Microsoft 365 Rollout Scrapped by Dutch Tax Office After Security Council Warned Against Public Cloud Migration

The Netherlands’ Tax and Customs Administration has abandoned its planned migration to Microsoft 365 public cloud services. This decision replaces the previous rollout schedule with an on-premises and open-source approach. The move follows a recommendation from the Dutch Advisory Council on ICT Assessment in June to reverse the public-cloud strategy. The government initially paused the plan in July before making this final announcement.

Root cause

The shift aligns with a broader European focus on digital sovereignty, as highlighted at the Open Source Summit Europe. The Linux Foundation released its 2026 State of Open Source in Europe report during the conference. The data indicates that 94% of EU organisations consider digital sovereignty important, with 61% viewing it as very important. Thierry Carrez, general manager of Linux Foundation Europe, stated that Europe has clearly heard the message on this issue.

Attack path

There is no technical attack path described in this administrative change. The decision stems from policy and sovereignty concerns rather than a specific security vulnerability or breach. Nithya Ruff, chair of the Linux Foundation board, noted that digital sovereignty is a global need, citing examples from Sierra Leone to China. This reflects a strategic preference for control over data and infrastructure rather than a response to an active threat.

Affected versions

The cancellation affects the planned Microsoft 365 public-cloud rollout intended for the Dutch Tax and Customs Administration. The original plan aimed to begin the switch in 2025 and complete it by the end of 2026. Approximately 5,000 employees had already migrated to the new system before the reversal. The agency is not replacing all Microsoft Office applications with a single open-source suite immediately. Instead, it will keep existing Microsoft software while exploring broader switches to Linux.

Mitigation

The primary mitigation is the cessation of further migration to the public cloud. The agency is retaining its current Microsoft software installations to maintain operational continuity. It is simultaneously exploring alternatives, including Linux operating systems and open-source programs across the board. This follows similar moves by other European governments, including Austria, France, Germany, and Ireland, which have shifted towards Linux. The Swiss military also announced a move to Linux and the German open-source suite openDesk.

What to do and how to stay safe: Microsoft 365

• Review current cloud migration plans for alignment with national digital sovereignty requirements.
• Evaluate the feasibility of on-premises or open-source alternatives for critical government workloads.
• Monitor advisory council recommendations regarding public-cloud deployments in your jurisdiction.
• Ensure existing proprietary software contracts allow for gradual transition to open-source suites.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why did the Dutch Tax Authority stop its Microsoft 365 rollout?

The Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout in June due to digital sovereignty concerns.

Will the agency stop using Microsoft software entirely?

No, the agency will keep its existing Microsoft software for now while exploring open-source and Linux alternatives.

How many employees were affected by the initial migration?

Approximately 5,000 employees had already migrated to Microsoft 365 before the plan was reversed.