[{"data":1,"prerenderedAt":449},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/hanover-license-fiasco-microsoft-365-schools-2026-posts_en":51,"/en/blog/hanover-license-fiasco-microsoft-365-schools-2026-surround-posts_en":438},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":376,"description":377,"extension":378,"faq":379,"howto":395,"image":430,"meta":432,"navigation":433,"path":434,"seo":435,"stem":436,"__hash__":437},"posts_en/en/3.blog/21.hanover-license-fiasco-microsoft-365-schools-2026.md","Three months after the Hanover freeze – What the 60,000-license fiasco reveals about Microsoft 365 in schools and how school authorities can prepare cleanly for the 2026/27 school year",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Schools & Procurement",{"type":63,"value":64,"toc":366},"minimark",[65,69,90,113,132,137,140,160,167,171,195,198,212,216,233,245,249,256,273,296,307,311,314,334,349,353],[66,67,53],"h1",{"id":68},"three-months-after-the-hanover-freeze-what-the-60000-license-fiasco-reveals-about-microsoft-365-in-schools-and-how-school-authorities-can-prepare-cleanly-for-the-202627-school-year",[70,71,72,73,77,78,81,82,85,86,89],"p",{},"On ",[74,75,76],"strong",{},"21 April 2026 at 18:00"," the state capital of ",[74,79,80],{},"Hanover"," cut off access to ",[74,83,84],{},"60,000 Microsoft 365 Education licenses"," at its roughly 100 schools. Purchase value – around ",[74,87,88],{},"324,000 euros",". Reason – the wrong contract type and a data protection impact assessment produced too late. Three months on the case is still open; the city has given itself until roughly October 2026 to present \"concrete proposals for data-protection-compliant and workable school IT\".",[70,91,92,93,96,97,100,101,104,105,108,109,112],{},"The event would be one municipal mishap among many – were it not ",[74,94,95],{},"exactly symptomatic"," of the position the ",[74,98,99],{},"German Data Protection Conference (Datenschutzkonferenz, DSK)"," took on Microsoft 365 in schools back in 2022. And were it not ",[74,102,103],{},"temporally colliding"," with the Microsoft price increase of ",[74,106,107],{},"1 July 2026"," (public sector up to plus 13 per cent) and with the operational start of ",[74,110,111],{},"openDesk Phase 3"," – the expansion of the Center for Digital Sovereignty (ZenDiS) to municipalities and schools.",[70,114,115,116,119,120,123,124,127,128,131],{},"Anyone acting as a school authority, district or state ministry who has to make a decision now, before the ",[74,117,118],{},"2026/27 school year",", has three items on the table at once – ",[74,121,122],{},"legal certainty",", ",[74,125,126],{},"price pressure"," and ",[74,129,130],{},"a matured alternative",". This post sorts the three along the Hanover case and delivers a concrete fourteen-day review path in the HowTo section for your own procurement.",[133,134,136],"h2",{"id":135},"what-went-wrong-in-hanover-on-21-april-2026","What went wrong in Hanover on 21 April 2026",[70,138,139],{},"The Hanover city administration had procured around 60,000 Microsoft 365 Education licenses for its roughly 100 schools in spring 2026. The rollout started at the beginning of April. On 21 April the city froze access itself, after internal review and queries from the Lower Saxony state data protection commissioner had surfaced two flaws:",[141,142,143,150],"ul",{},[144,145,146,149],"li",{},[74,147,148],{},"Only the standard DPA instead of the education DPA."," The data processing agreement matched the generic Microsoft Products and Services Data Protection Addendum – not the additional \"Data Protection Addendum for Education\" required for schools. The tighter purpose limitation clauses that the DSK explicitly named in 2022 as a precondition for compliant school use were therefore missing.",[144,151,152,155,156,159],{},[74,153,154],{},"DPIA after the purchase."," The data protection impact assessment under Article 35 GDPR was only drafted after the license procurement. The ",[74,157,158],{},"Privacy by Design"," principle from Article 25 GDPR was thereby formally breached – the risk assessment must precede the processing, not follow it.",[70,161,162,163,166],{},"Both