Microsoft 365 and Office 2021: continuity needs two plans
Cloud access disruption and unsupported software require different decisions. Organize migration and continuity around verifiable acceptance criteria.
Ler em portuguêsBy Pentesty
Separate confirmed lifecycle information from incident reporting
Microsoft states that Office LTSC 2021 support ended on October 13, 2026. CyberSec Brazil reported European customers having difficulty accessing Microsoft 365 through Global Secure Access around the same time. Matching dates do not establish causation. Check availability reporting against the incident history of the affected tenant rather than assuming every organization experienced the same fault.
Document the user's route to a service
Opening a business document can depend on identity, device state, connectivity, access policy and the destination service. When Teams does not open, the visible application may not be the failed component. Document these dependencies before an incident and retain support contacts outside the platform used for normal communication.
During disruption, record timestamps, affected groups and controlled test results. Compare a reference session with an affected one without weakening policies for the entire organization. This comparison helps distinguish a local issue from a shared dependency failure and provides useful evidence for the provider's support process.
Test emergency communication and access
Choose an alternative coordination channel and a route to official status information. Microsoft documents service-health information and a public option when administrators cannot sign in. Your procedure should assign responsibility for following updates, informing users and deciding whether an alternative business process can be activated.
Emergency access should be narrow, logged and reviewed after use. An outage should not automatically justify disabling strong authentication or allowing every network destination. A tabletop exercise can test the decision process without interrupting production: who authorizes the exception, when does it expire and how is the expected configuration restored?
Begin migration with inventory
For Office LTSC 2021, identify installations, users, add-ins, macros and integrations. Classify business processes that depend on them and choose a representative pilot group. Acceptance should cover compatibility, identity policies, document handling and operational rollback as well as basic application functionality. Buying licenses alone does not demonstrate that those dependencies have been addressed.
- Inventory: compare management-tool records with a sample of real devices.
- Compatibility: test critical workflows and add-ins with their business owners.
- Security: verify policy, updates and document access in the destination environment.
- Exceptions: assign an owner, compensating controls and a deadline to remaining installations.
Measure recovery against a business activity
Select an essential activity such as approving an order or retrieving a contract. Establish the acceptable interruption time and the information that must remain accessible. Then rehearse the alternative procedure with the people who will actually perform it. A document copy that nobody can locate during disruption is not a validated recovery process.
Pentesty's analysis is that migration and resilience should produce different evidence. One demonstrates that deployed software is supported and retains the intended policies. The other shows that staff can continue a priority workflow when a dependency becomes unavailable. A security assessment can verify access paths within its agreed scope; it cannot promise that a service provider will never experience an outage.
Keep the two workstreams connected through a shared change record. A migration that introduces a new authentication dependency should update the continuity exercise, while an emergency workaround should become a tracked review item rather than a permanent undocumented exception.
When a channel returns, check the work still waiting
Editorial update: October 16, 2026
In a September 25, 2026 statement, Dyfed-Powys Police said an incident identified September 14 disrupted non-emergency systems. Telephone services 999 and 101 and emergency response were unaffected; online and email channels had been restored. At that statement’s cutoff, investigators had found no evidence of public-data compromise and were still examining staff information. We infer neither ransomware nor an initial access vector.
The case provides context for testing channels separately. NCSC guidance recommends preparing alternative communications. In Pentesty’s proposed application, a team records which fictional requests arrived during a simulated outage, who received them and where they were tracked, without claiming the cited force lost requests or used this procedure.
Technical restoration of email does not close the exercise. Reconcile the synthetic-request list with records in the alternative channel and restored system: every item needs an owner and a clear state, without duplication that causes conflicting actions. Also check how a person finds the correct channel using previously approved information. The deliverable should distinguish availability, queue integrity and unresolved data questions, with separate acceptance criteria for each conclusion.
Frequently asked questions
Does Office LTSC 2021 stop working when support ends?
End of support does not automatically switch applications off. Microsoft stops providing support and security updates for the product, so organizations need a replacement plan.
Does cloud migration eliminate availability failures?
No. Identity, connectivity, access policies and provider operations remain dependencies. Test critical workflows and their alternatives rather than assuming the subscription itself provides continuity.
Does an outage establish that an attack occurred?
No. Record the impact and consult provider communications. Attributing the cause to an attacker requires specific supporting evidence.
What should the team deliver first?
An owned software inventory and a continuity test for one priority workflow, both with acceptance criteria and recorded outstanding actions.
Sources and references
- Microsoft Lifecycle: Office LTSC 2021 end of support
- Microsoft: service health monitoring
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.