[{"data":1,"prerenderedAt":405},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365-posts_en":51,"/en/blog/dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365-surround-posts_en":395},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":338,"description":339,"extension":340,"faq":341,"howto":362,"image":387,"meta":389,"navigation":390,"path":391,"seo":392,"stem":393,"__hash__":394},"posts_en/en/3.blog/33.dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365.md","Azure as a DMA gatekeeper in November 2026 – how German SMEs and public authorities can use the data-portability obligation to exit Microsoft 365",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Regulation & Portability",{"type":63,"value":64,"toc":326},"minimark",[65,69,124,129,150,154,184,188,213,217,239,243,264,268,292,296,319,323],[66,67,53],"h1",{"id":68},"azure-as-a-dma-gatekeeper-in-november-2026-how-german-smes-and-public-authorities-can-use-the-data-portability-obligation-to-exit-microsoft-365",[70,71,72,73,77,78,81,82,85,86,89,90,93,94,97,98,105,106,110,111,114,115,119,120,123],"p",{},"On ",[74,75,76],"strong",{},"2 October 2026",", Bloomberg reported from Brussels that the European Commission intends to publish the final designation of ",[74,79,80],{},"Microsoft Azure"," and ",[74,83,84],{},"Amazon Web Services"," as ",[74,87,88],{},"gatekeepers"," under the ",[74,91,92],{},"Digital Markets Act"," (DMA) in ",[74,95,96],{},"November 2026",". That marks the formal conclusion of ",[99,100,104],"a",{"href":101,"rel":102},"https://digital-strategy.ec.europa.eu/en/news/commission-reaches-preliminary-position-amazons-and-microsofts-market-leading-cloud-services-should",[103],"nofollow","the market investigation opened on 18 November 2025"," – and the first DMA designation that rests exclusively on qualitative criteria. For German SMEs, school providers and public authorities already under ",[99,107,109],{"href":108},"/en/blog/nis2-gdpr-microsoft-paradox","NIS2, GDPR and BSI pressure",", this is not a legal detail but a hard time window. Within six months of designation – that is, by around ",[74,112,113],{},"May 2027"," – Microsoft Azure must deliver on data portability, interoperability and FRAND access. In parallel, the cloud-switching rules of the ",[99,116,118],{"href":117},"/en/blog/eu-data-act-cloud-switching-microsoft-365-exit-january-2027","EU Data Act"," have been in force since ",[74,121,122],{},"January 2027",". Combined, the two instruments give customers the strongest exit toolkit European law has yet produced.",[125,126,128],"h2",{"id":127},"what-a-dma-gatekeeper-designation-means-in-operational-terms","What a DMA gatekeeper designation means in operational terms",[70,130,131,132,134,135,137,138,141,142,145,146,149],{},"The ",[74,133,92],{}," obliges designated ",[74,136,88],{}," – platforms with structural market power – to a catalogue of duties under ",[74,139,140],{},"Articles 5, 6 and 7",": a ban on self-preferencing of own services, a ban on contractual lock-in clauses, mandatory interoperability of core services, free real-time data portability, and a structured right of complaint for competitors and end users. As of today, ",[74,143,144],{},"Azure"," meets neither the DMA's revenue nor its user thresholds – the Commission therefore justifies the designation ",[74,147,148],{},"qualitatively",", based on structural dominance in European cloud infrastructure. That makes the decision politically significant: it is the first time since the DMA took effect in 2024 that a qualitative designation is pushed through in full. The precedent then applies to all future cases – it will remain legally challengeable before the Court of Justice of the European Union, but binding until any annulment.",[125,151,153],{"id":152},"why-the-dma-does-not-solve-the-cloud-act-problem","Why the DMA does not solve the CLOUD Act problem",[70,155,156,157,160,161,164,165,169,170,173,174,178,179,183],{},"The DMA regulates ",[74,158,159],{},"market conduct",", not ",[74,162,163],{},"jurisdiction",". Microsoft remains a US parent company, and every EU subsidiary therefore continues to be subject to the ",[99,166,168],{"href":167},"/en/blog/cloud-act-2026","US CLOUD Act",". The DMA opens the exit path, but it does not fix the sovereignty gap as long as Microsoft remains the operational provider. That distinction is decisive for your own planning: the DMA delivers the ",[74,171,172],{},"transport tooling"," – structured exports, interoperability APIs, FRAND pricing. Sovereignty only emerges with the target operator. The same logic has been visible in the debate around ",[99,175,177],{"href":176},"/en/blog/delos-cloud-cada-sovereignty-gap-2026","Delos Cloud and Microsoft 365 Local"," and around ",[99,180,182],{"href":181},"/en/blog/sovereignty-washing-microsoft-365-local-municipalities-2026","\"sovereignty washing\""," – and the DMA confirms it rather than refutes it.",[125,185,187],{"id":186},"the-interplay-with-the-eu-data-act-and-the-cyber-resilience-act","The interplay with the EU Data Act and the Cyber Resilience Act",[70,189,131,190,192,193,196,197,200,201,203,204,207,208,212],{},[74,191,118],{}," has been applicable since ",[74,194,195],{},"12 September 2025","; the full ",[74,198,199],{},"cloud-switching