Three months after the Hanover freeze – What the 60,000-license fiasco reveals about Microsoft 365 in schools and how school authorities can prepare cleanly for the 2026/27 school year

On 21 April 2026 at 18:00 the state capital of Hanover cut off access to 60,000 Microsoft 365 Education licenses at its roughly 100 schools. Purchase value – around 324,000 euros. Reason – the wrong contract type and a data protection impact assessment produced too late. Three months on the case is still open; the city has given itself until roughly October 2026 to present "concrete proposals for data-protection-compliant and workable school IT".

The event would be one municipal mishap among many – were it not exactly symptomatic of the position the German Data Protection Conference (Datenschutzkonferenz, DSK) took on Microsoft 365 in schools back in 2022. And were it not temporally colliding with the Microsoft price increase of 1 July 2026 (public sector up to plus 13 per cent) and with the operational start of openDesk Phase 3 – the expansion of the Center for Digital Sovereignty (ZenDiS) to municipalities and schools.

Anyone acting as a school authority, district or state ministry who has to make a decision now, before the 2026/27 school year, has three items on the table at once – legal certainty, price pressure and a matured alternative. This post sorts the three along the Hanover case and delivers a concrete fourteen-day review path in the HowTo section for your own procurement.

What went wrong in Hanover on 21 April 2026

The Hanover city administration had procured around 60,000 Microsoft 365 Education licenses for its roughly 100 schools in spring 2026. The rollout started at the beginning of April. On 21 April the city froze access itself, after internal review and queries from the Lower Saxony state data protection commissioner had surfaced two flaws:

• Only the standard DPA instead of the education DPA. The data processing agreement matched the generic Microsoft Products and Services Data Protection Addendum – not the additional "Data Protection Addendum for Education" required for schools. The tighter purpose limitation clauses that the DSK explicitly named in 2022 as a precondition for compliant school use were therefore missing.
• DPIA after the purchase. The data protection impact assessment under Article 35 GDPR was only drafted after the license procurement. The Privacy by Design principle from Article 25 GDPR was thereby formally breached – the risk assessment must precede the processing, not follow it.

Both points can be avoided with clean preparation. That they passed two levels of administration unnoticed shows – awareness of the school-specific GDPR regime is not up to date in many municipalities.

Why the fiasco is symptomatic – the DSK and the illusion model of the standard DPA

In November 2022 the Data Protection Conference determined with a clear majority that proof of a data-protection-compliant operation of Microsoft 365 by the controllers could not be furnished with the contractual framework in force at the time. Microsoft has since improved in several places, in particular via the EU Data Boundary (declared complete in February 2025) and the Data Protection Addendum for Education. In principle, however, the DSK ruling still stands – purpose extension, legitimate business operations use, telemetry, unclear separation between controller and processor in edge cases – all these remain contested.

The Hessian state data protection authority lifted its de-facto M365 ban for Hesse in November 2025, but explicitly under the condition that controllers correctly conclude the school-specific contractual addenda and fully perform the DPIA before processing begins. Hanover missed exactly these two conditions – four months after the green light.

For a deeper reading of the background of the DSK assessment, see the post Microsoft 365 in Schools – Why NRW, Hesse and Lower Saxony are exiting. The framework of the BSI IT-Grundschutz compendium additionally shows which module violations an M365 operation without a clean DPIA triggers in the public sector.

Price increase 1 July 2026 – the economic pressure

On 1 July 2026 Microsoft raised list prices for the public sector. Business Basic by 16 per cent, Business Standard by 12 per cent, the public sector as a whole up to 13 per cent. For school authorities this means in practice – A1 licenses remain free of charge, but A1 licenses are not enough for productive regular operation. Teams telephony, Intune-based mobile device management, Defender for Endpoint, and Copilot for Education are only available with A3 or A5. Exactly these licenses became more expensive on 1 July.

For a typical school authority with 10,000 users and an A3 mix, the price increase means additional costs of between 14,000 and 22,000 euros per year. Anyone budgeting an alternative path at that scale should also read NIS2, GDPR and the Microsoft paradox in parallel – the compliance costs for a hardened M365 operation are quantified there and reach the same order of magnitude as the licenses themselves for larger authorities.

openDesk Phase 3 – the alternative goes operational

With openDesk 2.5 released on 15 May 2026, the Center for Digital Sovereignty (ZenDiS) has reached a maturity level that covers regular operation in primary and lower secondary schools. The release contains:

• the reworked Univention portal client with single sign-on against the internal school user directory
• the integrated OnlyOffice editor with real-time collaboration
• the XMPP-based messenger including video talk
• the connector to IServ user directories for legacy schools
• a mobile device management interface for iPadOS and Android

Baden-Württemberg has been running its Digital Workplace for Teachers on openDesk since April 2026 and reports 99.4 per cent availability after 90 days of regular operation. The Deutsche Rentenversicherung Bund and the Federal Employment Agency started their test installations in January 2026. For more context on the program see openDesk Partner Program 2026 and the detailed analysis Euro Office – The realistic Microsoft 365 alternative 2026.

For a school authority with 500 users per school, the openDesk fully loaded cost in 2026 sits at around 45 euros per user per year for the license plus 8 to 12 euros per user per month for operations – clearly below M365 A3 costs in the new price structure.

What school authorities should clarify by end of August 2026

The 2026/27 school year begins between 24 August and 14 September 2026 depending on the state. Anyone who currently has an open M365 contract should answer three questions before the school year begins:

• Is our DPA fit for school use? If not, either conclude a supplementary contract with Microsoft or change the contract type.
• Does our DPIA precede processing? If not, produce the DPIA now and document why the processing remains admissible during the transition.
• Is the alternative path costed? If not, set up a parallel openDesk calculation now as a comparison anchor.

The operational table with a current overview of sovereign offerings is at /en/alternativen. Anyone reviewing the migration cost and operating frame of a managed openDesk environment finds the line items at /en/pricing. For a first assessment of your contract and DPIA situation, the route via /en/contact is available.

Conclusion

The Hanover freeze of 21 April 2026 is not an outlier but the visible expression of a structural pattern – the school-specific GDPR requirements are often overlooked in municipal procurement, the DPIA follows procurement instead of guiding it, and the standard data processing agreement gets misread as fit for schools. The combination of the DSK position 2022, the Microsoft price increase of July 2026 and openDesk 2.5 shifts the calculation. Anyone working through the four review points above and the fourteen-day path in the HowTo section will reach defensible clarity before the 2026/27 school year begins – and avoid the next municipal data protection freeze.