What Happens If Your US Cloud Provider Cuts Access Tomorrow: A 72-Hour Scenario for European Businesses

This is not a prediction. It is a scenario exercise. We describe what would happen, hour by hour, if a typical 30-person European professional services firm lost access to its US cloud provider overnight. The firm runs on Microsoft 365 with Azure AD, Exchange Online, SharePoint, Teams, and OneDrive. It has no documented exit strategy.

The purpose is not to cause alarm. It is to make the dependency concrete, because most organisations cannot articulate what would actually break until they walk through it.

Why This Scenario Is Not Hypothetical

Before the walkthrough, three precedents:

1. Russia, March 2022. Microsoft, Google, Apple, and other US technology companies suspended or restricted services to Russian organisations following the invasion of Ukraine and subsequent US/EU sanctions. Russian businesses using Microsoft 365 experienced sudden loss of access to email, files, and collaboration tools. The restrictions were imposed with days of notice, not months.

2. Iran, ongoing. Iranian users have been cut off from Google services, GitHub, Slack, and other US platforms for years under US sanctions. Developers, researchers, and businesses lost access to their own code repositories, email archives, and project histories.

3. Cuba, Venezuela, Crimea. Organisations and individuals in US-sanctioned regions have reported sudden account suspensions from Google, Microsoft, Amazon, and other US cloud providers, often with no individual warning and limited appeal mechanisms.

The common thread: US cloud providers comply with US sanctions law. They do so quickly, comprehensively, and with limited consultation with affected customers. The legal mechanism exists. The operational playbook has been tested.

The question for European businesses is: under what circumstances could similar restrictions apply to EU organisations? Trade disputes, retaliatory sanctions, changes in US foreign policy, or a future CLOUD Act conflict could all create scenarios where US providers restrict or condition access to European customer data.

Hour 0: Access Is Revoked

At 06:00 CET on a Tuesday morning, the firm’s IT administrator receives an email (sent to a personal address, since work email is now inaccessible) from Microsoft stating that the organisation’s Microsoft 365 tenant has been suspended pending review.

What immediately stops working:

• Email. Exchange Online is offline. No employee can send or receive email. No new messages arrive. Existing messages in mailboxes are inaccessible.
• Calendar. All calendar entries, including today’s client meetings, are inaccessible. External calendar invitations (sent via Exchange) are orphaned.
• Identity. Azure AD authentication fails for every SSO-connected application. Employees attempting to log into Salesforce, HubSpot, Jira, Notion, or any tool connected via Microsoft SSO see an authentication error.
• MFA. Employees using Microsoft Authenticator for MFA on non-Microsoft services cannot complete login. Services that require MFA are inaccessible even if they have their own authentication system.
• Files. OneDrive and SharePoint are offline. Documents, templates, contracts, client deliverables, and internal policies are inaccessible. Files synced to local machines via OneDrive are still on the laptop, but syncing stops. Any file edited after the last sync is gone.
• Teams. Chat history, channel conversations, meeting recordings, and file tabs are inaccessible. Ongoing project discussions are frozen.
• Intune. If device compliance policies require Azure AD check-in, managed laptops and phones may begin showing compliance warnings or restricting access to local resources.

Hour 1-2: The Cascade

The IT administrator begins troubleshooting. Initial confusion: is this an outage or a suspension? Microsoft’s status page shows no global outage. Support channels are unresponsive (the firm’s support contract is tied to the suspended tenant).

Employees arrive at their desks and cannot log in. They begin texting each other on personal phones. The firm has no alternative communication channel.

Secondary failures emerge:

• CRM access. Salesforce logins fail because SSO is down. Employees with direct Salesforce passwords can still log in if they remember them. Most do not, because SSO replaced direct login two years ago.
• Project management. Jira/Asana/Monday.com logins fail via SSO. Some employees have fallback passwords. Most do not.
• Client portals. If the firm operates a client-facing portal authenticated through Azure AD, clients cannot access their documents.
• Automated workflows. Power Automate flows that send reminders, route approvals, or sync data between systems stop running silently. Nobody notices for hours.
• Scheduled meetings. Teams meetings scheduled for today are inaccessible. The firm has no way to join or notify attendees. External attendees clicking the Teams link see an error page.

Hour 4-8: Crisis Response

By mid-morning, the firm has established a communication channel via WhatsApp or Signal (personal accounts). The managing partner, the IT administrator, and the operations manager convene.