obligations"," of its Chapter VI have been in force since ",[74,202,122],{},". Specifically: a 30-day switching window, machine-readable data formats, a ban on exit fees, and minimum interoperability standards. The DMA builds on this and tightens the catalogue for the handful of large providers classified as gatekeepers. For an SME or a public authority this creates a ",[74,205,206],{},"dual legal basis",": from May 2027 any EU customer can invoke whichever instrument is more favourable – usually the DMA, because it imposes stricter transparency and response deadlines. On top of that the ",[99,209,211],{"href":210},"/en/blog/cyber-resilience-act-september-2026-microsoft-smes-public-sector","Cyber Resilience Act"," tightens vendor management for software- and cloud-based products. The three instruments – DMA, Data Act, CRA – mesh in 2027 and, for the first time, form a coherent European exit framework.",[125,214,216],{"id":215},"what-german-public-authorities-have-to-prepare","What German public authorities have to prepare",[70,218,219,220,223,224,228,229,233,234,238],{},"For public authorities there is one additional obligation: ",[74,221,222],{},"procurement law"," (UVgO/VgV) requires an assessment of alternative offers at every renewal. After the DMA designation that assessment can no longer be waved away with \"there is no equivalent alternative\" – mandatory interoperability and portability make alternative offers factually compatible. Authorities that plan to renew Microsoft 365 contracts in 2027 or 2028 will have to document why, after designation, they continue to depend on a gatekeeper. That documentation is further tightened by the ongoing ",[99,225,227],{"href":226},"/en/blog/bsi-c3a-microsoft-365-procurement-sovereignty-2026","BSI C3A procurement guidance"," and the ",[99,230,232],{"href":231},"/en/blog/cada-eu-tech-sovereignty-package-public-sector-2026","CADA review obligation",". For state administrations the ongoing ",[99,235,237],{"href":236},"/en/blog/schleswig-holstein-blueprint-libreoffice-migration-states-municipalities-2026","Schleswig-Holstein migration"," provides the practical blueprint.",[125,240,242],{"id":241},"what-smes-have-to-prepare","What SMEs have to prepare",[70,244,245,246,249,250,253,254,258,259,263],{},"For SMEs the DMA is the first instrument that directly attacks ",[74,247,248],{},"contractual lock-in mechanisms",". Multi-year enterprise agreements with Microsoft, which so far have come with substantial early-exit penalties, collide after May 2027 with DMA Art. 5 (ban on certain binding clauses) and the EU Data Act (ban on exit fees). In concrete terms: existing three-year ",[74,251,252],{},"Enterprise Agreements"," running beyond 2027 should be reviewed – before the designation – by in-house or external IT counsel against the new obligations. The expected line of argument: once the new legal basis takes effect, the contractual binding is unilaterally undercut, and the customer can leave under DMA/Data Act with reduced or zero cost. This matters in particular for sectors with parallel sectoral regulation such as ",[99,255,257],{"href":256},"/en/blog/dora-microsoft-365-exit-strategy-banks-2026","DORA for financial services"," or ",[99,260,262],{"href":261},"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","the professional-secrecy regime in law firms",".",[125,265,267],{"id":266},"technical-preparation-what-has-to-happen-in-the-next-eight-weeks","Technical preparation: what has to happen in the next eight weeks",[70,269,270,271,274,275,278,279,282,283,287,288,291],{},"Between October and December 2026 preparation shows up as concrete technical steps. First: an ",[74,272,273],{},"export test"," over the existing Microsoft APIs – Exchange eDiscovery, SharePoint Migration Tool, OneDrive Content Export, Teams Compliance Export, Entra ID scripted export. Real-world results diverge significantly from marketing claims: Teams chats do not cleanly carry reactions or reply threads, Entra ID policies export only in part, SharePoint shares typically lose their permission matrix on export. These gaps become a ",[74,276,277],{},"formal basis for a complaint"," to the European Commission after designation – and the lever to demand FRAND-conformant redelivery. Second: bring up the ",[74,280,281],{},"target platform",", mirror identities in Keycloak, make Nextcloud and Open-Xchange production-ready. That infrastructure stands independent of the Microsoft decision and delivers immediate value – see the practical case studies in the ",[99,284,286],{"href":285},"/en/blog/opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","municipal openDesk rollout",". Third: a ",[74,289,290],{},"24-month migration plan"," that, between the DMA designation in November 2026 and the final Microsoft contract end, executes the migration in waves of 100 to 500 gigabytes.",[125,293,295],{"id":294},"what-comes-next","What comes next",[70,297,298,299,303,304,308,309,313,314,318],{},"After a DMA designation, the actual work between the European Commission and Microsoft only begins – over the concretisation of obligations, over disputed interoperability specifications, and over the handling of existing lock-in contracts. For customers that means: