Field Notes / Cloud Security
Europe Is Leaving US Software. The Security Work Microsoft Did for You Is Now Your Job.
France is replacing Teams and Zoom with Visio. Schleswig-Holstein moved more than 40,000 mail accounts off Exchange. Denmark, the Austrian army and an Austrian ministry dropped Microsoft Office or 365, and the ICC is reported to be moving to openDesk. Each switch takes data out of reach of US law. Each one also hands the patching, identity and sharing controls back to the organisation that made it. Here is what changes, where the new stack breaks, and how to test it before and after go-live.
01 Who has switched, and when
n January 2026 France told its ministries to stop using Teams and Zoom. Visio, a video tool built by the state, will replace them across the administration by 2027. It already had more than 40,000 regular users and is being rolled out to 200,000 public agents. It runs on Outscale, a Dassault Systèmes subsidiary with ANSSI’s SecNumCloud certification, and staff reach it only through ProConnect, the state’s login CyberInsider 2026 .
France is the largest move so far, not the first. Here are the switches with a named source behind them.
| Who | From | To | Status |
|---|---|---|---|
| Denmark, Ministry of Digitalisation | Microsoft Office, Office 365 | LibreOffice, Linux | Half of staff from summer 2025, whole ministry planned for autumn 2025 heise 2025 |
| Austrian armed forces | Microsoft Office 2016 | LibreOffice | 16,000 workstations, Office removed from all military computers in September 2025 It’s FOSS 2025 |
| Schleswig-Holstein state administration | Exchange, Outlook, SharePoint | Open-Xchange, Thunderbird, Nextcloud | More than 40,000 mail accounts and over 100 million emails and calendar entries moved by October 2025; SharePoint replacement still running The Register 2025 |
| Austria, economy ministry (BMWET) | Microsoft 365 | Nextcloud on Austrian infrastructure | Proof of concept to production in four months, Teams kept for external calls Gigazine 2025 |
| International Criminal Court | Microsoft | openDesk | Reported by Handelsblatt in late 2025, after Microsoft cut the sanctioned chief prosecutor’s email in May 2025 Scottish Legal News 2025 |
| France, state administration | Teams, Zoom | Visio | Announced January 2026, full replacement by 2027 Gigazine 2026 |
The reasons repeat. The Austrian army wanted sensitive data on its own servers once Office moved towards mandatory cloud services. Denmark’s minister said too much public infrastructure depends on a handful of foreign suppliers. The ICC case showed the risk in practice: a sanctions order in Washington ended a prosecutor’s email in The Hague.
02 What Microsoft did that is now yours
With Microsoft 365, a lot of security happens without anyone on your team lifting a finger. Exchange Online is patched before you read the advisory. Sign-in risk is scored on Microsoft’s side. Somebody in Redmond watches the platform at 3am. You still own your configuration, but the platform itself is someone else’s job.
Self-host Nextcloud, Open-Xchange or Matrix and every one of those jobs lands on your desk:
- Patching. Nextcloud, its apps, the PHP runtime under it, the database, the reverse proxy, the office server (Collabora or OnlyOffice) and the operating system. Each has its own release cycle.
- Identity. Entra ID, conditional access and Microsoft’s sign-in risk scoring go away. You rebuild single sign-on, MFA, password policy and session limits, usually on Keycloak or an LDAP directory.
- Sharing controls. Public links, guest accounts, federated shares and team folders work differently from SharePoint. The defaults your staff learned no longer apply.
- Monitoring. Nobody else watches the logs. If you do not ship them somewhere and read them, a break-in leaves no alert.
- Backups and restore. Your data, your backups, your restore test.
This is the trade the governments above made on purpose. They swapped dependence on one supplier for more work in-house. It is a fair trade if the in-house work gets done.
