Microsoft 365 vs Self-Hosted: The Real Costs, Risks, and Alternatives for UK Businesses

The Real Cost of Microsoft 365

Microsoft publishes clean per-seat pricing. What they do not publish is the total cost of ownership once you account for the add-ons, compliance tools, and storage upgrades that most businesses actually need.

Published per-seat pricing (UK, April 2026)

The hidden costs

The sticker price is the starting point. These costs appear in your actual invoice:

• Additional storage: OneDrive beyond 1TB is £5.90/user/month. SharePoint beyond the tenant pool is £0.15/GB/month.
• Microsoft Copilot: £25/user/month. Mandatory for any AI feature. Not included in E5.
• Azure AD P2: £6.70/user/month on top of E3. Required for PIM and risk-based conditional access.
• Microsoft Defender P2: £4.20/user/month. Required for full EDR.
• Compliance Manager premium: Advanced DLP requires E5 or add-on.
• Power Platform: Power Automate premium £12.30/user/month. Power Apps £4.10/user/app/month.
• Telephony: Teams Phone Standard £6.50/user/month. Calling plans additional.
• MSP fees: Most UK SMEs pay £5–15/user/month to a Microsoft partner.

Where Your M365 Data Actually Goes

Microsoft offers “UK data residency” for core workloads (Exchange Online, SharePoint, OneDrive, Teams). This means your data-at-rest is stored in Microsoft's UK South and UK West Azure regions. But data residency is not the same as data sovereignty.

What “UK data residency” does not cover

• Entra ID (Azure AD): Directory data and authentication tokens are processed globally.
• Microsoft Copilot and AI features: Prompts processed by Azure OpenAI Service, which may use datacentres outside the UK.
• Diagnostic and telemetry data: Windows and Office telemetry sent to Microsoft's US infrastructure.
• Support and troubleshooting: Microsoft engineers globally may access your tenant data.
• Microsoft Graph API: Third-party apps access data through Microsoft's global infrastructure.

The CLOUD Act Problem

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted in 2018, gives US law enforcement the power to compel US-headquartered technology companies to produce data stored anywhere in the world.

• No geographic protection: Storing data in UK datacentres does not exempt it from a CLOUD Act request.
• No mandatory notification: Microsoft is not required to notify the data controller that a request has been served.
• UK-US Data Access Agreement: The bilateral agreement does not prevent unilateral US requests under the CLOUD Act.
• Legal conflict with UK GDPR: A CLOUD Act disclosure without data controller authorisation is a potential breach of UK GDPR Article 48.

Self-Hosted Replacement for Every M365 Component

Every component of Microsoft 365 has a mature, open-source, self-hostable replacement. These are production software used by governments, universities, and enterprises across Europe.

What a Self-Hosted Replacement Actually Costs

Genitco's managed self-hosted collaboration stack (Stalwart, Nextcloud, Mattermost, Jitsi, all under Zitadel identity) is a flat monthly fee, not a per-seat licence — the same shape of pricing as the rest of Genitco's Run tier.

No per-seat licensing, no Copilot/Defender/Azure AD P2 add-ons stacked on top — the flat fee covers hosting, monitoring, backups, and managed operations. For teams above 50, or a setup with specific requirements, we scope and quote rather than extrapolating a generic number here. See the full pricing matrix for the current rates, or book the call below for a quote against your actual setup.

GDPR and Data Sovereignty

The UK GDPR (retained EU law post-Brexit) and the Data Protection Act 2018 impose strict obligations on controllers and processors regarding international data transfers, lawful basis, and data subject rights. Self-hosted infrastructure fundamentally changes your compliance posture.

In March 2024 the European Data Protection Supervisor found that the European Commission's own use of Microsoft 365 infringed EU data protection law and ordered specific data flows to non-EU sub-processors suspended. The Commission brought its use of M365 into compliance by mid-2025. It was a targeted finding against one institution's specific configuration, not a blanket ban on M365 across the EU — but it is a concrete example of a data protection authority finding fault with M365's default data flows, which is the same underlying exposure any UK organisation using it faces.