anyone who has not set up a clear target platform by May 2027 forfeits a significant part of the toolkit the DMA provides, because the portability windows are tied to active customer demand. With DMA, Data Act and CRA the EU has for the first time created a coherent European exit framework – but the framework works only where concrete customers invoke it concretely. europioneer accompanies SMEs and public authorities with a migration plan calibrated to this legal reality: see ",[99,300,302],{"href":301},"/en/pricing","pricing",", ",[99,305,307],{"href":306},"/en/alternativen","alternatives catalogue",", the ",[99,310,312],{"href":311},"/en/microsoft","Microsoft live tracker"," for ongoing outage monitoring, and ",[99,315,317],{"href":316},"/en/contact","contact"," for an individual gap analysis.",[125,320,322],{"id":321},"conclusion","Conclusion",[70,324,325],{},"The DMA gatekeeper designation of Azure in November 2026 is not an abstract Brussels announcement – it is the strongest operational exit tool that German SMEs and public authorities have ever had against Microsoft 365. It does not solve the CLOUD Act problem, but it breaks the technical and contractual barriers that have slowed every serious migration so far. Combined with the EU Data Act (from January 2027) and the CRA, by May 2027 a coherent legal framework for a planned transition to European-controlled infrastructure is in place. Whoever uses the eight weeks until designation now – for data inventory, export tests and target-platform build-out – starts the migration from the strongest possible negotiating position. Whoever waits gets the same legal basis, but without the preparatory work – and without the data that would support a formal complaint.",{"title":327,"searchDepth":328,"depth":328,"links":329},"",2,[330,331,332,333,334,335,336,337],{"id":127,"depth":328,"text":128},{"id":152,"depth":328,"text":153},{"id":186,"depth":328,"text":187},{"id":215,"depth":328,"text":216},{"id":241,"depth":328,"text":242},{"id":266,"depth":328,"text":267},{"id":294,"depth":328,"text":295},{"id":321,"depth":328,"text":322},"2026-10-13T00:00:00.000Z","The European Commission will designate Microsoft Azure a DMA gatekeeper in November 2026. What Articles 5–7 mean for data portability and your Microsoft 365 exit.","md",[342,345,348,351,359],{"q":343,"a":344},"What changes for Microsoft 365 customers once Azure is designated a DMA gatekeeper?","The DMA gatekeeper obligations primarily apply at the infrastructure layer – Azure Compute, Storage, Networking and Identity. Microsoft 365 itself was designated separately in 2023 under the Windows/Operating-Systems category, and Office products are handled on a different track within the DMA framework. For customers, the new Azure designation primarily means that the infrastructure layer on which Exchange Online, SharePoint, Teams and OneDrive technically run becomes subject to a FRAND obligation (fair, reasonable, non-discriminatory) for interoperability and data portability. In practice, that lowers the technical barriers to migrating to alternative providers – provided those rights are actively invoked within the six months after designation.",{"q":346,"a":347},"Does the DMA solve the CLOUD Act problem for European customers?","No. The DMA regulates market conduct, not jurisdiction. Microsoft remains a US parent company, and every Microsoft entity – including its EU subsidiaries – therefore stays subject to the US CLOUD Act. The DMA makes it easier to leave Microsoft, but it does not fix any data that still sits in an environment operationally run by Microsoft. True sovereignty still requires migration to a European-controlled operator.",{"q":349,"a":350},"What deadlines apply after a November 2026 designation?","After the formal designation, Microsoft has six months to implement the obligations of DMA Articles 5, 6 and 7 for Azure – including real-time data portability, interoperability with third parties, and the ban on self-preferencing related services. That puts the practical compliance horizon at roughly May 2027. In parallel, the EU Data Act has been applicable since 12 September 2025, and its specific cloud-switching rules have been fully in force since January 2027.",{"q":352,"a":353},"How do DMA portability and the EU Data Act interact?",{"DMA Article 6(9) requires a gatekeeper to give end users free, effective portability of their data":354},{" The EU Data Act operationalises the same for cloud services in its Chapter VI":355},{"30-day switching window, machine-readable data formats, ban on exit fees from January 2027":356},{" The two instruments overlap, and a Microsoft 365 customer can invoke whichever is more favourable in their situation":357},{" In practice":358},"from May 2027 onwards, every EU customer can demand a free, structured data export.",{"q":360,"a":361},"What is the first concrete step for a public authority or an SME?","Data inventory and export test. Which Microsoft services produce which data types – Exchange mail as PST or EML, SharePoint libraries as directory tree, Teams chats via Compliance Export, OneDrive as folder structure, Entra ID role data? Document format, volume and transfer cost before the DMA designation. Immediately after designation