Leaving Microsoft 365: A Guide to a Sovereign Open-Source Office Stack
Microsoft 365 vendor lock-in is a documented risk, not a theory. This guide covers the full open-source replacement stack, real migration costs, and how to run it all on EU-sovereign infrastructure.
By runtiq Team
Microsoft France’s legal director, Anton Carniaux, told the French Senate in June 2025: “No, I cannot guarantee French data won’t be seized by US authorities.” A few months later, the International Criminal Court adopted OpenDesk. Its Chief Prosecutor, Karim Khan, had been locked out of Microsoft Outlook following US sanctions. Cases like these turn an abstract risk into a practical business concern.
The Main Risks for Organizations
Microsoft 365 concentrates files, communication, and identity with one vendor. Entra ID is especially important: many organizations connect 20 to 80 external applications through SAML or OIDC. During platform outages such as those in July 2023 and November 2024, the impact can extend beyond Microsoft services to CRM, HR, and internal applications.
Cost is another concern. License prices have increased by more than 40% cumulatively since 2022, with a further increase announced for July 2026. Backup, archiving, and compliance features often cost extra.
Legal access also remains relevant. The CLOUD Act allows US authorities to compel US providers to produce data. The provider, not the physical storage location, is the key factor. In January 2026, Microsoft produced BitLocker keys from its Azure Key Vault in response to a US federal warrant.
A Practical Replacement Stack
Open-source alternatives already operate at scale. Île-de-France runs Nextcloud for 550,000 students and staff. The French government’s Tchap platform serves more than 600,000 public-sector users with Matrix. The following table shows what works well today and where gaps remain:
Technically, the replacement is not a single suite. Nextcloud handles files, calendars, and collaboration. ONLYOFFICE or Collabora edit documents in the browser. Mailcow provides email, while Keycloak or Authentik manages identity and SSO. The components use open protocols and can be upgraded or replaced independently.
| Microsoft 365 Component | Open-Source Replacement | Status |
|---|---|---|
| Word / Excel / PowerPoint (browser, co-edit) | ONLYOFFICE Document Server or Collabora Online | ✅ Production-ready |
| Word / Excel / PowerPoint (desktop) | LibreOffice | ✅ Production-ready |
| OneDrive / SharePoint (files & sync) | Nextcloud Files (desktop + mobile clients) | ✅ Production-ready |
| Microsoft Teams (video & chat) | Nextcloud Talk, Element/Matrix | ✅ Good for ≤50 person meetings |
| Exchange / Outlook (email) | Mailcow + Nextcloud Mail (client) | ✅ Production-ready |
| Outlook Calendar | Nextcloud Calendar (CalDAV) | ✅ Production-ready |
| Azure Active Directory / Entra ID | Keycloak or Authentik | ✅ Production-ready |
| Planner / project boards | Nextcloud Deck (Kanban) | ✅ Good |
| Microsoft Forms | Nextcloud Forms | ✅ Good |
| Power Automate (basic file triggers) | Nextcloud Flow | ⚠️ Basic triggers only |
| Power Automate (complex workflows) | n8n (self-hosted) | ⚠️ Requires separate setup |
| VBA macros in Excel/Word | ONLYOFFICE 9.x improved support | ⚠️ Audit your macro inventory first |
| Power BI / dashboards | Grafana, Metabase | ⚠️ Not a drop-in replacement |
| Teams Live Events (large webinars) | No direct replacement yet | ❌ Gap remains |
| Microsoft Intune (device management) | ManageEngine, Jamf | ⚠️ Separate tooling required |
A staged setup works well for many organizations. Files and shared documents can move first while email and identity temporarily remain with Microsoft. Teams can test the new environment with real work without switching every dependency at once. The architecture should explicitly support this transition period.
Open standards should connect the components. CalDAV and CardDAV cover calendars and contacts, while SAML or OIDC handles sign-in. For files and office documents, test versioning, sharing, and concurrent editing early. This keeps individual products replaceable without rebuilding the entire stack.
What Makes Migration Hard
Applications are rarely the biggest problem. The difficult work lies in dependencies that may not have been fully documented.
Entra ID and SSO: Keycloak or Authentik can replace the technical function. First, every connected application must be identified and moved. Running two identity systems during the transition is often necessary.
The inventory should record more than application names. Each integration needs its protocol, responsible team, role model, and planned cutover date. Services that use Entra groups directly for authorization need particular attention. Replacing a SAML or OIDC connection is usually quick; coordinating access rules takes longer.
Power Automate: Every active flow needs an owner and a replacement plan. Nextcloud Flow handles basic file triggers; n8n can cover more complex processes. Abandoned or outdated flows should not be migrated by default.
SharePoint: Document storage, intranet pages, and workflows are often mixed together. Some content belongs in Nextcloud Files, some in an intranet, and obsolete sites can be retired.
Before transfer, teams should review active libraries, metadata, and retention rules. A simple copy otherwise preserves abandoned sites and inconsistent structures. Teams should also test co-editing with the templates they actually use. Format compatibility in daily work matters more than a general product comparison.
Teams history: Nextcloud Talk does not import channel history at scale. A read-only archive is usually more practical than attempting a complete live migration.
