Sovereignty Washing 2026 – Why Microsoft 365 Local and the Munich Sovereignty Studio do not release German municipalities from the CLOUD Act

For municipal IT leadership in Germany, four events are converging into a new decision landscape. Microsoft 365 Local reached General Availability in its disconnected variant in early 2026 and now runs as a regular offering on Azure Local in customer or partner data centres. In parallel, Microsoft has opened Europe's first Sovereignty & Digital Resilience Studio in Munich, where authorities are meant to discuss their individual sovereignty requirements with Microsoft consultants. From Berlin, the Federal Chancellery reports productive use of openDesk – alongside the Robert Koch Institute and other ministries. And Bavaria has cancelled a multi-billion-euro framework contract with Microsoft to move to a sovereign basic workplace. On 22 July 2026, openDesk 1.17.0 was released.

For cities, districts and municipalities, this is not an academic debate. The municipal level is regulatorily responsible for resident registration, social services data, foreigners' authority, registry office, citizen communication and schools – all data categories under Article 6 and Article 9 GDPR, some with sector-specific additional rules. Anyone now investing in Microsoft 365 Local as a "sovereign alternative" to Microsoft 365 without checking the legal attribution risks a misinvestment. This post is a fact-check.

What Microsoft 365 Local is technically – and what it is not legally

Microsoft 365 Local is an on-premises deployment of Exchange Server, SharePoint Server and Skype for Business Server on Azure Local – Microsoft's successor to Azure Stack HCI. Deployment happens in the customer's or a local partner's data centre; the disconnected variant runs fully without a connection to Microsoft cloud services. Support commitments run through at least 2035. Up to this point it reads like a sovereign stack.

The legal break happens at three places. First, Microsoft Corporation continues to sign and deliver all updates, security patches and firmware updates. Second, the legal entity via the operator framework contract is typically bound to Microsoft Ireland or a US subsidiary. Third, during incidents, support access and telemetry kick in – channels that are rarely fully closed in default operation. All three points let the US CLOUD Act (18 U.S. Code §2713) apply, regardless of where the data is stored.

Why the Munich Sovereignty Studio does not solve the structural conflict

The Sovereignty & Digital Resilience Studio in Munich, opened in February 2026, is a consulting offering, not a legal construct. It supports customers in articulating sovereignty requirements and mapping Microsoft products to them. However, the consulting changes nothing about the basic jurisdictional question: the contractual counterparty remains Microsoft. A studio in Munich is not a European company under the EU Data Act and not a European legal entity under the BSI IT-Grundschutz building block SYS.1.5. The economic comparison between Delos Cloud and open European alternatives shows the same structure – we broke it down in the analysis on the Delos Cloud sovereignty gap.

The ZenDiS criteria – and why they are the better yardstick for municipalities

ZenDiS – the Centre for Digital Sovereignty of Public Administration has published public criteria for assessing sovereign offerings. The review questions read soberly:

• Who holds the legal entity for operations?
• Who holds the code-signing and update keys?
• Who has emergency and support access to production systems?
• Which clauses govern the rejection of foreign disclosure orders?
• Which audit rights does the customer have without the provider's consent?

These five questions are the pragmatic yardstick for municipalities. Microsoft 365 Local does not currently answer them positively. openDesk in a German data centre operated by a European provider answers them positively as a rule.

The municipal reality in August 2026

The municipal IT landscape in Germany is heterogeneous. Around 11,000 cities and municipalities, 294 districts, 107 independent cities – plus special-purpose associations, municipal IT service providers and the municipal data centres (AKDB, KDN, ekom21, KRZ). For the vast majority of municipalities with 50 to 500 administrative workstations, the starting point in 2026 is:

• Existing Microsoft 365 contract with a price increase from 1 July 2026 (Business Standard plus 12 percent, Business Basic plus 16 percent).
• Regulatory pressure from the NIS-2 Implementation Act – see our NIS-2 GDPR paradox post.
• Missing state-level framework contracts for sovereign alternatives in several federal states.
• Political tailwind from Bavaria, Schleswig-Holstein, Hamburg and the federal government.

The room for action is open: municipalities can now either invest in Microsoft 365 Local – with the legal risk described above – or in an openDesk stack in a German municipal data centre. The procurement waves over the next twelve months will show how the municipal environment positions itself.

The economic comparison for a district with 250 administrative workstations

Reference calculation, 36-month view, 250 users, existing Microsoft 365 Business Standard contract:

Microsoft 365 Local is thus the most expensive of the three options – without solving the legal sovereignty question. The factor versus openDesk sits at around 2. This structure confirms the pattern we described for the EuroOffice alternative in the administrative context – for municipalities the comparison is even sharper, because the compliance evidence burden in districts tends to be higher.

Conclusion and next steps

Microsoft 365 Local is a technically solid on-premises product – but it is not a sovereignty solution in the legal sense. The Munich Sovereignty Studio is consulting, not a legal construct. Sovereignty Washing 2026 therefore means for municipalities: anyone who sees the term "sovereign" in a contract must ask the five ZenDiS review questions before signing.

For cities, districts and municipalities that will set the course for the 2027 budget year, we recommend three steps. First, the live analysis of your current Microsoft 365 data flows at /en/microsoft. Second, the categorised overview of sovereign providers at /en/alternativen, including the sales-partner channels for openDesk – background in our post on the openDesk partner programme 2026. Third, an initial consultation via /en/contact for a municipality-specific migration plan that takes the procurement cycle of state framework contracts into account.