Cloud services: Bavaria to introduce Microsoft 365 in public authorities

The Bavarian state government wants to introduce cloud services from Microsoft in the state's authorities. The state and local authorities are to be able to use services such as MS 365, Teams and Copilot in the future. To this end, the Ministry of Finance is negotiating a "joint contract for the Free State and local authorities" with the US company. This is according to a presentation by the ministry, which is available to c't.

Bavaria is thus following the example of pioneers such as Lower Saxony, which is also planning to use services from the US company's public cloud. According to the Bavarian presentation, Microsoft services will gradually only be available from the cloud, which will put authorities under pressure to act. It would be "uneconomical" to discuss data protection and security issues in many places. These issues should therefore be clarified centrally.

Microsoft 365 is even listed in the presentation as a mandatory, centrally provided basic service for local authorities. However, the ministry rowed back on this point when asked by c't: a decision had not yet been made and would be "coordinated hand in hand with the municipal umbrella organizations".

Data protection officer has made demands

It is not clear from the presentation when the introduction is to start. Talks are still ongoing between the ministry and the State Commissioner for Data Protection. In his view, "transparency in terms of processing purposes, anonymization of usage data and deletion periods for personal data" are "indispensable". The aim of the ministry is to conclude contract supplements with Microsoft on the subject of data protection. Lower Saxony is explicitly mentioned here as an example. The Ministry is also holding talks with the State Office for Information Security.

The ministry has also formulated a goal on the subject of costs: The total costs would have to "remain within the current license costs". The presentation mentions communication between authorities as well as with citizens and companies, including citizen consultation hours via Teams, as application scenarios for the cloud services.

Open source is not mentioned

Many data protection experts are critical of the use of Microsoft cloud services in public administration. Among others, the EU Data Protection Commissioner has described the use of Microsoft 365 in the EU Commission as unlawful. The German government wants to use Microsoft services in a special cloud environment from SAP subsidiary Delos to dispel data protection concerns. However, it is likely to be several years before the Delos cloud is ready. According to the presentation, a proof of concept for the use of the Delos cloud for personnel administration and payroll accounting is currently underway in Bavaria. Further PoCs are planned with German cloud operators such as Ionos.

For Microsoft 365 and Teams, however, Bavaria is relying on Microsoft's public cloud, which is presumably cheaper than Delos, at least for now. The keyword "open source" does not appear in the presentation, so the state government's interest in the federally funded Microsoft alternative openDesk is presumably limited.

The cloud projects are among the fields of action of the "Future Commission Digital Bavaria 5.0", in which the Free State is working together with the local authorities. This commission is also working on other projects, such as the increased use of AI. The creation of a "central IT service provider for local authorities" is also being examined.

(cwo)