points can be avoided with clean preparation. That they passed two levels of administration unnoticed shows – ",[74,164,165],{},"awareness of the school-specific GDPR regime is not up to date in many municipalities",".",[133,168,170],{"id":169},"why-the-fiasco-is-symptomatic-the-dsk-and-the-illusion-model-of-the-standard-dpa","Why the fiasco is symptomatic – the DSK and the illusion model of the standard DPA",[70,172,173,174,177,178,181,182,123,185,123,188,123,191,194],{},"In November 2022 the Data Protection Conference determined with a clear majority that ",[74,175,176],{},"proof of a data-protection-compliant operation of Microsoft 365"," by the controllers ",[74,179,180],{},"could not be furnished"," with the contractual framework in force at the time. Microsoft has since improved in several places, in particular via the EU Data Boundary (declared complete in February 2025) and the Data Protection Addendum for Education. In principle, however, the DSK ruling still stands – ",[74,183,184],{},"purpose extension",[74,186,187],{},"legitimate business operations use",[74,189,190],{},"telemetry",[74,192,193],{},"unclear separation between controller and processor in edge cases"," – all these remain contested.",[70,196,197],{},"The Hessian state data protection authority lifted its de-facto M365 ban for Hesse in November 2025, but explicitly under the condition that controllers correctly conclude the school-specific contractual addenda and fully perform the DPIA before processing begins. Hanover missed exactly these two conditions – four months after the green light.",[70,199,200,201,206,207,211],{},"For a deeper reading of the background of the DSK assessment, see the post ",[202,203,205],"a",{"href":204},"/en/blog/microsoft-365-schools","Microsoft 365 in Schools – Why NRW, Hesse and Lower Saxony are exiting",". The framework of the ",[202,208,210],{"href":209},"/en/blog/bsi-it-grundschutz-microsoft-365","BSI IT-Grundschutz compendium"," additionally shows which module violations an M365 operation without a clean DPIA triggers in the public sector.",[133,213,215],{"id":214},"price-increase-1-july-2026-the-economic-pressure","Price increase 1 July 2026 – the economic pressure",[70,217,72,218,220,221,224,225,228,229,232],{},[74,219,107],{}," Microsoft raised list prices for the public sector. Business Basic by 16 per cent, Business Standard by 12 per cent, the public sector as a whole up to 13 per cent. For school authorities this means in practice – ",[74,222,223],{},"A1 licenses remain free of charge",", but A1 licenses are not enough for productive regular operation. Teams telephony, Intune-based mobile device management, Defender for Endpoint, and Copilot for Education are only available with ",[74,226,227],{},"A3"," or ",[74,230,231],{},"A5",". Exactly these licenses became more expensive on 1 July.",[70,234,235,236,239,240,244],{},"For a typical school authority with 10,000 users and an A3 mix, the price increase means additional costs of between ",[74,237,238],{},"14,000 and 22,000 euros per year",". Anyone budgeting an alternative path at that scale should also read ",[202,241,243],{"href":242},"/en/blog/nis2-gdpr-microsoft-paradox","NIS2, GDPR and the Microsoft paradox"," in parallel – the compliance costs for a hardened M365 operation are quantified there and reach the same order of magnitude as the licenses themselves for larger authorities.",[133,246,248],{"id":247},"opendesk-phase-3-the-alternative-goes-operational","openDesk Phase 3 – the alternative goes operational",[70,250,251,252,255],{},"With ",[74,253,254],{},"openDesk 2.5"," released on 15 May 2026, the Center for Digital Sovereignty (ZenDiS) has reached a maturity level that covers regular operation in primary and lower secondary schools. The release contains:",[141,257,258,261,264,267,270],{},[144,259,260],{},"the reworked Univention portal client with single sign-on against the internal school user directory",[144,262,263],{},"the integrated OnlyOffice editor with real-time collaboration",[144,265,266],{},"the XMPP-based messenger including video talk",[144,268,269],{},"the connector to IServ user directories for legacy schools",[144,271,272],{},"a