[{"data":1,"prerenderedAt":525},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/sovereignty-washing-microsoft-365-local-municipalities-2026-posts_en":51,"/en/blog/sovereignty-washing-microsoft-365-local-municipalities-2026-surround-posts_en":514},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":451,"description":452,"extension":453,"faq":454,"howto":486,"image":506,"meta":508,"navigation":509,"path":510,"seo":511,"stem":512,"__hash__":513},"posts_en/en/3.blog/24.sovereignty-washing-microsoft-365-local-municipalities-2026.md","Sovereignty Washing 2026 – Why Microsoft 365 Local and the Munich Sovereignty Studio do not release German municipalities from the CLOUD Act",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Municipalities & Sovereignty",{"type":63,"value":64,"toc":441},"minimark",[65,69,98,116,121,129,163,167,188,192,198,217,226,230,241,271,281,285,288,386,400,404,421],[66,67,53],"h1",{"id":68},"sovereignty-washing-2026-why-microsoft-365-local-and-the-munich-sovereignty-studio-do-not-release-german-municipalities-from-the-cloud-act",[70,71,72,73,77,78,81,82,85,86,89,90,93,94,97],"p",{},"For municipal IT leadership in Germany, four events are converging into a new decision landscape. ",[74,75,76],"strong",{},"Microsoft 365 Local"," reached General Availability in its disconnected variant in early 2026 and now runs as a regular offering on ",[74,79,80],{},"Azure Local"," in customer or partner data centres. In parallel, Microsoft has opened ",[74,83,84],{},"Europe's first Sovereignty & Digital Resilience Studio in Munich",", where authorities are meant to discuss their individual sovereignty requirements with Microsoft consultants. From Berlin, the ",[74,87,88],{},"Federal Chancellery"," reports productive use of ",[74,91,92],{},"openDesk"," – alongside the Robert Koch Institute and other ministries. And ",[74,95,96],{},"Bavaria"," has cancelled a multi-billion-euro framework contract with Microsoft to move to a sovereign basic workplace. On 22 July 2026, openDesk 1.17.0 was released.",[70,99,100,101,104,105,108,109,112,113,115],{},"For ",[74,102,103],{},"cities, districts and municipalities",", this is not an academic debate. The municipal level is regulatorily responsible for ",[74,106,107],{},"resident registration, social services data, foreigners' authority, registry office, citizen communication and schools"," – all data categories under ",[74,110,111],{},"Article 6 and Article 9 GDPR",", some with sector-specific additional rules. Anyone now investing in ",[74,114,76],{}," as a \"sovereign alternative\" to Microsoft 365 without checking the legal attribution risks a misinvestment. This post is a fact-check.",[117,118,120],"h2",{"id":119},"what-microsoft-365-local-is-technically-and-what-it-is-not-legally","What Microsoft 365 Local is technically – and what it is not legally",[70,122,123,125,126,128],{},[74,124,76],{}," is an on-premises deployment of Exchange Server, SharePoint Server and Skype for Business Server on ",[74,127,80],{}," – Microsoft's successor to Azure Stack HCI. Deployment happens in the customer's or a local partner's data centre; the disconnected variant runs fully without a connection to Microsoft cloud services. Support commitments run through at least 2035. Up to this point it reads like a sovereign stack.",[70,130,131,132,135,136,139,140,143,144,147,148,151,152,143,155,158,159,162],{},"The legal break happens at three places. First, ",[74,133,134],{},"Microsoft Corporation"," continues to sign and deliver all ",[74,137,138],{},"updates",", ",[74,141,142],{},"security patches"," and ",[74,145,146],{},"firmware updates",". Second, the ",[74,149,150],{},"legal entity"," via the operator framework contract is typically bound to Microsoft Ireland or a US subsidiary. Third, during incidents, ",[74,153,154],{},"support access",[74,156,157],{},"telemetry"," kick in – channels that are rarely fully closed in default operation. All three points let the ",[74,160,161],{},"US CLOUD Act (18 U.S. Code §2713)"," apply, regardless of where the data is stored.",[117,164,166],{"id":165},"why-the-munich-sovereignty-studio-does-not-solve-the-structural-conflict","Why the Munich Sovereignty Studio does not solve the structural conflict",[70,168,169,170,173,174,177,178,181,182,187],{},"The ",[74,171,172],{},"Sovereignty & Digital Resilience Studio in Munich",", opened in February 2026, is a consulting offering, not a legal construct. It supports customers in articulating sovereignty requirements and mapping Microsoft products to them. However, the consulting changes nothing about the basic jurisdictional question: the contractual counterparty remains Microsoft. A studio in Munich is not a European company under the ",[74,175,176],{},"EU Data Act"," and not a European legal entity under