The Dutch tax office abandons Microsoft 365 and brings email and calendars on-premises in 2027
On October 7, 2026, the Dutch State Secretary for Finance announced that the Tax and Customs Administration is dropping its Microsoft 365 migration: email and calendars move on-premises in 2027, with European open source for storage and collaboration to follow. For European IT leaders, it is the most concrete signal yet that sovereignty is no longer a slogan but a budgeted trajectory.
October 7, 2026. Eelco Eerenberg, the Dutch State Secretary for Finance, announced in a letter to parliament that the Tax and Customs Administration (Belastingdienst) is abandoning its Microsoft 365 migration. 47,500 staff. That is the workforce affected, spread across tax, customs and benefits services. 2027. That is the year email and calendars move to on-premises infrastructure, followed in 2027 and 2028 by storage and collaboration on European open source. Why it matters: this is not a project killed at the study stage — Microsoft 365 had already been selected in 2025 and rolled out to 5,000 staff, and the administration is reversing course despite the money already spent.
A decision, not just a report
The timeline matters. The Dutch tax authority picked Microsoft 365 in 2025, aiming to complete the rollout by the end of 2026. The project never convinced: in June 2026, the Dutch Advisory Council on ICT Assessment was already recommending a rollback of a deployment that had reached roughly 5,000 of 47,500 seats. This week’s letter turns that recommendation into a firm decision.
The precise schedule is in the State Secretary’s letter. “In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open source solutions for personal storage and collaboration functionalities will follow,” Eerenberg wrote. Increased capacity in the administration’s own datacenters makes the on-premises option possible, and the agency will reuse existing licenses where possible to limit additional investment.
The three grievances against American cloud
The June council report grounds the reversal in an unambiguous verdict: the design of Microsoft 365 in the public cloud “falls short” on information security, information processing and future-proofing.
The first grievance is the most political. Confidential documents that currently travel over government networks would have moved across American servers. The council also criticized reliance on Microsoft’s standard encryption for sensitive data rather than Double Key Encryption, which would have left the administration in control of its keys. End-to-end encryption was not enabled by default for one-to-one Teams calls, and was unavailable for group calls under the chosen configuration.
The third grievance is about lock-in. A single American supplier with no exit strategy: the council flagged the risk of dependency and lost flexibility, compounded by the CLOUD Act, which lets US authorities compel American providers to disclose hosted data wherever it lives. That point, more than the others, explains why the Dutch debate is not about “which office suite” but about “who holds the keys and the data.”
The reversal is not frictionless. The administration still has to replace capabilities that exist only in the cloud version of Microsoft 365, and its records-management design depends on those. Increased datacenter capacity and the reuse of existing licenses soften the cost, but the exit strategy is being retrofitted because it was never written at entry — and the price of that retrofit is now visible in public, line by line, in a letter to parliament.
A European wave that is not slowing
The Dutch case is not isolated. It joins DAWO, the sovereign workstation the Dutch government is building on NixOS, La Suite in France, openDesk in Germany — adopted by the International Criminal Court in The Hague — and Switzerland’s trials to move off Microsoft 365. US sanctions aimed at international institutions acted as an accelerant, but the underlying motivation is older: reducing a structural dependency.
European open-source vendors are banking on that momentum. Nextcloud says it added more than two million sovereign workspace seats in 2025, and its founder Frank Karlitschek welcomed a decision that “will benefit the resilience” of the Dutch administration. Element, whose Matrix protocol already powers the French state messaging service Tchap, is targeting the same ground.
Not everything is smooth. A Politico report quoted a European Commission staffer calling the Teams alternative supplied by Element “absolute shit” on an internal board. Matthew Hodgson, Element’s CEO, responds by pointing to “a few unhappy change-resistant users” in large deployments — a reminder that sovereignty also costs comfort, at least during the transition.
What it changes for an IT leader
The Dutch case is full of operational lessons. First: sovereignty is decided before deployment, not after. An organization that has already migrated 5,000 seats faces a real exit cost, and that cost is precisely what long froze decisions. Second: encryption is an architecture criterion, not a checkbox. The complaint over Double Key Encryption and the missing end-to-end encryption shows that a “encrypted” suite guarantees nothing if the keys remain with the vendor. Third: the exit strategy must be written on the day of entry. The Dutch council explicitly criticized the absence of an exit plan — an expectation few organizations still impose on their cloud vendors.
Verdict
If your organization holds sensitive data subject to European jurisdiction, read this reversal as a precedent rather than an anecdote: a major public body priced the cost of leaving American cloud and decided to pay it. If you are an open-source vendor or integrator, the trajectory is clear — email and calendars first, storage and collaboration next — and European public administrations form a market that is being built in front of you. In every case, do not reduce this file to an office-suite war: the real dividing line is control of keys, data and the exit strategy, and it is on those three points that American cloud is losing ground, one ministry at a time.