The Swiss federal open-source workplace, next to Microsoft 365
The Swiss federal government plans an open-source workplace beside Microsoft 365 from the end of 2027. What the pilot found and what a parallel setup needs.
The Swiss federal government is to give about 3,000 staff in particularly critical business processes an open-source workplace from the end of 2027, run in parallel with Microsoft 365, not in its place. The Federal Chancellery launched the programme on 2 September 2026, estimates phase one at about CHF 9 million and on 6 October 2026 announced it as one of 22 federal key projects, subject to systematic audits by the Swiss Federal Audit Office (EFK). For cantons, cities and regulated firms, the federal reference is now a second workplace, not a replacement.
This post covers whether Bern is replacing Microsoft 365, what its pilot found, how the Dutch tax administration’s choice differs, and what a parallel workplace needs. None of the official texts has an English version, so summaries and translations are ours. In German the programme is “digital souveräner Arbeitsplatz”, in French “bureautique souveraine”.
Is the Swiss federal government replacing Microsoft 365 with open source?
No. As of 8 October 2026 the programme plans an open-source workplace for about 3,000 staff, while about 54,000 federal workplaces run Microsoft 365, a rollout reported complete on 18 December 2025. The 2 September release leaves open whether the whole workplace moves later, and the Chancellery’s strategic report calls full substitution “keine realistische Option” (not a realistic option) at present.
- Decided. The Federal Chancellery launched the programme on 2 September 2026. On 1 October 2026 the Federal Chancellor made it a key project under the Digitalisation Ordinance. It is funded from money Parliament approved for a sovereign Swiss open-source office platform.
- Planned. From the end of 2027, about 3,000 staff are to use email, calendar, documents, presentations, telephony and audio and video conferencing on a standalone system run in parallel with Microsoft 365.
- Open. The programme has not chosen a product. The pilot used openDesk because testing an established suite was more economical than assembling components, and the strategic report says this sets no precedent for production. Phase one is to make the cost of a broad rollout and of regular operation possible to estimate, and more money may be needed.
As of 8 October 2026 we found no product award, tender notice or EFK report. Some coverage mixes the programme up with a separate move: the armed forces’ Cyber Command plans to equip all its staff with openDesk by October 2026 at the latest, Netzwoche reported on 13 July 2026, citing Republik. We found no official release on it. Other coverage ties the programme to the EMBAG, whose Article 9 covers publishing code the administration develops or commissions, not choosing a workplace (our EMBAG post).
What did the PoC BOSS pilot find?
PoC BOSS, a proof of concept for office automation with open-source software, was meant as an emergency replacement if today’s office automation fails and for secure handling of sensitive information. It was also to test whether the federal exit strategy for Microsoft 365 is feasible (project page). The technical report of the Federal Office of Information Technology, Systems and Telecommunication (BIT) lists what was tested: openDesk from Germany’s ZenDiS, which bundles Open-Xchange, Element, Jitsi, Nextcloud, Collabora, XWiki, OpenProject and Univention Nubus.
In the user acceptance test (report dated 30 June 2026), 172 people had browser access and 73 submitted evaluations, with an average score of 5.4 out of 6. Test users rated document editing, file storage, collaboration and basic mail and calendar positively.
The strategic report finds four things reachable only partly or with considerable extra effort: large video conferences with genuine end-to-end encryption, deep integration with specialist applications, automation specific to Microsoft 365, and broad Linux readiness of core specialist applications.
The 2 September release calls the browser solution “grundsätzlich geeignet” (suitable in principle) for central standard processes and able to contribute substantially to an emergency solution. The strategic report calls the results a basis for further work, “aber noch keine unmittelbare Produktionsreife” (but not yet ready for production). The pilot showed what a fallback involves, not that one is ready.
What the technical report says about running it
The BIT ran the pilot’s backend on a best-effort basis and lists its findings without evaluating them. Some reflect the pilot setup, others are limits of the software itself; together they show what production has to cover.
- Platform and updates. openDesk is, according to its vendor, not optimised for OpenShift, and the BIT configured about 100 container images to run it there. Each monthly update took about 12 hours of image scanning and approval, and about 3 working days in all.
- Backups. The pilot had no established backup and restore processes, and the Community Edition upgrade from 1.4 to 1.8 lost data, so the BIT rebuilt on the Enterprise Edition. A standby needs backups that have been restored, not just taken.
- Sign-in. The federal eIAM worked in the browser, but Thunderbird and WebDAV clients needed app passwords because OAuth2 and OIDC were not integrated throughout.
- Clients. The BIT has no central Linux management for devices, patches and certificates. GEVER records management (Acta Nova) is not fully functional under Linux, and its vendor has not committed to a Linux roadmap. SAP integration was not verified.
- Data out of Microsoft 365. The BIT found Microsoft 365’s native backup unsuitable for moving data out: copies stay in the Microsoft cloud, with no export artefact.
- Video. The BIT ran no systematic load tests. From architecture analysis, it estimates that Jitsi with genuine end-to-end encryption is effectively unusable from 20 participants, whatever the number of servers, and that a videobridge with transport encryption carries about 100 to 150 simultaneous users.
The strategic report concludes that a second open-source platform reduces dependence but demands more of the organisation’s own architecture, operations, security and integration capabilities.
How is the Dutch tax administration’s choice different?