the ",[74,179,180],{},"BSI IT-Grundschutz building block SYS.1.5",". The economic comparison between Delos Cloud and open European alternatives shows the same structure – we broke it down in the analysis on the ",[183,184,186],"a",{"href":185},"/en/blog/delos-cloud-cada-sovereignty-gap-2026","Delos Cloud sovereignty gap",".",[117,189,191],{"id":190},"the-zendis-criteria-and-why-they-are-the-better-yardstick-for-municipalities","The ZenDiS criteria – and why they are the better yardstick for municipalities",[70,193,194,197],{},[74,195,196],{},"ZenDiS – the Centre for Digital Sovereignty of Public Administration"," has published public criteria for assessing sovereign offerings. The review questions read soberly:",[199,200,201,205,208,211,214],"ul",{},[202,203,204],"li",{},"Who holds the legal entity for operations?",[202,206,207],{},"Who holds the code-signing and update keys?",[202,209,210],{},"Who has emergency and support access to production systems?",[202,212,213],{},"Which clauses govern the rejection of foreign disclosure orders?",[202,215,216],{},"Which audit rights does the customer have without the provider's consent?",[70,218,219,220,222,223,225],{},"These five questions are the pragmatic yardstick for municipalities. ",[74,221,76],{}," does not currently answer them positively. ",[74,224,92],{}," in a German data centre operated by a European provider answers them positively as a rule.",[117,227,229],{"id":228},"the-municipal-reality-in-august-2026","The municipal reality in August 2026",[70,231,232,233,236,237,240],{},"The municipal IT landscape in Germany is heterogeneous. Around 11,000 cities and municipalities, 294 districts, 107 independent cities – plus special-purpose associations, municipal IT service providers and the ",[74,234,235],{},"municipal data centres (AKDB, KDN, ekom21, KRZ)",". For the vast majority of municipalities with ",[74,238,239],{},"50 to 500 administrative workstations",", the starting point in 2026 is:",[199,242,243,250,261,264],{},[202,244,245,246,249],{},"Existing Microsoft 365 contract with a ",[74,247,248],{},"price increase from 1 July 2026"," (Business Standard plus 12 percent, Business Basic plus 16 percent).",[202,251,252,253,256,257,187],{},"Regulatory pressure from the ",[74,254,255],{},"NIS-2 Implementation Act"," – see our ",[183,258,260],{"href":259},"/en/blog/nis2-gdpr-microsoft-paradox","NIS-2 GDPR paradox post",[202,262,263],{},"Missing state-level framework contracts for sovereign alternatives in several federal states.",[202,265,266,267,270],{},"Political tailwind from ",[74,268,269],{},"Bavaria, Schleswig-Holstein, Hamburg"," and the federal government.",[70,272,273,274,276,277,280],{},"The room for action is open: municipalities can now either invest in ",[74,275,76],{}," – with the legal risk described above – or in an ",[74,278,279],{},"openDesk stack in a German municipal data centre",". The procurement waves over the next twelve months will show how the municipal environment positions itself.",[117,282,284],{"id":283},"the-economic-comparison-for-a-district-with-250-administrative-workstations","The economic comparison for a district with 250 administrative workstations",[70,286,287],{},"Reference calculation, 36-month view, 250 users, existing Microsoft 365 Business Standard contract:",[289,290,291,309],"table",{},[292,293,294],"thead",{},[295,296,297,301,304,306],"tr",{},[298,299,300],"th",{},"Position",[298,302,303],{},"Microsoft 365 (Cloud)",[298,305,76],{},[298,307,308],{},"openDesk stack",[310,311,312,327,341,353,365],"tbody",{},[295,313,314,318,321,324],{},[315,316,317],"td",{},"Licence/operation",[315,319,320],{},"120,000 €",[315,322,323],{},"180,000 €",[315,325,326],{},"90,000 €",[295,328,329,332,335,338],{},[315,330,331],{},"Infrastructure/DC",[315,333,334],{},"0 €",[315,336,337],{},"140,000 €",[315,339,340],{},"60,000 €",[295,342,343,346,348,350],{},[315,344,345],{},"Sovereignty legal advice",[315,347,340],{},[315,349,340],{},[315,351,352],{},"15,000 €",[295,354,355,358,360,362],{},[315,356,357],{},"One-off migration",[315,359,334],{},[315,361,326],{},[315,363,364],{},"70,000 €",[295,366,367,372,376,381],{},[315,368,369],{},[74,370,371],{},"Total",[315,373,374],{},[74,375,323],{},[315,377,378],{},[74,379,380],{},"470,000 €",[315,382,383],{},[74,384,385],{},"235,000 €",[70,387,388,390,391,394,395,399],{},[74,389,76],{}," is thus the ",[74,392,393],{},"most expensive"," of the three options – without solving the legal sovereignty question. The factor versus openDesk sits at around 2. This structure confirms the pattern we described for the ",[183,396,398],{"href":397},"/en/blog/euro-office-microsoft-365-alternative-2026","EuroOffice alternative"," in the administrative context – for municipalities the comparison is even sharper, because the