Remaining specialist cases: Large webinars, Power BI models, complex VBA macros, and device management require separate solutions. Test and budget for these gaps before committing.
Migration therefore needs clear waves rather than one cutover date. A pilot group tests file formats, sharing, and mobile clients. Less critical teams follow, with central processes moving later. Every wave needs a rollback path, support, and acceptance criteria. Training should focus on specific workflows, not just new interfaces.
Email also needs a dedicated plan. Mailboxes, calendars, distribution lists, shared addresses, and retention rules must be considered together. A limited period of parallel operation lowers risk but requires clear rules for delivery and calendar bookings. The old service should become read-only archival access only after these tests pass.
Costs and Lessons from Real Migrations
A fair comparison includes backup, compliance features, email archiving, infrastructure, and support. On that basis, the three-year picture looks like this:
| Organization size | MS365 realistic 3-year cost* | Open-source stack 3-year cost | Savings |
|---|---|---|---|
| 15 users | ~€21,000 | ~€8,000 | ~€13,000 |
| 50 users | ~€68,000 | ~€22,000 | ~€46,000 |
| 200 users | ~€188,000 | ~€75,000 | ~€113,000 |
MS365 realistic cost includes backup, compliance add-ons, and email archiving. Open-source cost includes EU-hosted infrastructure and support.
Schleswig-Holstein provides the most detailed public case study. Microsoft licenses for about 30,000 employees cost the state €15 million per year. The one-time migration investment was €9 million and paid back in under twelve months at the actual savings rate. By December 2025, 80% of workstations ran LibreOffice, and 44,000 Exchange mailboxes had moved to Open-Xchange and Thunderbird.
The figures also show why license prices are not enough for a comparison. Project work, data transfer, training, parallel operation, and ongoing support belong in the calculation. An open-source stack removes per-seat license fees, not operations and maintenance. Additional users mainly add compute and storage. This makes costs more predictable but does not replace sound capacity planning.
For an internal business case, separate one-time and recurring costs. Inventory, customization, migration, and training are one-time items. Infrastructure, upgrades, backups, monitoring, and support continue. Compare the same scope on both sides: a low base license without archiving or recovery is not a fair benchmark for a fully operated open-source stack.
Munich’s earlier experience shows the organizational factor. Microsoft systems remained in parallel, executive support did not last, and users could return to old workflows. In the more successful project, LibreOffice was the required standard, training had a budget, political backing was sustained, and the phase-out followed a fixed timeline. The implementation mattered as much as the software.
The Netherlands Central Government is also migrating 120,000 civil servants. Projected annual license savings after completion are €45 million. Its stack includes Nextcloud, Matrix/Element, and Keycloak.
A Concise Compliance View
The EU Data Boundary and partner offerings such as Delos Cloud and Bleu improve data residency. They do not remove every dependency on Microsoft’s software, identity, and key-management stack.
These offerings matter operationally because customers can work with European companies and keep data in the EU. The server location alone is still not enough for a risk assessment. Organizations should also consider the operator, parent company, access to keys, and technical dependencies. Contracts can define safeguards, but they cannot remove the provider’s underlying legal obligations.
Three obligations matter most. GDPR Articles 44–49 limit transfers of personal data to third countries. NIS2 Article 21 requires organizations to manage supply-chain and concentration risks. Under DORA, financial entities must also address audit rights, incident reporting, and exit strategies.
This does not make Microsoft 365 categorically unlawful. Organizations should document affected data and critical processes, their safeguards, and a workable exit plan. Containerized open-source software and open formats make that exit planning simpler.
A credible exit plan covers more than data export. It records the formats used for files, identities, and logs, the expected transfer time, and the applications that must keep running. Regular export and restore tests show whether the plan works in practice. This reduces both compliance risk and the impact of outages or contract changes.
The assessment should distinguish levels of sensitivity. Public material, internal documents, and highly sensitive data need different controls for encryption, logging, and access. This avoids a blanket decision for or against one provider and creates a traceable mapping between data and services. The same documentation supports audits and helps prioritize migration work.
Running the Stack on runtiq
Nextcloud, ONLYOFFICE, Collabora, Keycloak, and Mailcow run as separate containers. runtiq operates this stack as an Austrian PaaS under EU jurisdiction, without dependencies on US infrastructure.
This separation creates clear technical boundaries. The document server can communicate only with Nextcloud, databases do not need public exposure, and identity remains a separate service. Components can be operated and upgraded independently. Monitoring, secrets, DNS, and deployment still remain manageable in one place.
Auto-detect CI/CD: after a push, the pipeline handles build and deployment. Maintained images are available directly from the projects.
Private networking: Nextcloud, ONLYOFFICE, and databases communicate internally. Only required services are publicly reachable.
Managed DNS and ingress: DNS, TLS certificates, and routing for office.yourcompany.com, docs.yourcompany.com, and auth.yourcompany.com are managed.
Vault-compatible secrets: passwords and OAuth/OIDC keys are stored securely and can be rotated without redeploying containers.
Observability: logs, metrics, and alerts are available for every container from the first deployment.
Compliance documentation: the Data Processing Agreement, NIS2/DORA reports, and incident-reporting workflows are included from day one.
See the pricing page for details. If you are evaluating a migration, the right first step is auditing your current Microsoft 365 dependency map — we can help with that too.