mobile device management interface for iPadOS and Android",[70,274,275,278,279,282,283,286,287,291,292,166],{},[74,276,277],{},"Baden-Württemberg"," has been running its Digital Workplace for Teachers on openDesk since April 2026 and reports 99.4 per cent availability after 90 days of regular operation. The ",[74,280,281],{},"Deutsche Rentenversicherung Bund"," and the ",[74,284,285],{},"Federal Employment Agency"," started their test installations in January 2026. For more context on the program see ",[202,288,290],{"href":289},"/en/blog/opendesk-partner-program-2026","openDesk Partner Program 2026"," and the detailed analysis ",[202,293,295],{"href":294},"/en/blog/euro-office-microsoft-365-alternative-2026","Euro Office – The realistic Microsoft 365 alternative 2026",[70,297,298,299,302,303,306],{},"For a school authority with 500 users per school, the openDesk fully loaded cost in 2026 sits at around ",[74,300,301],{},"45 euros per user per year for the license"," plus ",[74,304,305],{},"8 to 12 euros per user per month for operations"," – clearly below M365 A3 costs in the new price structure.",[133,308,310],{"id":309},"what-school-authorities-should-clarify-by-end-of-august-2026","What school authorities should clarify by end of August 2026",[70,312,313],{},"The 2026/27 school year begins between 24 August and 14 September 2026 depending on the state. Anyone who currently has an open M365 contract should answer three questions before the school year begins:",[141,315,316,322,328],{},[144,317,318,321],{},[74,319,320],{},"Is our DPA fit for school use?"," If not, either conclude a supplementary contract with Microsoft or change the contract type.",[144,323,324,327],{},[74,325,326],{},"Does our DPIA precede processing?"," If not, produce the DPIA now and document why the processing remains admissible during the transition.",[144,329,330,333],{},[74,331,332],{},"Is the alternative path costed?"," If not, set up a parallel openDesk calculation now as a comparison anchor.",[70,335,336,337,340,341,344,345,348],{},"The operational table with a current overview of sovereign offerings is at ",[202,338,339],{"href":339},"/en/alternativen",". Anyone reviewing the migration cost and operating frame of a managed openDesk environment finds the line items at ",[202,342,343],{"href":343},"/en/pricing",". For a first assessment of your contract and DPIA situation, the route via ",[202,346,347],{"href":347},"/en/contact"," is available.",[133,350,352],{"id":351},"conclusion","Conclusion",[70,354,355,356,359,360,127,363,365],{},"The Hanover freeze of 21 April 2026 is not an outlier but the visible expression of a structural pattern – the school-specific GDPR requirements are often overlooked in municipal procurement, the DPIA follows procurement instead of guiding it, and the standard data processing agreement gets misread as fit for schools. The combination of the ",[74,357,358],{},"DSK position 2022",", the ",[74,361,362],{},"Microsoft price increase of July 2026",[74,364,254],{}," shifts the calculation. Anyone working through the four review points above and the fourteen-day path in the HowTo section will reach defensible clarity before the 2026/27 school year begins – and avoid the next municipal data protection freeze.",{"title":367,"searchDepth":368,"depth":368,"links":369},"",2,[370,371,372,373,374,375],{"id":135,"depth":368,"text":136},{"id":169,"depth":368,"text":170},{"id":214,"depth":368,"text":215},{"id":247,"depth":368,"text":248},{"id":309,"depth":368,"text":310},{"id":351,"depth":368,"text":352},"2026-07-21T00:00:00.000Z","On 21 April 2026 Hanover froze 60,000 M365 licenses. Three months later, the case shows what school authorities must change before the 2026/27 school year.","md",[380,383,386,389,392],{"q":381,"a":382},"What exactly happened in Hanover on 21 April 2026?","The state capital of Hanover had procured 60,000 Microsoft 365 Education licenses for its roughly 100 schools at a cost of around 324,000 euros. On 21 April 2026 at 18:00 the city administration cut off access to the platform. The reason – only a standard data processing agreement had been concluded with Microsoft, not the