compliance evidence burden in districts tends to be higher.",[117,401,403],{"id":402},"conclusion-and-next-steps","Conclusion and next steps",[70,405,406,408,409,412,413,416,417,420],{},[74,407,76],{}," is a technically solid on-premises product – but it is not a sovereignty solution in the legal sense. The ",[74,410,411],{},"Munich Sovereignty Studio"," is consulting, not a legal construct. ",[74,414,415],{},"Sovereignty Washing 2026"," therefore means for municipalities: anyone who sees the term \"sovereign\" in a contract must ask the five ",[74,418,419],{},"ZenDiS review questions"," before signing.",[70,422,423,424,427,428,431,432,436,437,440],{},"For cities, districts and municipalities that will set the course for the 2027 budget year, we recommend three steps. First, the live analysis of your current Microsoft 365 data flows at ",[183,425,426],{"href":426},"/en/microsoft",". Second, the categorised overview of sovereign providers at ",[183,429,430],{"href":430},"/en/alternativen",", including the sales-partner channels for openDesk – background in our post on the ",[183,433,435],{"href":434},"/en/blog/opendesk-partner-program-2026","openDesk partner programme 2026",". Third, an initial consultation via ",[183,438,439],{"href":439},"/en/contact"," for a municipality-specific migration plan that takes the procurement cycle of state framework contracts into account.",{"title":442,"searchDepth":443,"depth":443,"links":444},"",2,[445,446,447,448,449,450],{"id":119,"depth":443,"text":120},{"id":165,"depth":443,"text":166},{"id":190,"depth":443,"text":191},{"id":228,"depth":443,"text":229},{"id":283,"depth":443,"text":284},{"id":402,"depth":443,"text":403},"2026-08-11T00:00:00.000Z","M365 Local is GA, the Munich Sovereignty Studio is open, openDesk 1.17 is in the Chancellery – municipalities need a fact-check, not marketing.","md",[455,458,464,471,483],{"q":456,"a":457},"What exactly is Microsoft 365 Local and why is it marketed as \"sovereign\" in 2026?","Microsoft 365 Local is an on-premises variant of the core productivity services – Exchange Server, SharePoint Server and Skype for Business Server – running on Azure Local. Azure Local is Microsoft's successor product to Azure Stack HCI and is operated in the customer's or a partner's data centre. Microsoft markets the combination as a \"Sovereign Private Cloud\" with attributes such as \"local data residency\", \"operational autonomy\" and \"support through 2035\". General Availability of the fully separated, disconnected operating variant was announced in early 2026. On paper this reads like a sovereign stack – legally, the attribution to the US-based Microsoft Corporation is unchanged.",{"q":459,"a":460},"Why do ZenDiS and Nextcloud call the new Microsoft sovereignty strategy \"sovereignty washing\"?",{"The accusation can be summarised in one sentence":461},{"sovereignty is being sold as a technical feature, but it is a question of legal jurisdiction":462},{" Frank Karlitschek, CEO of Nextcloud, coined the term":463},"In Europe, sovereignty means the absence of strong dependencies on overseas third parties. The sovereign cloud from Microsoft does not deliver that.",{"q":465,"a":466},"Does the 2018 CLOUD Act really no longer bite on Microsoft 365 Local because the data stays in Germany?",{"No":467},{" The CLOUD Act does not address the geographic storage location but the provider's legal jurisdiction":468},{" Microsoft's legal counsel in France confirmed under oath in 2025 that a non-disclosure guarantee against US authorities is not possible, regardless of the data-centre location":469},{" The same legal logic applies to Microsoft 365 Local":470},"as long as Microsoft Corporation runs the support, update and key-management chains, data-disclosure orders under 18 U.S. Code §2703 remain possible. Details on the affected extraterritoriality chains are broken down in our post on the [CLOUD Act 2026](/en/blog/cloud-act-2026).",{"q":472,"a":473},"What has moved politically in Germany over the last few weeks?",{"Four events converge within a few months":474},{" First, the Federal Chancellery uses openDesk productively, together with the Robert Koch Institute and other federal ministries":475},{" Second, the Free State of Bavaria has cancelled a billion-euro framework contract with Microsoft in order to move to a sovereign basic workplace":476},{" Third, openDesk 1":477},[478,478,478,478,478,478,478,478,478,478,478,478,478,478,478,478,478,479],null,{"0 was released on 22 July 2026 with sprint planning, scheduled email sending and Keycloak security fixes":480},{" Fourth, Microsoft has opened the Sovereignty & Digital Resilience Studio in Munich in parallel, intended to support authorities and companies in sovereignty analyses":481},{" The message for municipalities