Dutch tax office abandons Microsoft 365 cloud for on-premises and open source alternatives

Reversal follows security and sovereignty concerns over American cloud provider

By LineZotpaper
Published
Read Time2 min
The Netherlands Tax and Customs Administration has scrapped its planned migration to Microsoft 365 cloud services, opting instead to host email, calendars, and collaboration tools on its own infrastructure and on European open source solutions, citing information security, vendor lock-in, and sovereignty risks.

The Dutch government has reversed course on a cloud migration that was already partly rolled out. In a letter to parliament, State Secretary for Finance Eelco Eerenberg announced that email and calendar services will move on-premises in 2027, with personal storage and collaboration functionalities following later in 2027 and 2028 via European open source alternatives. The decision comes after the independent Dutch Advisory Council on ICT Assessment recommended in June that the tax authority halt its Microsoft 365 rollout, which at that point had reached about 5,000 of the 47,500 employees across tax, customs, and benefits services.

The advisory board found that Microsoft 365 in the public cloud fell short on information security, information processing, and future-proofing. Specific concerns included sending confidential documents over American servers, reliance on standard Microsoft encryption rather than Double Key Encryption, and the fact that end-to-end encryption was not enabled by default for one-to-one Teams calls and was unavailable for group calls under the chosen configuration. The board also warned about vendor lock-in, reduced flexibility, and the lack of an exit strategy for moving to more sovereign alternatives.

Eerenberg wrote that increased datacenter capacity has made the on-premises option feasible and that the revised approach will reuse existing licenses where possible to limit additional investment. However, the reversal creates complications for records management, as some planned capabilities in the Microsoft 365 package are unavailable on-premises, and the administration is still assessing how to replace them.

The shift reflects broader European concerns about the CLOUD Act, which allows US authorities to compel disclosure of data held by American providers. Several European governments are exploring sovereign alternatives, though teething troubles have been reported. A Politico article quoted an unnamed European Commission staffer describing the Teams alternative supplied by Element as "absolute shit" on an internal message board. Element CEO Matthew Hodgson struck a more positive tone, telling The Register: "We've only had positive and constructive feedback from our actual customers; the leaders and IT functions that are driving sovereignty. There's inevitably a few unhappy change-resistant users in large deployments, but we work in lockstep with our customers to gather feedback and incorporate it."

§

Analysis

Why This Matters

  • Affects how European governments approach cloud procurement, potentially accelerating moves away from US hyperscalers.
  • Sets a precedent for other Dutch agencies and possibly other EU member states grappling with data sovereignty and CLOUD Act risks.
  • Demonstrates that even partially completed migrations can be reversed, though at a cost in terms of records management and interim capabilities.

Background

The Netherlands Tax and Customs Administration selected Microsoft 365 in 2025, but faced immediate criticism over security and sovereignty. In June 2026, the Dutch Advisory Council on ICT Assessment recommended rolling back the cloud rollout, which had reached about 5,000 of 47,500 employees, rather than completing it by end of 2026. The council flagged inadequate encryption, reliance on US servers, and lack of an exit strategy. The government now plans to host services on-premises followed by European open source software, citing increased datacenter capacity as an enabling factor. European institutions have been exploring sovereign alternatives, with the European Commission deploying the Matrix-based Element platform, though user complaints have surfaced.

Key Perspectives

[Dutch Tax and Customs Administration]: Seeks greater control over data security and long-term autonomy, willing to forgo some cloud functionality to achieve sovereignty. Acknowledges records management challenges but prioritises independence from US providers. [Microsoft]: The company faces a setback in a key European government account, but the concerns stem partly from the specific configuration chosen by the administration, not necessarily from its platform capabilities. Microsoft remains widely used across Dutch public bodies. [Open source advocates and sovereignty proponents]: View the reversal as validation of the push for European digital autonomy. Element and other Matrix-based alternatives are positioned as viable replacements, though user experience complaints suggest adoption hurdles remain. [Skeptics and change-resistant users]: Some staff may find the new tools less mature or harder to use, as exemplified by the unnamed EC staffer's criticism of Element. Large deployments inevitably encounter such friction, but the Dutch administration will need to manage the transition carefully.

What to Watch

  • Whether the Dutch tax office meets its 2027 on-premises deadline for email and calendar without significant disruption.
  • How other Dutch agencies respond: will they follow suit or double down on existing cloud commitments?
  • The European Commission's own experience with Element: if widespread dissatisfaction persists, it could undermine the case for sovereign alternatives.
  • Any legal or political reaction from Washington regarding the CLOUD Act implications of the Dutch decision.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.