Microsoft 365 in Schools – Why German States Are Pulling Out
Microsoft 365 in Schools – Why German States Are Pulling Out
In an increasing number of German states, data-protection authorities are restricting or banning Microsoft 365 in schools. The legal reasoning is consistent: CLOUD Act, Schrems II/III, telemetry, opaque data-processing agreements.
Here's the current state of play — and realistic alternatives.
State-level positions in 2025/2026
| State | Position | Source |
|---|---|---|
| Hesse | Prohibition of MS 365 in schools | HBDI |
| Baden-Württemberg | Recommendation against MS 365, MoodleNet+BBB as standard | LfDI BW |
| NRW | School boards must assess alternatives | LDI NRW |
| Berlin | Recommendation against MS 365 | BlnBDI |
| Lower Saxony | IServ deployed state-wide | LfD Lower Saxony |
| Bavaria | Mebis + ByCS as standard | Ministry of Culture |
| Rhineland-Palatinate | Schulcampus RLP, BBB | Ministry of Education |
There is no unified federal line — education is a state matter — but the direction is clear.
Why? Three main reasons
1. CLOUD Act
US authorities can demand data from Microsoft clouds — even when stored in Europe. For student data (minors!), that's an elevated protected interest.
2. Telemetry
Microsoft sends diagnostic data to US servers. Despite "Required only" settings, it cannot be fully disabled. The Dutch DPA documented this in 2019 — and only partial fixes have followed.
3. Data-processing agreement
The Microsoft Online Services Terms is a standard contract that can be changed unilaterally. For schools that need a clear DPA under §80 SGB X and Article 28 GDPR, that's problematic.
What alternatives exist?
State-level (centralised)
- NRW: LOGINEO NRW (Moodle + open-source stack)
- Lower Saxony: IServ (commercial, EU-hosted, widely deployed)
- BW: MoodleNet + BigBlueButton
- Bavaria: ByCS (BayernCloud Schule)
- Hesse: Schulportal Hessen
School-board level (local choice)
This is where we come in. europioneer sets up:
| Microsoft Tool | Open-Source Equivalent |
|---|---|
| OneDrive / SharePoint | Nextcloud (with ONLYOFFICE for Office files) |
| Teams | Element/Matrix + BigBlueButton |
| Outlook / Exchange | Mailcow + Nextcloud Mail |
| OneNote | Nextcloud Notes / Joplin Server |
| Forms | Nextcloud Forms |
| Azure AD | Keycloak (or integration with state IdP) |
| Whiteboard | Whiteboard (Nextcloud), Excalidraw |
All components:
- Are GDPR-compliant
- Are hosted in Germany (Hetzner Falkenstein)
- Run on iPad, Chromebook, Windows, Linux, Android
- Cost a fraction of MS licensing: ~€1–3 per student/month
Cost comparison: Gymnasium with 800 students + 70 teachers
Microsoft 365 A3 (Education)
- Students: free (A1) or €2.50/month (A3)
- Teachers: €3.40/month (A3)
- Consulting & operations: not included
- Plus: Compliance risk not quantifiable
europioneer school stack
- 800 students + 70 teachers ≈ €350–550 / month (managed, fully included)
- One-off setup from €1,500 (eligible for funding)
- 24/7 monitoring included
- Compliance risk: zero
Pedagogical value
Open source isn't just data-protection-compliant — it's pedagogically valuable:
- Students learn transparent software
- Teachers can customise without asking a vendor
- No lock-in: content is exportable, platform-independent
- Digital sovereignty becomes tangible
How we support school boards
- Free initial consultation with data-protection guidance
- Funding application support (DigitalPakt successor, state programmes)
- Pilot for one school, then scale
- On-site teacher training
- Student onboarding material
Free consultation for school boards →
Conclusion
Microsoft 365 in schools is a legal end-of-life model in 2026. School boards that act now avoid expensive emergency migrations when DPAs enforce harder — and gain better, cheaper, sovereign digital education at the same time.
Nextcloud vs. OneDrive vs. SharePoint – The Honest 2026 GDPR Comparison
Which cloud-storage platform is actually GDPR-compliant in 2026? Features, costs, and compliance — a direct comparison of Nextcloud, Microsoft OneDrive, and SharePoint with real numbers.
Schrems III – What the 2026/2027 CJEU Ruling Means for European SMEs
Max Schrems has filed his third lawsuit against the EU-US Data Privacy Framework. Most observers expect a third ruling in favour of the plaintiffs. Here's what companies should do now.