Dutch tax office drops Microsoft 365 and takes its email in-house

The agency will host its services on infrastructure it controls, alongside European open source alternatives. The plan has a clear timeline.

• 2027: email and calendars move on-premises.
• Later in 2027 and 2028: European open source tools take over personal storage and collaboration.

The decision came in a letter to parliament from Eelco Eerenberg, State Secretary for Finance. He wrote that in 2027 the mail and calendar service "will be realized on-premises", and that the later tools will "work toward a sustainable and more autonomous solution".

The agency has dropped Microsoft 365 in the cloud and will run email and calendars on its own servers from 2027.

On-premises means the software runs on servers the organization owns or manages itself. Think of the difference between renting an apartment and owning the house. In the rented version, the landlord holds the keys to the building. In the owned version, you hold them, and you also fix the plumbing.

The Dutch outlet Accountancy van Morgen explained it the same way when the agency first paused the project in July: the software runs on the tax authority's own servers, or on servers it manages and controls.

In real life If your employer runs its own mail server in its own building, that is on-premises. If your email lives in a data center run by a big provider, that is the cloud.

The path to this week's decision took about a year.

• 2025: the tax authority selected Microsoft 365. Accountancy van Morgen reports that the State Secretary at the time chose it because it was then "the only feasible and realistic option".
• June 2026: the Dutch Advisory Council on ICT Assessment recommended rolling the cloud services back instead of finishing by the end of 2026.
• July 2026: the State Secretary paused the program for the tax, customs and benefits services, and asked whether a self-hosted setup was possible.
• October 2026: the answer arrived. It is possible, and the agency is going ahead with it.

By the time of the pause, the rollout had reached about 5,000 of the 47,500 employees.

When he paused the program in July, Eerenberg wrote, in Accountancy van Morgen's translation, that it was important not to take new steps in this light. He said the advisory board's conclusions fit the course he had already set on the tax authority's digital autonomy. The board's advice was to approach the development of the digital workplace in a fundamentally different way.

The board said the design of Microsoft 365 in the public cloud "falls short on information security, information processing and future-proofing", according to The Register. It raised several specific points.

• Where the data travels: confidential documents currently move over government networks. The cloud design would send them via American servers.
• Encryption: the board criticized the use of standard Microsoft encryption for sensitive data instead of Double Key Encryption, which would give the agency more control.
• Teams calls: end-to-end encryption was not on by default for one-to-one calls and was unavailable for group calls under the chosen setup.
• Lock-in: a single supplier with one American cloud provider reduces flexibility and sovereignty.
• No exit plan: there was no strategy for leaving if the agency later wanted a more sovereign option.

The Register adds a fair note. Many of these concerns, such as encryption, come from the configuration the agency chose, not from Microsoft 365 itself. Others are harder to dismiss.

Eerenberg said bigger data center capacity made the on-premises route realistic. In July, Accountancy van Morgen reported that he pointed to changed circumstances, including available data center capacity and what the market now offers. Options that looked out of reach a year ago are now on the table.

The money angle: the revised approach will reuse existing licenses where possible, which limits the extra spending.

The catch: records management. The Register reports that some planned capabilities in the Microsoft 365 package are not available on-premises. The agency is still assessing how to replace them.

For a tax authority that has to keep documents in order for years, that is not a small detail. Keeping records straight is half the job.

The July pause also came with some homework. According to Accountancy van Morgen, the Dutch government audit service had examined the backup setup for the cloud environment, which is a key part of any exit strategy. Because the on-premises route changes the context, its findings do not carry over one to one. The "valuable points of attention" will still be used when the alternative is designed.

An evaluation with the advisory board was planned six months after the research is finished. Whatever the outcome, Eerenberg wrote, the long-term goal stays the same: a more autonomous and sovereign solution for the tax, customs and benefits services.

No. Microsoft is a familiar supplier to public bodies in the Netherlands, and a recent report showed that most of them use its cloud services. But worries about the US CLOUD Act, which can let US authorities compel data held by US providers, have grown. The Register says that has pushed European governments to consider more sovereign options.

It is early days, and the switch is not always smooth. The Register points to a Politico report in which an unnamed European Commission staffer used strong words about the Teams alternative supplied by Element. The report does not show how widespread the complaints are.

Element's chief executive, Matthew Hodgson, told The Register he had only heard "positive and constructive feedback" from customers. He said a few change-resistant users are normal in big deployments, and added that governments "can't leave themselves exposed to being deplatformed".

Frank Karlitschek, founder and chief executive of Nextcloud, welcomed the Dutch decision. He said public organizations mostly rely on a few large proprietary providers, and now want better control of their data and infrastructure. Nextcloud says it added more than two million sovereign workspace seats in 2025. Both are vendors who stand to gain from such moves, so read their quotes as the view of interested parties.

Microsoft declined to comment.

• If you live in the Netherlands: nothing changes in how you file taxes. The change is behind the scenes, in how the agency's staff handle email and files.
• If you run IT for an organization: the case shows how a cloud decision can be reversed when security reviewers ask hard questions. Ask about encryption, exit plans and lock-in before you sign.
• If you sell or use open source software: sovereign alternatives are getting real public-sector customers, though the early reviews are mixed.
• If you use Microsoft 365: your own setup is not affected. The advisory board's concerns were about this agency's design and its sensitive data.