In a letter to the Tweede Kamer dated 5 October 2026, State Secretary for Finance Eelco Eerenberg wrote that the Belastingdienst, Douane and Toeslagen (tax, customs and benefits) “now choose an on-premises solution in combination with open source”. Mail and calendar move on-premises first, in 2027; the letter does not say they will be open source, and aims to reuse existing licences where possible. European open-source storage and collaboration follow later in 2027 and in 2028. The letter says this is in line with advice from the Adviescollege ICT-toetsing (AcICT) not to rely on one solution from one supplier but to look at alternatives function by function.
This ends a migration that was under way. ibestuur reported on 10 July 2026 that the Microsoft 365 rollout had been paused after critical AcICT advice. The Register reported on 7 October 2026 that about 5,000 of 47,500 employees had moved.
The letter adds that some planned records-management provisions came with the Microsoft 365 package and are not available on-premises; the Belastingdienst is working out what a fix needs, and the State Secretary will report back by the next status letter at the latest.
| Switzerland | Netherlands | |
|---|---|---|
| Relation to Microsoft 365 | Standalone system in parallel | Ends a Microsoft 365 migration under way |
| Mail and calendar | Core functions, product open | On-premises in 2027, product not named |
| Files and collaboration | Core functions, product open | European open source, later in 2027 and in 2028 |
| Budget | About CHF 9 million, phase one estimate | Not stated |
| Next milestone | Rollout and operating cost estimate; EFK audits | ICT roadmap, first quarter of 2027 |
Why run a second workplace beside Microsoft 365?
The strategic report weighs two options. An emergency platform held in reserve is the least disruptive but would have to scale at short notice. A second platform used beside Microsoft 365 in defined areas is the strongest strategic lever, at extra organisational and financial cost, with limited interoperability and functional limits users must accept. The report says much favours this coexisting route, built up gradually, with parallel running costs meanwhile. The BIT’s lightest variant is a standby with no everyday role, for example bought as SaaS, plus a regularly synchronised copy of Microsoft 365 data.
The point is availability and dependence more than data location. The strategic report says the federal Microsoft 365 setup already keeps mailboxes and sensitive data in federal data centres, and the stated aim is less dependence on foreign providers. See Microsoft 365 data in Switzerland on location and US sanctions on the ICC on how a foreign government’s measures can reach a cloud customer.
For a canton, city, hospital or regulated firm, the first choice is between a cold standby built when needed, a warm standby with recent data, and a second platform people use every week.
What does a workplace running in parallel need?
- Identity that survives an outage. A fallback that signs in only through Entra ID fails with it. Federate Active Directory or LDAP read-only into Keycloak, with multi-factor authentication enforced there, so staff can sign in without Entra ID, and test the break-glass accounts (identity).
- Mail and calendar, decided on their own. Mail is the hardest part to run twice, and the Dutch gave it its own track. Decide routing, domains and who can send from the fallback first.
- Files and editing with a recent copy. The BIT found that Microsoft 365’s native backup leaves no export artefact, so schedule your own exports in open formats (through the Graph API or an export tool) and check the counts. Nextcloud and Collabora Online take the copy.
- Chat and video sized to the need. Element for encrypted chat, with recovery keys stored centrally and device verification automated through single sign-on, the fixes the BIT proposes for the key-handling errors its testers ran into. Jitsi Meet for meetings, planned around the end-to-end encryption limit.
- An operator and a rehearsal. Monthly updates, restore-tested backups, monitoring, and a switch-over drill timed against your RTO. A standby nobody uses falls behind.
What to do, and by when
The dates are our suggestion, set against Bern’s timetable.
- By 31 December 2026: name the critical processes. List those that must run without Microsoft 365, who carries them, and what each depends on: Entra ID, Exchange, Teams, SharePoint and OneDrive, Power Automate, specialist applications.
- By 31 March 2027: choose the model. Emergency standby or second platform. Set RTO and RPO per process, and decide mail and calendar separately.
- By 30 June 2027: make identity and data independent. Test sign-in without Microsoft 365, break-glass accounts included, and run scheduled exports with counts checked.
- By 30 September 2027: pilot with real work. Have a group work normally on the fallback for several weeks, and plan for participation: in Bern, 73 of 172 people with access submitted evaluations.
- By 31 December 2027: rehearse the switch-over. When Bern’s 3,000 users are due to start, run a first rehearsal with a dated record, then repeat on a schedule. Regulated firms can add the record to the evidence for their exit strategy.
- Watch the next milestones. In Bern, the rollout and operating cost estimate, the product choice and the first EFK audit; in the Netherlands, the ICT roadmap (first quarter of 2027) and the records-management follow-up (next status letter). As of 8 October 2026, none has been published.
How Pilae fits
The sovereign workplace covers files, editing, chat, meetings, wiki, sign-in and passwords with Nextcloud, Collabora Online, Mattermost or Element, Jitsi Meet, Outline, Keycloak and Vaultwarden, on your premises, in Pilae Cloud regions in Switzerland and the EU, or hybrid. You can start with one app and keep Microsoft 365 running for the rest, with Keycloak federating Entra ID so staff keep one login. Pilae does not operate mail and has no phone system: Exchange Online or your mail provider stays in place, and calendars and contacts can move to Nextcloud (Microsoft 365 alternative).
As a fallback, the exit plan provides scheduled exports in open formats, a switch-over runbook and exercises up to a full rehearsal, each with a dated record. The Pilae Agent plans each update and waits for your approval, and every app is backed up daily, encrypted and offsite, with monthly restore tests on the Enterprise plan. To plan a workplace beside Microsoft 365, talk to an engineer.