additional \"Data Protection Addendum for Education\" (DPA-E) required for the school sector. In addition, the data protection impact assessment mandated under Article 35 GDPR had only been drafted after the purchase, not before procurement. The city announced it would present concrete proposals for data-protection-compliant and workable school IT within six months – roughly by October 2026.",{"q":384,"a":385},"Why is the normal Microsoft data processing agreement not enough for schools?","Microsoft's standard DPA (the Data Protection Addendum from the Microsoft Products and Services Data Protection Addendum, MPSDPA) governs the processing of personal data for business customers. For the education sector, Microsoft additionally processes data of minors, which triggers specific requirements from Article 8 GDPR, from state school laws and from the 2023 KMK guidelines. The specific DPA-E therefore contains stricter purpose limitation, tighter provisions on the use of personal data for \"legitimate business operations\", and explicit rules on the deletion of student data after a school change or graduation. Without this addendum, the purpose extension criticized by the German Data Protection Conference in 2022 applies, which makes school use non-compliant.",{"q":387,"a":388},"Does the fiasco affect other school authorities as well?","Yes. The cities of Braunschweig, Osnabrück and Wolfsburg confirmed between May and July 2026 that they are pausing their ongoing M365 rollouts and reviewing their own contracts against the DPA-E clause. In Baden-Württemberg the state data protection commissioner issued an expanded guidance following the Hanover case that also applies to municipalities without school M365. The commissioner in North Rhine-Westphalia added a review step for \"contract type and DPIA sequence\" to ongoing consultation.",{"q":390,"a":391},"How does the Microsoft price increase on 1 July 2026 change this calculation?","On 1 July 2026 Microsoft raised list prices for the public sector by up to 13 per cent. Business Basic rose by 16 per cent, Business Standard by 12 per cent. For a school authority with 10,000 users, this means additional costs of between 14,000 and 22,000 euros per year depending on the license mix. The \"M365 Education is free\" argument only holds for the basic A1 variant and explicitly excludes core functions like Teams telephony, Copilot, Intune MDM and Defender. For regular operation, paid A3 or A5 licenses are required – exactly the items that became more expensive on 1 July.",{"q":393,"a":394},"Is openDesk already mature enough for regular school operation?","For primary and lower secondary schools, yes. openDesk version 2.5 released on 15 May 2026 contains the reworked Univention portal client, the integrated OnlyOffice editor, the XMPP-based messenger, and the connector to the IServ user directory. Baden-Württemberg has been running its Digital Workplace for Teachers on openDesk since April 2026 and reports 99.4 per cent availability after 90 days of regular operation. For upper secondary schools some subject-specific extensions are still missing (formula editor at LaTeX level, specialized programming interfaces). The internal combination of openDesk plus Schulportal Hessen plus Mahara portfolio covers the standard case.",{"name":396,"description":397,"totalTime":398,"steps":399},"Ten steps to a legally sound review of a school M365 contract","Compact review path for municipal school authorities to clarify before the 2026/27 school year whether their M365 contract meets DSK and state data protection requirements or must be replaced.","P14D",[400,403,406,409,412,415,418,421,424,427],{"name":401,"text":402},"Identify the existing contract","On day 1 pull the existing license and data processing agreement with Microsoft (or the reseller) from the contract register. Check whether the contract contains the addendum \"Data Protection Addendum for Education\" or \"Education Amendment\". Without this addendum the contract is not sufficient for school use.",{"name":404,"text":405},"Date the data protection impact assessment","On day 2 pull the data protection impact assessment under Article 35 GDPR