The landlord¶

Before the move, everything the Home did on a screen happened inside one Microsoft 365 tenant, obtained through the nonprofit grant at a price that made the finance team cry with relief. Mail, files, chat, calendars, the logins for all of them, and the admin panel that could switch any of it off: one account, one landlord. The tenant had two Global Administrators, one of whom still worked there. Nobody had checked which region it had been provisioned in. The freshly hired architect drew the estate on the whiteboard, and the lines all ran through the same box. The scraps for this layer say: a tenant is not a place where the mail lives, it is the person who can change the locks.

The grant, read¶

The first scrap is Microsoft’s own description of what the Home had. Microsoft provides Business Basic as the primary cloud grant offer, and eligibility “is validated by Microsoft’s third-party validation supplier, using Microsoft’s eligibility criteria, publicly available information, locally relevant records, and details submitted during registration”. Two sentences further down, the eligibility page says that “Microsoft reserves the right to grant or deny an organisation’s application or participation at any time, for any reason”, and that granted licences “are only permitted for paid employees and unpaid executive staff”. Volunteers get discounted licences, not granted ones.

That last line was news to the finance team, who had counted the volunteers among the free seats. The line above it was news to everyone. The tenant that held the exports of 200,000 donor records sat on a licence that its landlord could withdraw at any time, for any reason, with a validation partner in between whose name the Home did not know. Nobody at the Home had done anything wrong. The relief the finance team had cried with was, read in full, a licence to occupy.

Where the tenant lives¶

The second scrap is the region. Microsoft’s EU Data Boundary is the commitment to “store and process Customer Data and personal data” for Microsoft 365 inside a geographically defined boundary, for tenants provisioned there, “subject to limited circumstances where Customer Data, personal data, and Professional Services Data will continue to be transferred outside”. The Home’s tenant turned out to be an EU one, which nobody had known either way until the architect looked under the organisation profile. So the mail and the files sat in Europe, with the exceptions Microsoft lists, under a contract with a US company, on a grant that company could end. Where the data sits and who can reach it are two different questions, and the region answers only the first.

What a tenant is¶

Held up against the estate, the tenant turned out to be five things wearing one login: the identity provider, the mailbox, the file store, the chat, and the licence that made the other four exist. The Entra ID audit found the tenant’s contents to be a palimpsest of good intentions, and one of the two Global Administrators to be a member of the previous IT team who had left during a difficult period. That account could still change the locks. Recovery ran through the tenant as well: the address that would recover the registrar, the CRM and the bank was a mailbox inside it, on the one name the donors write to, whose zone held the tenant’s records and nothing else. The naming page is where that name became two.

So the designation question for this layer had a short answer. If Microsoft’s compliance desk, or its validation partner, or a list somewhere, ended the Home’s tenant, the Home would lose its mail, its files, its chat, its logins and the means of recovering any of them, in one afternoon, and would find out by the mail stopping. The move was about there being no single landlord with every key.

The landlord that was looked at¶

openDesk came first, because it is the one European suite that arrives as a whole: Nextcloud for files, Collabora for documents, Open-Xchange for mail, Element for chat, OpenProject, XWiki, and Univention’s Nubus for identity, developed by ZenDiS GmbH, a publicly funded company of the German federal government, commissioned by the Federal Ministry of the Interior. Its own page says what it is for: “the customisable office and collaboration suite designed specifically for your needs in public administration”. The Home is a charity with a basement, not an administration, and openDesk is sold to authorities. It went into the notes as the answer for a Home that was a ministry, and stayed there.

The one it went to¶

The files, calendars and contacts went to a managed Nextcloud. The software is made by Nextcloud GmbH in Stuttgart. The instance is a Storage Share from Hetzner Online GmbH of Gunzenhausen, hosted in Hetzner’s own datacentre in Falkenstein, with an unlimited number of users, no minimum contract period, and a data processing agreement under Article 28 generated from the customer console. The mail, the identity and the chat each got their own landlord, on their own pages. Four contracts, and no landlord holding a key to the mail or the chat.

What that cost the Home is the thing a tenant hides. Under one landlord, the mailbox, the file share and the login had come free with each other. Under four, each has to be paid for, administered and recovered on its own, and the architect keeps a list of which is which. The finance team cried a third time, briefly, and then did the sums.

The lease¶

   before                                   after

   ┌────────── one tenant ──────────┐       identity ── the Home's own, on a Hetzner machine
   │ identity  mail  files  chat    │       mail ────── one provider
   │ licence: a grant, revocable    │       files ───── managed Nextcloud, Falkenstein
   │ admin: two, one departed       │       chat ────── one provider
   └────────────────────────────────┘       each paid, each recoverable on its own

Not sovereignty, which the Home could not afford if it wanted it. A lease it has read.

What could go wrong?

Microsoft or its validation partner revokes the Home’s nonprofit eligibility, and the tenant becomes a bill the Home cannot pay, then a suspended tenant.
A compliance decision at the landlord suspends the tenant outright, and mail, files, chat and the logins go at once.
The departed Global Administrator’s credentials are used, and the locks change without anyone at the Home touching them.
The EU Data Boundary’s listed exceptions turn out to cover the data that the Home cared about most.

The tenant is gone, what now? Under one landlord: nothing, until the mail comes back. Under four: the mail still arrives, the files are still on the Nextcloud, the chat still works, and the logins still resolve, because none of them lived in the box that closed. The recovery address for each of the four is at a fifth place that none of them runs.

Granny Weatherwax has never rented anything in her life. The cottage was there before her and will be there after, and the only landlord it answers to is the weather.