Dutch tax office ditches Microsoft 365 cloud for on-premises alternative

The Netherlands Tax and Customs Administration has abandoned its planned Microsoft 365 cloud migration in favor of services hosted on infrastructure it controls, alongside European open source alternatives. Email and calendars will move on-premises in 2027, followed by storage and collaboration services later that year and in 2028. The letter to parliament from Eelco Eerenberg, State Secretary for Finance, follows an earlier decision to pause the Microsoft 365 rollout. The tax authority selected Microsoft 365 in 2025, but the decision attracted criticism. In June, the Dutch Advisory Council on ICT Assessment recommended rolling back the cloud services rollout, which had reached about 5,000 of the 47,500 employees across the tax, customs, and benefits services, rather than completing it as planned by the end of 2026. According to the board, the design of Microsoft 365 in the public cloud "falls short on information security, information processing and future-proofing." On security, the board noted concerns about sending confidential documents, which currently travel over government networks, via American servers. The board also criticized reliance on standard Microsoft encryption for sensitive data rather than Double Key Encryption, which would give the administration greater control. End-to-end encryption was not enabled by default for one-to-one Teams calls and was unavailable for group calls under the chosen configuration. To be fair to Microsoft, many of these concerns (for example, around encryption) stem from the design selected. However, others are harder to dismiss. On future-proofing, other concerns included vendor lock-in and the risk of reduced flexibility and sovereignty from choosing a single-supplier solution with one American (cloud) provider. There was also a concern about a lack of an exit strategy for when the Tax and Customs Administration wanted to move on to more sovereign alternatives. In this week's letter, Eerenberg wrote: "In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open source solutions for personal storage and collaboration functionalities will follow. This allows us to work toward a sustainable and more autonomous solution for these functionalities." Increased datacenter capacity has made the on-premises option possible, Eerenberg said. The revised approach will reuse existing licenses where possible to limit additional investment. The reversal creates complications for records management, however. Some planned capabilities in the Microsoft 365 package are unavailable on-premises, and the administration is still assessing how to replace them. Microsoft is no stranger to public bodies in the Netherlands, and a recent report showed that a majority used the company's cloud services. However, concerns about US authorities' ability to compel disclosure of data held by US providers under the CLOUD Act have loomed large in recent years. The risk has prompted European governments to consider reducing their dependence on US providers and moving to more sovereign solutions. It is early days, and agencies report teething trouble switching. A colorful report from Politico quoted an unnamed European Commission staffer describing the Teams alternative supplied by Element as "absolute shit" on an internal message board. The report does not establish how widespread those complaints are. The Matrix protocol underpinning Element's software also powers the French public sector messaging service, Tchap. Element boss Matthew Hodgson was upbeat about the European Commission deployment, telling The Register: "We've only had positive and constructive feedback from our actual customers; the leaders and IT functions that are driving sovereignty. "There's inevitably a few unhappy change-resistant users in large deployments, but we work in lockstep with our customers to gather feedback and incorporate it, especially during the trial phase." As for sovereignty more widely in Europe, Hodgson said: "European governments are moving to alternatives that give them greater sovereignty. They can't leave themselves exposed to being deplatformed, and they recognise that traditional centralised technology isn't resilient enough for an increasingly unpredictable geopolitical climate." Frank Karlitschek, founder and CEO of Nextcloud, a vendor of storage and collaboration software, said: "It is great to see Dutch tax authorities have decided to work toward a sovereign digital workplace. This will benefit the resilience of their operations. "European Public sector organizations mostly use software from a few large, proprietary providers, which has led to strong dependencies. "Organizations have recognized the risks of digital dependencies and are looking for better options to have full control over their data, infrastructure, and underlying technology. The organizations now aim to build a more resilient IT stack." Karlitschek noted a trend forming across Europe. According to Nextcloud, it added more than two million sovereign workspace seats in 2025. Microsoft declined to comment. (R)