from the file. Check the date. If the DPIA is dated after the contract or after the license purchase, this is a formal breach of Article 35 (1) in combination with the Privacy by Design principle. This is exactly the point that triggered the Hanover freeze.",{"name":407,"text":408},"Contact the state data protection commissioner","On day 3 consult the competent state data protection commissioner with a precise two-question inquiry. First question – is the applicable DPA addendum recognized for the school sector? Second question – are there current directives from the specific state to school authorities following the Hanover case? Answers arrive within 14 days.",{"name":410,"text":411},"Clarify GDPR roles","On day 4 clarify who is the controller under Article 4 (7) GDPR for which processing. For school administration data usually the school authority, for teaching data usually the school management, for examination results usually the state ministry of culture. Without this clarification the DPIA is not defensible.",{"name":413,"text":414},"Review the deletion concept","On day 5 review the deletion concept for school changes, grade repetition, graduation and switches to another school type. Microsoft M365 accounts with an education license are not automatically deleted upon school change but remain in the tenant. Without a documented process instruction for timely deletion, Article 17 GDPR is violated.",{"name":416,"text":417},"Update the US access exposure","On day 6 fold the access risks from the CLOUD Act, FISA 702 and Executive Order 12333 into the DPIA. After the Schrems III framework and the CADA draft, these risks must be formally assessed for student data, not merely mentioned.",{"name":419,"text":420},"Document the reseller chain","On day 7 document every intermediary and sub-processor. Common pattern – a school authority contracts with a local IT integrator which is connected via a distributor to Microsoft Ireland. Every intermediate step must appear by name in the DPIA.",{"name":422,"text":423},"Calculate alternatives","On days 8 and 9 build a defensible comparison for openDesk. Realistic 2026 figure per school with 500 users – 45 euros per user per year for the license plus 8 to 12 euros per user per month for operations, against 24 to 42 euros per user per month for M365 A3 in the new price structure.",{"name":425,"text":426},"Sketch a transition plan","On days 10 and 11 outline a concrete transition plan. Realistic – parallel use for one school year, migration of core applications (collaboration, mail, file storage, video conferencing) in the first half of the 2026/27 school year, decommissioning of the M365 tenant in the first half of 2027.",{"name":428,"text":429},"Prepare the council decision","On days 12 to 14 prepare a decision paper for the city or district council. Contents – result of the DPIA review, response of the state commissioner, cost calculation of the alternative, timeline. Take the decision before the start of the 2026/27 school year, at the latest end of August 2026.",{"src":431},"https://images.unsplash.com/photo-1580582932707-520aed937b7b?w=1200&q=80",{},true,"/en/blog/hanover-license-fiasco-microsoft-365-schools-2026",{"title":53,"description":377},"en/3.blog/21.hanover-license-fiasco-microsoft-365-schools-2026","cU17PkPD4zvq9uO8Flg435TPv66B73ue_yknkurab2k",[439,444],{"title":440,"path":441,"stem":442,"description":443,"children":-1},"Delos Cloud under the CADA framework – Why the SAP-Microsoft \"administration cloud\" structurally fails to reach sovereignty Level 3","/en/blog/delos-cloud-cada-sovereignty-gap-2026","en/3.blog/20.delos-cloud-cada-sovereignty-gap-2026","The new CADA Cloud Sovereignty Framework defines four tiers. Why Delos Cloud stalls at Level 1 and what German public bodies must lock into contracts.",{"title":445,"path":446,"stem":447,"description":448,"children":-1},"EU Commission and gematik Adopt Matrix – What This Means for German SMEs","/en/blog/eu-commission-matrix","en/3.blog/3.eu-commission-matrix","More and more European institutions are migrating to Matrix/Element for secure communication. A trend that should also guide German SMEs.",1784618209196]