because "other" may be several vendors.
- Share on the main provider: 1 if the capability runs there, 0.5 if it is mixed, 0 if it runs elsewhere. "We don't use this" is left out of the total.
- Fallback factor: a tested fallback keeps 25% of the exposure, an untested fallback keeps 60%, no fallback keeps 100%.
- Score = sum of (weight × share × fallback factor) ÷ sum of weights in use, as 0-100. Bands: under 25 Low, 25-49 Moderate, 50-74 High, 75 and above Critical.
- This is a PlayCISO heuristic to start a conversation, not an industry standard, a benchmark or a measure of probability.
Your answers stay in this browser only; nothing is sent to us.
TL;DRWhat this scorer is
4 points
- Mark which provider runs each of 11 capabilities (Microsoft 365, Google Workspace, other or mixed) and whether a tested fallback exists.
- Get a 0-100 concentration score with the method printed on the page. It is a PlayCISO heuristic, not an industry standard or a probability.
- See your single points of failure, such as security monitoring and incident comms on the same provider, and a prioritized list of fixes: out-of-band comms, independent backup, break-glass accounts, an offline contact list and an alert path that avoids the main provider.
- Free to use, signed out too. Answers stay in this browser and nothing is sent to us. Markdown and PDF reports are available with a paid plan.
Frequently asked questions
What is SaaS concentration risk?
It is the risk that one provider runs so many of your critical capabilities that a single outage, account lockout or tenant-level mistake takes several of them down at once. The classic example is when email, chat, files, sign-in and security monitoring all sit with one suite, and the incident team has nowhere else to meet.
What happened in the Microsoft 365 outage on 12 November 2026?
It began on 12 November 2026 with Exchange Online mailbox access failures in the Americas, then affected Outlook, Teams, SharePoint, Copilot and Microsoft Defender XDR in multiple regions, per Microsoft and press reports. Microsoft said it is not aware of malicious activity causing it and will publish a post-incident report. Our blog post tracks what has been confirmed.
How is the concentration score calculated?
Each capability has a weight (3 for identity, endpoint security, incident comms and backup; 2 for most others; 1 for the AI assistant). Its exposure is weight × share on the main provider (1, or 0.5 if mixed) × a fallback factor (0.25 tested, 0.6 untested, 1 none). The score is total exposure divided by total weight, as 0-100. The full method is on the page. It is a heuristic, not a standard.
Is using Microsoft 365 or Google Workspace for everything a bad idea?
Not by itself. One suite is often simpler and easier to secure. The risk is having no tested way to keep working, and to keep responding to security incidents, when that suite is unavailable. The fixes are usually small: a separate incident channel, an offline contact list, independent backup and tested break-glass accounts.
What is a break-glass account?
An emergency admin account used only when normal admin sign-in fails. For Microsoft Entra ID, Microsoft recommends two or more cloud-only accounts with phishing-resistant sign-in, excluded from Conditional Access policies that block or restrict sign-in, monitored on every use, and validated at least every 90 days.
How do I check Microsoft 365 status if I cannot sign in to the admin center?
Microsoft says to use the service status page at status.cloud.microsoft and the @MSFT365Status account on X. With a working admin sign-in, service health is in the Microsoft 365 admin center under Health > Service health.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.