UK Regulatory Frameworks: DSPT, SRA, and FCA

NHS — Data Security and Protection Toolkit (DSPT)

The DSPT V8 requires IT suppliers to demonstrate accountability over their entire data supply chain (NDG Standard 10). If your M365 tenant processes NHS patient data, you must evidence where that data is processed and how you would respond to a third-country law enforcement request.

A self-hosted stack on UK infrastructure eliminates the “where is the data?” question entirely. Your DSPT evidence shows servers in a UK datacentre, encryption keys in your control, and no subprocessor chains extending to US jurisdiction.

Legal sector — SRA Standards and Regulations

The Solicitors Regulation Authority (SRA) requires law firms to safeguard client confidentiality (Principle 6). Legal professional privilege is a fundamental right. The CLOUD Act creates a scenario where privileged communications stored in Microsoft 365 could be disclosed to US law enforcement without the law firm's knowledge.

Financial services — FCA and PRA

The FCA's operational resilience requirements (PS21/3) and the PRA's supervisory statement SS2/21 require firms to identify important business services and ensure they can tolerate disruption. Concentration risk in a single US hyperscaler is a known supervisory concern. Self-hosted infrastructure eliminates single-vendor concentration risk.

Migration Path

Migration from M365 to self-hosted is a phased process, not a big-bang cutover. The goal is zero downtime and zero data loss, with both systems running in parallel during transition.

Phase 1: Infrastructure and identity (Week 1–2)

• Deploy Kubernetes cluster on UK/EU dedicated servers
• Deploy Zitadel as identity provider with OIDC/SAML
• Configure SCIM provisioning from existing Azure AD or direct user import
• Deploy monitoring, alerting, and backup infrastructure
• Establish VPN or WireGuard mesh between sites

Phase 2: Email migration (Week 2–4)

• Deploy Stalwart mail server with JMAP, IMAP, and SMTP
• Configure DKIM, SPF, and DMARC for your domain
• IMAP-sync all mailboxes from Exchange Online to Stalwart
• Update MX records to point to Stalwart
• Migrate calendars and contacts via CalDAV/CardDAV

Phase 3: Files and collaboration (Week 3–5)

• Deploy Nextcloud with OnlyOffice integration
• Migrate OneDrive/SharePoint data using the Nextcloud migration tool or rclone
• Deploy Nextcloud desktop and mobile sync clients
• Verify folder structures, sharing permissions, and external shares

Phase 4: Communications (Week 4–6)

• Deploy Mattermost for team messaging (import Teams history if needed)
• Deploy Jitsi Meet for video conferencing
• Integrate Mattermost with Jitsi for one-click video calls
• Train users on new tools (typically 1–2 hour session)

Phase 5: Decommission M365 (Week 6–8)

• Verify all data migrated and accessible
• Run both systems in parallel for 2 weeks as safety net
• Export compliance and audit data from M365 admin centre
• Cancel M365 licences
• Update data processing records, privacy notices, and ROPA

Decision Framework: Should You Move?

Self-hosted is not for everyone. Here is an honest assessment of when it makes sense and when it does not.

Self-hosted is a strong fit if:

• You operate in a regulated sector (healthcare, legal, finance) where data sovereignty is a compliance requirement
• You handle client data subject to professional privilege or sector-specific confidentiality rules
• Your M365 costs exceed £30/user/month and you have 20+ users
• You want to eliminate per-seat licensing and achieve predictable infrastructure costs
• You need to demonstrate DSPT, ISO 27001, or Cyber Essentials compliance with full evidence of infrastructure control
• You are uncomfortable with the CLOUD Act exposure and want to remove it entirely

M365 may still be appropriate if:

• You are a very small team (<10 users) without regulatory obligations and want zero infrastructure management
• Your workflows depend heavily on Power Platform, Dynamics 365, or other Microsoft-only integrations
• You have no in-house IT capability and do not want managed hosting
• Your data classification is low-sensitivity with no professional privilege or regulatory requirements