Dutch tax office abandons Microsoft 365 to run its email on its own servers

The Dutch tax authority has abandoned its move to Microsoft‘s cloud office suite and will run its email, calendars and office tools on servers it owns or controls, backed by European open source software. The Belastingdienst, together with the Dutch customs service and the agency that pays out benefits, was supposed to work inside Microsoft’s public cloud, on Outlook, Teams and the online Office apps. Now the institution that holds the financial records of every Dutch taxpayer is pulling that work back onto its own hardware.

The trigger was a verdict from the government’s own IT watchdog. The Advisory Council on ICT Assessment concluded that the public-cloud design “falls short on information security, information processing and future-proofing,” as The Register reported. Its list of problems reads like a checklist any organisation on Microsoft’s cloud could run against itself: confidential documents passing through American servers, and standard Microsoft encryption instead of Double Key Encryption, the option that leaves one key in the customer’s hands.

The council also found that one-to-one Teams calls were not end-to-end encrypted by default, and that group calls could not be encrypted that way at all. Above everything else sat the lock-in problem: a single American provider, and no exit strategy if the tax office ever needed to leave. Dutch lawmakers had already argued that leaning on one US vendor leaves a core state function exposed, since US law can compel American companies to hand over data wherever it is stored.

Until recently, the tax office insisted that a sovereign alternative was “not realistic or feasible.” What changed, according to State Secretary for Finance Eelco Eerenberg, is capacity: the Belastingdienst has expanded its own data centres enough to host the software itself. To keep costs down, it will reuse existing licences wherever possible, and it is following the council’s advice to choose tools function by function instead of buying one suite from one supplier.

The plan still has holes. The government names no products, so “European open source” is a direction, not yet a choice. Some records-management features built into Microsoft 365 have no on-premises equivalent, and the agency is still working out how to replace them. About 5,000 of the 47,500 people working across tax, customs and benefits had already moved to the cloud, according to The Register, and nobody has put a figure on the cost of the reversal. Early reviews of European alternatives have been mixed, too: Politico reported that a European Commission staffer harshly criticised Element’s Teams rival on an internal message board.

Microsoft declined to comment. The vendors who stand to gain were quicker to speak. Nextcloud chief executive Frank Karlitschek welcomed the decision and said his company added more than two million sovereign workspace seats last year, while Element chief executive Matthew Hodgson described customer feedback as “only positive and constructive” and said some pushback from users who dislike change was to be expected.

Outside the Netherlands, the decision matters as a precedent more than as an IT project. Tax authorities are among the most risk-averse institutions a state has, and this one has now put in writing that a mainstream US cloud suite failed its security review. The weaknesses the council listed are not exotic settings. Default encryption, Teams calls and a single-vendor contract are what most organisations get when they sign up for Microsoft 365, and most Dutch public bodies still run on Microsoft’s cloud.

Email and calendars move to the tax office’s own servers first, in 2027. European open source tools for personal storage and collaboration follow later in 2027 and in 2028, and the House of Representatives will receive a detailed roadmap in the first quarter of 2027. Eerenberg set out the plan in a letter to parliament on 6 October, answering questions from MPs.

The first real test will be the inbox: the morning tens of thousands of tax, customs and benefits staff open their email on servers the Dutch state controls, and either notice nothing or notice everything.

Tags: microsoft, Open Source, Microsoft 365, Belastingdienst, digital sovereignty, Element