is":482},"the federal government and the states are positioning themselves visibly, but the municipal level is not automatically covered by the state framework contracts.",{"q":484,"a":485},"Is openDesk technically ready enough that a German municipality can fully replace Microsoft 365?","In defined user groups yes, in edge workloads not yet across the board. The city of Zurich documented in a May 2026 study that a full replacement is currently not possible – primarily because of specialist-application integrations. This assessment is realistic for cities with highly specialised IT landscapes. For the vast majority of German districts and municipalities with standard administrative workflows – council information system, resident registration, accounting, citizen communication – the openDesk 1.17 baseline in combination with Nextcloud, Element, Jitsi and Collabora Online is sufficient to productively replace 70 to 90 percent of Microsoft 365 usage. The rest belongs on a dedicated residual roadmap and is not an argument against the switch.",{"name":487,"description":488,"totalTime":489,"steps":490},"Sovereignty washing test for municipalities in five review steps","A compact review path for IT leadership in cities, districts and municipalities to factually assess a cloud offering marketed as \"sovereign\".","P30D",[491,494,497,500,503],{"name":492,"text":493},"Check the legal entity","Establish which legal entity signs the operator contract. Operation in a German data centre does not help if the contractual counterparty is a US entity or a US subsidiary. For assessment under BSI IT-Grundschutz building block SYS.1.5, only the legal entity counts, not the server location. Details on this check point are broken down in our post on the [BSI IT-Grundschutz conflict with Microsoft 365](/en/blog/bsi-it-grundschutz-microsoft-365).",{"name":495,"text":496},"Document key and signature sovereignty","Ask the provider in writing who signs off on root certificates, signing keys and updates. If a US parent holds the code-signing keys, it can undo every security guarantee in the data centre via software updates. For a sovereign stack, the signing and update chain must lie entirely under EU control.",{"name":498,"text":499},"Zero out emergency access paths","Check whether the provider can access production data or administrative interfaces during an incident. Support access, remote diagnostics and telemetry are the most frequent open channels in practice. A sovereign offering must either fully disable these channels or restrict them to EU personnel chains under German jurisdiction.",{"name":501,"text":502},"Interpret contractual clauses on disclosure obligations","Have the contract reviewed by an IT-law specialist for a clause that rejects foreign disclosure orders. Without such a clause, US law applies in a dispute – even if the data physically sits in Germany. This clause is absent from the standard framework contracts of Microsoft, AWS and Google.",{"name":504,"text":505},"Prove audit rights and exit clauses","A sovereign offering must grant the customer the right to audit the actual data flows independently or through an independent auditor. The EU Data Act has guaranteed free data export since 12 September 2025 – the detailed analysis is in our post on the [Data Act switching window](/en/blog/eu-data-act-cloud-switching-microsoft-365-exit-january-2027). Anyone who does not obtain this clause in writing is not buying sovereignty but a sovereignty promise.",{"src":507},"https://images.unsplash.com/photo-1541959833400-049d37f98ccd?w=1200&q=80",{},true,"/en/blog/sovereignty-washing-microsoft-365-local-municipalities-2026",{"title":53,"description":452},"en/3.blog/24.sovereignty-washing-microsoft-365-local-municipalities-2026","sx__9I5E6etAh_Vnpnzzvd-uug4u5JE_an7uyA-hdZM",[515,520],{"title":516,"path":517,"stem":518,"description":519,"children":-1},"Hospitals caught between NIS-2, KHZG expiry and mandatory ePA – Why German clinics should exit Microsoft 365 now","/en/blog/hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","en/3.blog/23.hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","NIS-2 registered, ePA in regular operation, KHZG funding ending – for hospital IT, Microsoft 365 is no longer a viable target architecture. The sovereign path.",{"title":521,"path":522,"stem":523,"description":524,"children":-1},"BSI C3A meets Microsoft 365 – How the new sovereignty criteria catalogue changes the German state tenders in autumn 2026","/en/blog/bsi-c3a-microsoft-365-procurement-sovereignty-2026","en/3.blog/25.bsi-c3a-microsoft-365-procurement-sovereignty-2026","Germany's BSI C3A catalogue makes cloud sovereignty measurable. What the new criteria mean for Microsoft 365 tenders in NRW and Lower Saxony this autumn.",1788852143334]