Dutch Tax and Customs Administration cancels Microsoft 365 cloud rollout, shifts to on-premises and open-source tools
The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout and will move to an on-premises, open-source approach, citing digital sovereignty and data control concerns. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the rollout in June. The government paused the plan in July, and the latest announcement replaces it. The decision fits a wider European trend: the Linux Foundation reported at Open Source Summit Europe that 94% of EU organizations consider digital sovereignty important. This is policy and industry news with no direct threat to defenders.
Technical Details
- The ICT assessment found the chosen Microsoft 365 public-cloud design fell short on information security, information processing and future-proofing.
- Concerns included confidential documents transiting American servers instead of government networks, and reliance on standard Microsoft encryption rather than Double Key Encryption.
- End-to-end encryption would not have been enabled by default for one-to-one Teams calls and would have been unavailable for group calls under the selected configuration. The article stresses these are criticisms of this deployment design, not of every Microsoft 365 configuration.
- Vendor lock-in, reduced flexibility and the lack of an adequate exit strategy were also cited.
- State Secretary for Finance Eelco Eerenberg set out the timetable: on-premises mail and calendar in 2027, then European open-source solutions for personal storage and collaboration in late 2027 and 2028. Existing Microsoft software, including Outlook, stays for now.
- No open-source stack has been chosen. Options mentioned are DAWO (built on NixOS), France's La Suite, Germany's openDesk, and MijnBureau (Nextcloud, Collabora, Element, OpenProject).
Remediation
No remediation is applicable. Organizations weighing similar cloud migrations may review encryption key control, default end-to-end encryption settings, data residency and exit strategy.
Linha do tempo
-
Dutch Tax and Customs Administration cancels Microsoft 365 cloud rollout, shifts to on-premises and open-source tools
ler a análise desta fonte ocultar
The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout and will move to an on-premises, open-source approach, citing digital sovereignty and data control concerns. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the rollout in June. The government paused the plan in July, and the latest announcement replaces it. The decision fits a wider European trend: the Linux Foundation reported at Open Source Summit Europe that 94% of EU organizations consider digital sovereignty important. This is policy and industry news with no direct threat to defenders.
Technical Details
- The ICT assessment found the chosen Microsoft 365 public-cloud design fell short on information security, information processing and future-proofing.
- Concerns included confidential documents transiting American servers instead of government networks, and reliance on standard Microsoft encryption rather than Double Key Encryption.
- End-to-end encryption would not have been enabled by default for one-to-one Teams calls and would have been unavailable for group calls under the selected configuration. The article stresses these are criticisms of this deployment design, not of every Microsoft 365 configuration.
- Vendor lock-in, reduced flexibility and the lack of an adequate exit strategy were also cited.
- State Secretary for Finance Eelco Eerenberg set out the timetable: on-premises mail and calendar in 2027, then European open-source solutions for personal storage and collaboration in late 2027 and 2028. Existing Microsoft software, including Outlook, stays for now.
- No open-source stack has been chosen. Options mentioned are DAWO (built on NixOS), France's La Suite, Germany's openDesk, and MijnBureau (Nextcloud, Collabora, Element, OpenProject).
Remediation
No remediation is applicable. Organizations weighing similar cloud migrations may review encryption key control, default end-to-end encryption settings, data residency and exit strategy.