Netherlands Tax Admin Drops Public Cloud for Local Infra, Reversing 5,000 Worker Migrations on ICT Council Advice
The Netherlands’ Tax and Customs Administration has abandoned its public cloud rollout following advice from its ICT advisory council, opting instead for local infrastructure.
Key points
- The Dutch Tax and Customs Administration cancelled its planned Microsoft 365 public-cloud migration.
- Approximately 5,000 employees had already migrated before the Dutch Advisory Council on ICT Assessment recommended a reversal in June.
- The agency will retain existing Microsoft software while shifting future strategy toward on-premises open-source solutions.
The Netherlands’ Tax and Customs Administration has officially abandoned its planned rollout of Microsoft 365 in the public cloud. This decision follows a recommendation from the Dutch Advisory Council on ICT Assessment, which advised reversing the migration in June. The government paused the initiative in July and has now confirmed it will replace the cloud strategy with an on-premises, open-source approach.
Root cause
The reversal aligns with broader trends regarding digital sovereignty within European public sectors. At the Open Source Summit Europe, the Linux Foundation highlighted that 94% of EU organisations consider digital sovereignty important. Thierry Carrez, general manager of Linux Foundation Europe, stated that Europe has clearly recognised the imperative for sovereign control over technology infrastructure.
Attack path
This event does not involve a technical exploit or security breach. Instead, it represents a strategic operational shift driven by policy advice. The Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout in June. The government paused the plan in July, citing the council's advice as the primary driver for the change. No malicious actor or vulnerability was involved in this decision.
Affected versions
The planned migration involved moving to Microsoft 365 public-cloud services. The original timeline aimed to complete the rollout by the end of 2026, having started in 2025. Approximately 5,000 employees had already been migrated to the new environment before the pause. The agency is not replacing all existing Microsoft Office installations with a single open-source suite immediately.
Mitigation
The Tax and Customs Administration will maintain its current Microsoft software installations for the time being. There is no technical patch required, as this is a strategic policy change rather than a software defect. The organisation is exploring a wider switch from Windows and proprietary software to Linux and open-source programs across its operations.
What it means for organisations
Organisations should review their cloud dependency strategies against national sovereignty requirements. Teams usually need to assess whether current vendor contracts align with long-term policy goals. Check whether existing data residency clauses meet evolving regulatory standards. Internal stakeholders, including legal and IT leadership, must be informed of potential strategic shifts. Evaluate the operational impact of maintaining legacy systems alongside new initiatives. Ensure that procurement teams are aware of the risks associated with single-vendor reliance in critical infrastructure.
What to do and how to stay safe: Microsoft 365
- Review current cloud contracts for data residency and sovereignty clauses that may conflict with future policy shifts.
- Assess the operational readiness of your team to manage on-premises infrastructure if public cloud services are restricted.
- Monitor advisory council recommendations in your jurisdiction for early warnings on strategic technology shifts.
- Ensure documentation exists for all proprietary software integrations to facilitate potential future migration to open-source alternatives.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why did the Dutch Tax Authority cancel the Microsoft 365 rollout?
The Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout, leading the government to pause and then cancel the plan in favour of an on-premises approach.
How many employees were affected by the migration before it stopped?
Approximately 5,000 employees had already migrated to Microsoft 365 before the Dutch Advisory Council on ICT Assessment recommended reversing the rollout in June.
Will the agency replace all Microsoft software immediately?
No, the Tax and Customs Administration is not replacing all Microsoft Office with a single open-source suite immediately; it will keep existing Microsoft software for now.
