Azure as a DMA gatekeeper in November 2026 – how German SMEs and public authorities can use the data-portability obligation to exit Microsoft 365

On 2 October 2026, Bloomberg reported from Brussels that the European Commission intends to publish the final designation of Microsoft Azure and Amazon Web Services as gatekeepers under the Digital Markets Act (DMA) in November 2026. That marks the formal conclusion of the market investigation opened on 18 November 2025 – and the first DMA designation that rests exclusively on qualitative criteria. For German SMEs, school providers and public authorities already under NIS2, GDPR and BSI pressure, this is not a legal detail but a hard time window. Within six months of designation – that is, by around May 2027 – Microsoft Azure must deliver on data portability, interoperability and FRAND access. In parallel, the cloud-switching rules of the EU Data Act have been in force since January 2027. Combined, the two instruments give customers the strongest exit toolkit European law has yet produced.

What a DMA gatekeeper designation means in operational terms

The Digital Markets Act obliges designated gatekeepers – platforms with structural market power – to a catalogue of duties under Articles 5, 6 and 7: a ban on self-preferencing of own services, a ban on contractual lock-in clauses, mandatory interoperability of core services, free real-time data portability, and a structured right of complaint for competitors and end users. As of today, Azure meets neither the DMA's revenue nor its user thresholds – the Commission therefore justifies the designation qualitatively, based on structural dominance in European cloud infrastructure. That makes the decision politically significant: it is the first time since the DMA took effect in 2024 that a qualitative designation is pushed through in full. The precedent then applies to all future cases – it will remain legally challengeable before the Court of Justice of the European Union, but binding until any annulment.

Why the DMA does not solve the CLOUD Act problem

The DMA regulates market conduct, not jurisdiction. Microsoft remains a US parent company, and every EU subsidiary therefore continues to be subject to the US CLOUD Act. The DMA opens the exit path, but it does not fix the sovereignty gap as long as Microsoft remains the operational provider. That distinction is decisive for your own planning: the DMA delivers the transport tooling – structured exports, interoperability APIs, FRAND pricing. Sovereignty only emerges with the target operator. The same logic has been visible in the debate around Delos Cloud and Microsoft 365 Local and around "sovereignty washing" – and the DMA confirms it rather than refutes it.

The interplay with the EU Data Act and the Cyber Resilience Act

The EU Data Act has been applicable since 12 September 2025; the full cloud-switching obligations of its Chapter VI have been in force since January 2027. Specifically: a 30-day switching window, machine-readable data formats, a ban on exit fees, and minimum interoperability standards. The DMA builds on this and tightens the catalogue for the handful of large providers classified as gatekeepers. For an SME or a public authority this creates a dual legal basis: from May 2027 any EU customer can invoke whichever instrument is more favourable – usually the DMA, because it imposes stricter transparency and response deadlines. On top of that the Cyber Resilience Act tightens vendor management for software- and cloud-based products. The three instruments – DMA, Data Act, CRA – mesh in 2027 and, for the first time, form a coherent European exit framework.

What German public authorities have to prepare

For public authorities there is one additional obligation: procurement law (UVgO/VgV) requires an assessment of alternative offers at every renewal. After the DMA designation that assessment can no longer be waved away with "there is no equivalent alternative" – mandatory interoperability and portability make alternative offers factually compatible. Authorities that plan to renew Microsoft 365 contracts in 2027 or 2028 will have to document why, after designation, they continue to depend on a gatekeeper. That documentation is further tightened by the ongoing BSI C3A procurement guidance and the CADA review obligation. For state administrations the ongoing Schleswig-Holstein migration provides the practical blueprint.

What SMEs have to prepare

For SMEs the DMA is the first instrument that directly attacks contractual lock-in mechanisms. Multi-year enterprise agreements with Microsoft, which so far have come with substantial early-exit penalties, collide after May 2027 with DMA Art. 5 (ban on certain binding clauses) and the EU Data Act (ban on exit fees). In concrete terms: existing three-year Enterprise Agreements running beyond 2027 should be reviewed – before the designation – by in-house or external IT counsel against the new obligations. The expected line of argument: once the new legal basis takes effect, the contractual binding is unilaterally undercut, and the customer can leave under DMA/Data Act with reduced or zero cost. This matters in particular for sectors with parallel sectoral regulation such as DORA for financial services or the professional-secrecy regime in law firms.

Technical preparation: what has to happen in the next eight weeks

Between October and December 2026 preparation shows up as concrete technical steps. First: an export test over the existing Microsoft APIs – Exchange eDiscovery, SharePoint Migration Tool, OneDrive Content Export, Teams Compliance Export, Entra ID scripted export. Real-world results diverge significantly from marketing claims: Teams chats do not cleanly carry reactions or reply threads, Entra ID policies export only in part, SharePoint shares typically lose their permission matrix on export. These gaps become a formal basis for a complaint to the European Commission after designation – and the lever to demand FRAND-conformant redelivery. Second: bring up the target platform, mirror identities in Keycloak, make Nextcloud and Open-Xchange production-ready. That infrastructure stands independent of the Microsoft decision and delivers immediate value – see the practical case studies in the municipal openDesk rollout. Third: a 24-month migration plan that, between the DMA designation in November 2026 and the final Microsoft contract end, executes the migration in waves of 100 to 500 gigabytes.

What comes next

After a DMA designation, the actual work between the European Commission and Microsoft only begins – over the concretisation of obligations, over disputed interoperability specifications, and over the handling of existing lock-in contracts. For customers that means: anyone who has not set up a clear target platform by May 2027 forfeits a significant part of the toolkit the DMA provides, because the portability windows are tied to active customer demand. With DMA, Data Act and CRA the EU has for the first time created a coherent European exit framework – but the framework works only where concrete customers invoke it concretely. europioneer accompanies SMEs and public authorities with a migration plan calibrated to this legal reality: see pricing, alternatives catalogue, the Microsoft live tracker for ongoing outage monitoring, and contact for an individual gap analysis.

Conclusion

The DMA gatekeeper designation of Azure in November 2026 is not an abstract Brussels announcement – it is the strongest operational exit tool that German SMEs and public authorities have ever had against Microsoft 365. It does not solve the CLOUD Act problem, but it breaks the technical and contractual barriers that have slowed every serious migration so far. Combined with the EU Data Act (from January 2027) and the CRA, by May 2027 a coherent legal framework for a planned transition to European-controlled infrastructure is in place. Whoever uses the eight weeks until designation now – for data inventory, export tests and target-platform build-out – starts the migration from the strongest possible negotiating position. Whoever waits gets the same legal basis, but without the preparatory work – and without the data that would support a formal complaint.