03 Where the new stack breaks
Open source does not mean fewer bugs. It means the bugs are published. Nextcloud lists roughly 280 security advisories on GitHub Nextcloud 2026 . That openness is useful, because you can read what was fixed and check whether you applied it. The 2026 entries also show where a self-hosted collaboration stack tends to fail:
| Published | Nextcloud advisory | Severity |
|---|---|---|
| 15 May 2026 | Two-factor authentication bypass via pending session token replay | Moderate |
| 5 Aug 2026 | View-only shares on external storage or team folders are always writeable | High |
| 5 Aug 2026 | Mail contact autocomplete bypasses the admin’s user enumeration limits | Moderate |
| 17 Sep 2026 | ImageMagick flaw reachable through previews of malicious files | High |
| 8 Oct 2026 | Privilege escalation in team folders for API-only delegated admins | Moderate |
Read the list as an attacker would. A second factor that can be skipped. A read-only share that is not read-only. A preview generator that opens whatever file a user uploads. An admin role that can grant more than it should. Every one of these lives in identity, sharing or file handling, the three areas a migration rebuilds from scratch.
04 The migration window
Schleswig-Holstein’s mail move ran for months, and heise reported problems along the way before it succeeded The Register 2025 . A long parallel run is normal. For all of that time an organisation runs two systems, and that doubles the ways in.
- Two sets of accounts. Leavers get disabled in one directory and forgotten in the other.
- Export files. Mailbox exports and SharePoint dumps sit on file shares and laptops, often unencrypted, long after the import finished.
- Temporary rights. Migration tools need broad admin access to both sides. Those rights tend to outlive the project.
- Permission drift. A folder that was restricted in SharePoint arrives open in Nextcloud because the tool mapped groups differently.
- Phishing cover. Every employee expects a new login page and an email asking them to set it up. Attackers send that email too.
05 Test it twice
Test once before go-live, against the production build rather than the pilot. Test again a few weeks after the cut-over, when real users have created real shares and the temporary fixes have become permanent. The second test usually finds more.
- List every internet-facing host the new stack adds: the login page, the office server, the TURN server for video, the admin consoles, the pilot and test instances. Anything not on the list gets switched off.
- Enforce MFA for every account, including admins and service accounts, and confirm it cannot be skipped through app passwords, WebDAV or the mobile apps.
- Subscribe to the security advisories of every component and set a patch deadline for high-severity fixes, then measure whether you meet it.
- Check the sharing defaults: public links off or with expiry and password, guest access limited, federation off unless you need it.
- Compare permissions on a sample of migrated folders with the source system, group by group.
- Delete export files and remove migration accounts and temporary admin rights the day the move finishes.
- Send the logs from the app, the proxy and the identity provider to a place someone reads, and alert on new admin accounts and mass downloads.
- Restore one mailbox and one team folder from backup to prove the backup works.
- Warn staff about fake setup emails before the cut-over, and tell them which address the real one comes from.
Sovereignty decides who can demand your data. Security decides who can take it. You can have the first and lose the second in the same week. Your Threat Map shows what the new stack exposes, proves which routes reach your data, and ranks the fixes, so you go live knowing where you stand. Enterprise-grade. Not enterprise-priced.
References
Sources
- CyberInsider. “France to replace Zoom and Teams with sovereign platform Visio.” January 2026. cyberinsider.com
- Gigazine. “France to replace video meeting tools with domestic Visio.” 28 January 2026. gigazine.net
- The Register. “Schleswig-Holstein completes move to open source email.” 15 October 2025. theregister.com
- heise online. “From Word and Excel to LibreOffice: Danish ministry says goodbye to Microsoft.” 10 June 2025. heise.de
- It’s FOSS. “Austria’s Armed Forces Gets Rid of Microsoft Office (Mostly) for LibreOffice.” 1 October 2025. itsfoss.com
- Gigazine. “Austrian Ministry Moves Away from Microsoft, Adopts Open Source Alternative Nextcloud.” 31 October 2025. gigazine.net
- Scottish Legal News. “ICC to ditch Microsoft following US sanctions” (reporting Handelsblatt). 3 November 2025. scottishlegal.com
- Nextcloud. Security advisories, nextcloud/security-advisories on GitHub. Accessed 26 October 2026. github.com