in November 2026, submit a formal portability request. The result is both the dataset for migration and the evidence towards data-protection and IT supervision that you are actively meeting your obligations under NIS2, GDPR Art. 32 and – for authorities – the applicable procurement law.",{"name":363,"description":364,"totalTime":365,"steps":366},"Using DMA portability and the EU Data Act to exit Microsoft 365","Six-step plan for SME IT managers, administrative heads and data-centre operators in public authorities. The plan leverages the forthcoming DMA gatekeeper designation of Azure (November 2026) and the EU Data Act cloud-switching obligations (from January 2027) to replace Microsoft 365 in a planned fashion by mid-2027.","P240D",[367,370,373,376,381,384],{"name":368,"text":369},"Data inventory and export test before designation","By the end of November 2026, document every Microsoft 365 service that stores personal or business-critical data. For each service capture data volume, available export format, current transfer and API cost, and typical export duration. Run a 48-hour test export and measure which data does not come out cleanly – typically Teams chat threads, shared file permissions and Entra ID policies. These gaps become a formal basis for a complaint to the European Commission after designation.",{"name":371,"text":372},"Formal portability request under DMA Art. 6(9)","Immediately after designation, submit a request for a complete, structured, machine-readable and free data export through the Microsoft admin interface and in writing. Explicitly reference DMA Art. 6(9) and EU Data Act Chapter VI. Public authorities should copy the responsible state data-protection authority as documentation. Microsoft must respond within the deadlines set in the DMA implementing acts – absence of response becomes evidence for the compliance file and for a later EU complaint.",{"name":374,"text":375},"Set up the target platform and consolidate identities","In parallel, bring up the sovereign target stack – Nextcloud with Collabora Online for files and documents, Open-Xchange or Mailcow for mail and calendar, Element on Matrix for chat and conferencing, Keycloak as the central identity provider. Mirror the Entra ID role structure in Keycloak realms. Configure existing SAML and OIDC clients so they can authenticate against both Entra ID and Keycloak in parallel.",{"name":377,"text":378},"Migrate data in waves of 100 to 500 GB",{"Start with the least entangled service – usually OneDrive user folders – and work forward through Exchange, SharePoint team sites, and finally Teams rooms":379},{" For each wave":380},"brief the user group, mirror the data in Nextcloud, verify share permissions, run 48 hours of dual-login testing, then switch over. Document each wave towards the responsible functional or data-protection authority.",{"name":382,"text":383},"Mail and Teams as the final services to migrate","Mail is deliberately the second-to-last migration after SharePoint and OneDrive because email addresses tie all other services together. Point MX records to the European groupware server, with 30-day forwarding from Exchange Online. Teams is replaced by Element, conferencing runs on Jitsi or BigBlueButton. Keep the dual-use period to a maximum of 30 days, then deactivate the Microsoft tenant with a prior written export confirmation.",{"name":385,"text":386},"Close out compliance evidence and procurement documentation","Compile a handover pack from export logs, migration logs, procedure documentation and the new operator's contract documents. Public authorities add procurement documentation under the applicable law (in Germany, UVgO/VgV) with an explicit explanation of the DMA, Data Act and CLOUD Act risk picture. For SMEs the pack becomes part of the NIS2 and GDPR documentation. File it wherever it is needed – data-protection authority, IT auditor, management, supervisory board.",{"src":388},"https://images.unsplash.com/photo-1546436836-07a91091f160?w=1200&q=80",{},true,"/en/blog/dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365",{"title":53,"description":339},"en/3.blog/33.dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365","koGkRJE88SwZqTCDJFB8ZbCy6Xms-yNf1ED_po2d_qs",[396,401],{"title":397,"path":398,"stem":399,"description":400,"children":-1},"KBV IT Security Guideline §390 SGB V meets the October 2026 Microsoft 365 double outage – why 170,000 German medical practices, MVZs and dental practices need a sovereign alternative now","/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026","en/3.blog/32.kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026","On 6 Oct 2026 Microsoft 365 fails across Europe for the second time in four weeks. The KBV guideline under §390 SGB V has been binding since October 2025 – and BSI explicitly advises against M365.",{"title":402,"path":167,"stem":403,"description":404,"children":-1},"CLOUD Act 2026 – Why US Cloud Services Are No Longer Legally Tenable in the EU","en/3.blog/4.cloud-act-2026","Trump-era executive orders, the upcoming Schrems III ruling, and Microsoft's own sworn testimony make Microsoft 365, Google Workspace, and AWS a compliance risk for European SMEs. Here's what you need to know in 2026.",1791876238408]