Immediate priorities:

1. Communication with clients. The firm cannot send email from its domain. Options: use personal email accounts, set up a temporary email service, or call clients by phone. Each option has problems. Personal email looks unprofessional and may end up in spam. A new email service takes hours to configure with proper DNS records (SPF, DKIM, DMARC). Phone calls do not scale.

2. Access to critical documents. Contracts due for signature today are locked in SharePoint. The latest versions are inaccessible. Older versions may exist as email attachments in personal accounts, but finding them takes time.

3. Financial operations. If the firm uses Microsoft 365-integrated tools for invoicing, expense management, or payroll processing, these may be disrupted.

4. Legal assessment. The firm’s lawyer (if not also locked out of email) needs to assess the suspension notice, Microsoft’s terms of service, and the firm’s rights under the applicable contract and EU law.

Hour 12-24: Damage Assessment

By the end of the first day, the firm has a clearer picture of what is lost and what is merely inaccessible:

Inaccessible (but presumably recoverable if access is restored):

• Email archive (years of correspondence)
• SharePoint/OneDrive files (all company documents)
• Teams chat history (institutional knowledge)
• Calendar data (upcoming commitments)

Potentially lost:

• Power Automate workflows (configurations, not just data)
• Azure AD conditional access policies (security configurations)
• SharePoint site structures and permissions (organisational logic)
• Google/Microsoft OAuth tokens for third-party apps (access relationships)

Confirmed lost:

• Productive work hours for 30 employees for an entire day
• Client confidence (missed meetings, missed deadlines, unexplained silence)
• Revenue from delayed deliverables

Day 2-3: Rebuilding From Nothing

On the second day, the firm begins building a parallel infrastructure. Without preparation, this involves:

1. New email. Register with a European email provider (Proton, Open-Xchange, or Mailcow on a VPS). Configure DNS records. Send test emails. Notify clients of the new addresses. This takes a full day for a competent sysadmin.

2. New identity. Deploy Keycloak or Authentik on a European cloud provider (Hetzner, OVHcloud). Create user accounts. Begin reconnecting third-party applications via SAML/OIDC. Each application requires individual configuration. With 20 SSO-connected apps, this takes days.

3. New file storage. Deploy Nextcloud. Create user accounts and shared folders. Begin uploading whatever files exist on local machines. The organisational structure (who has access to what) must be rebuilt from memory.

4. New communication. Deploy Element (Matrix) or Nextcloud Talk. Create channels. Invite the team. Establish new communication norms.

Each of these tasks is achievable. None of them is fast under pressure. And none of them recovers the data locked in the suspended Microsoft 365 tenant.

The Cost

For a 30-person professional services firm billing an average of €150 per hour, the direct costs of this scenario:

These numbers do not include long-term client attrition, regulatory consequences (if personal data was affected), or the cost of implementing a proper backup and exit strategy after the fact.

What Would Have Changed With Preparation

An organisation that had completed a dependency audit and built a basic contingency plan would face a fundamentally different scenario:

• Alternative identity provider running in parallel. Keycloak or Authentik pre-configured with SSO connections to critical applications. Employees can log into their tools within minutes, not days.
• Email backup. A secondary MX record pointing to a standby email server. Incoming mail continues to flow even if Exchange is down.
• File backups. Regular backups of SharePoint/OneDrive to EU-hosted storage (Nextcloud, Hetzner Storage Box, or similar). Critical documents are accessible within the hour.
• Communication fallback. A pre-configured Element or Rocket.Chat instance that the team has used before. Not a scramble to set up WhatsApp groups.
• Documented procedures. A runbook that the IT administrator can follow under pressure, with DNS records, credentials, and step-by-step instructions for activating the fallback infrastructure.

The cost of this preparation: €3,000 to €8,000 for the audit and initial setup, plus €200 to €500 per month for maintaining the fallback infrastructure. A fraction of the cost of an unprepared outage.

The Planning Question

This scenario is extreme. Most European organisations will never experience a total access revocation. But partial disruptions, pricing changes, terms of service modifications, and regulatory conflicts are common and increasing.

The question is not whether this exact scenario will happen to your organisation. The question is whether you could answer, with confidence and specificity, what your organisation would do in the first four hours if it did.

If you cannot, a dependency audit is the place to start.

Sovereign Shift maps every dependency in your stack, scores each one for risk, and delivers a contingency plan you can act on. Start with an audit →