SLA Breach Lab: Work Out the Credit After a Cloud Outage
Email down for a day, Teams down for hours, the CFO asking what Microsoft owes you. Most teams find out how service credits work only when they need one, and miss the deadline or claim on the wrong definition. Rehearse it here on a fictional company, with the rules from Microsoft’s own SLA. For what is confirmed about the real outage, read our Microsoft 365 outage news post; to estimate your own numbers, use the Microsoft 365 outage cost calculator.
You are Alex Morgan, IT and security lead at Example Logistics Ltd, a fictional company with 2,000 Microsoft 365 users. A fictional outage, modelled on the pattern of the Microsoft 365 outage that began on 12 November 2026, has knocked out email, Teams and SharePoint for parts of several days. Jordan Lee, the CFO, wants to know what Microsoft owes you. Across 11 or 12 decisions you work out the service credit: which services count, the uptime in user-minutes, the tier, the claim, the deadline, the evidence, and what to tell the board. Every user count, fee, hour and revenue figure is made up. The SLA rules come from Microsoft's Online Services SLA (November 1, 2026 edition); where an answer is judgement rather than an SLA rule, the feedback says so.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
SLA source: Service Level Agreement for Microsoft Online Services (WW), November 1, 2026, read 2026-11-13. Scores and figures are a training exercise, not legal or contract advice.
TL;DRWhat this lab is
5 points
- A scenario lab: a fictional company, Example Logistics Ltd, with 2,000 Microsoft 365 users, loses email, Teams and SharePoint for parts of several days in a fictional outage modelled on the pattern of the one that began on 12 November 2026.
- You make 11 or 12 scored decisions: which services the SLA covers and how each measures downtime, uptime in user-minutes from a partial outage, the credit tier, one claim or several, the deadline, the evidence, lost revenue, the CFO and board, fallbacks and Microsoft's Post-Incident Report.
- The SLA rules come from Microsoft's Service Level Agreement for Microsoft Online Services (November 1, 2026 edition). Every user count, fee, hour and revenue figure is made up. Where an answer is judgement rather than an SLA rule, the feedback says so.
- Free to play. A final score and grade, a shareable scorecard and next-step links. A downloadable debrief is available with a paid plan.
- Not legal or contract advice: check the SLA edition and the agreement that apply to your subscription before you file.
Frequently asked questions
How do I claim a Microsoft 365 SLA credit?
Credits are not automatic. You submit a claim to Microsoft customer support with a detailed description of the Incident, the time and duration of downtime, affected resource names, the number and location(s) of affected users, and a description of the errors. Claims missing required information are rejected. Microsoft decides whether a credit is owed, typically within 45 days of receiving the claim (Microsoft Online Services SLA, November 1, 2026 edition).
What is the deadline to claim a Microsoft 365 service credit?
For services other than Azure, Microsoft must receive the claim and all required information by the end of the month after the month of the Incident. The SLA's own example: an Incident on February 15 needs the claim by March 31. For an Incident in November 2026 that is December 31, 2026. Azure claims have a different window (60 days).
How is Microsoft 365 uptime calculated for the SLA?
For Exchange Online, Teams, SharePoint Online and OneDrive for work or school it is (User Minutes − Downtime) ÷ User Minutes × 100 over the calendar month, with downtime in user-minutes: each Incident's length times the users it affected. A 30-day month has 43,200 minutes, so 99.9% allows 43.2 minutes for everyone, 99% allows 432 minutes (7.2 hours) and 95% allows 2,160 minutes (36 hours). Each service has its own downtime definition: Exchange Online's is about Outlook on the web.
Do Microsoft SLA credits cover lost revenue?
No. The SLA says service credits are your sole and exclusive remedy for availability issues and are not awarded for lost revenue, operational costs or indirect losses. A credit is a percentage of the affected service's monthly fees (25%, 50% or 100% for the main Microsoft 365 services) and never more than those fees.
Is this lab about the November 2026 Microsoft 365 outage?
It is modelled on the pattern of that outage, which began on 12 November 2026 (Microsoft incidents EX1550543 and MO1550821), but the company, the hours, the user counts and the fees are fictional. The lab does not assume that outage's cause or duration. For what Microsoft has confirmed, read our news post.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.