Microsoft 365 without Teams: choosing a self-hosted chat platform

Keeping Microsoft 365 and replacing only Teams chat

If your Microsoft 365 renewal no longer includes Teams, or you have decided to keep the suite and move chat elsewhere, a self-hosted chat platform can sit beside Microsoft 365 and sign users in through Entra ID. The main candidates are Mattermost, Rocket.Chat and Matrix with Element, and the right one depends on the constraint you must meet, not on a feature checklist. The change behind this decision is that, effective April 1, 2024, Microsoft introduced Microsoft 365 and Office 365 suites without Teams outside the EEA and Switzerland, and existing suites with Teams are no longer sold to new subscribers worldwide. Confirm with your Microsoft account team which SKU and region your contract uses, because the Teams-free suite is not offered in the EEA and Switzerland under that change.

Start by listing the constraints that rule options in or out: data residency, whether chat must run fully disconnected, how many users need single sign-on, and whether you need compliance export or high availability. Mattermost gates SSO, AD/LDAP sync, clustering and compliance export behind paid plans, while Rocket.Chat's free Starter plan includes single sign-on for up to 50 users. Matrix with Element is the option to examine when federation or end-to-end encryption across organizations matters. Ask each vendor in writing which features your user count and deployment model require, and map those answers to your renewal calendar.

Keep Entra ID as the identity source for the suite, then confirm that the chat platform's SSO method (SAML, OIDC or another supported protocol) works with your tenant before you commit to a product. Also decide early how you will handle chat history from Teams: if you need to keep it, the export path depends on admin-approved Microsoft Graph permissions and an active Teams license on each exported user, so check that while the licenses still exist. Plan the work as a sized, written scope before the first install, because the identity, hosting and data steps differ by product.

What the Microsoft 365 constraint requires from chat

Keeping Microsoft 365 while dropping Teams means chat has to sign in with the same identity, keep its own history, and link into Outlook and SharePoint instead of living inside them. The cards below are the checks that connect those needs to the platforms in this comparison.

Single sign-on with Entra ID

Chat should authenticate against Entra ID through OIDC or SAML so joiners, leavers and MFA policy stay in one directory. Mattermost SSO (SAML, OIDC, OAuth) is included from the Professional plan, not in the free Team Edition. Rocket.Chat Starter includes single sign-on for up to 50 users, and Synapse supports OIDC and SAML2. Confirm the connector and plan price in writing before you choose.

Retention and export of history

Teams history does not leave with the license unless you extract it, and Microsoft's Teams Export APIs require an active Teams license on each exported user. Plan the export window before the license lapses. Decide retention for the new platform up front, and check whether the free tier caps message history. Mattermost Entry caps channel history at 10,000 messages, so an archive of older chat may need to live elsewhere.

Links into Outlook and SharePoint

Without Teams, chat cannot host native tabs for SharePoint libraries or Outlook calendars. Instead, plan links: meeting invites that point to the chat channel, and file references that open documents in SharePoint or OneDrive. Confirm that the platform's link previews and file handling work with your Microsoft 365 sharing policies, and test with guest accounts before rollout.

Storage behind high availability

Multi-node Mattermost clusters need shared file storage on Amazon S3, an S3-compatible service or NAS mounted on each node. Local file storage will not work correctly and risks corrupting files. Clustering itself is an Enterprise or Enterprise Advanced feature. Ask who owns that storage tier, how it is backed up, and whether it sits inside your own data boundary.

Federation and identity boundaries

Matrix federation is on by default across other servers, so an identity and domain decision comes before rollout. Synapse uses federation_domain_whitelist to restrict federation to listed domains, and an empty list disables it. Document which domains may federate, and firewall the federation listener as the docs recommend. This matters most when chat must stay inside a Microsoft-free, controlled network.

An upgrade cadence the team keeps

Chat platforms age quickly, and falling behind has consequences. Rocket.Chat standard releases get 6 months of support and LTS releases 12 months, and unsupported versions can lose connection to official mobile and desktop clients. Mattermost ships monthly, so choose the ESR line if you want a slower change rate. Assign an owner for upgrades and test them against your SSO and storage setup before each cutover.

How Mattermost, Rocket.Chat and Matrix with Element meet the constraint

Mattermost is an open core, self-hosted platform written in Go and React that runs as a single Linux binary with PostgreSQL as its database. Its licensing is split: compiled binaries are MIT licensed, the source code for custom builds is under AGPL v3.0 with a commercial alternative from Mattermost, Inc., and admin tools and configuration files are under Apache 2.0. Team Edition is free and aimed at teams under 250 users that do not need single sign-on, so a Microsoft 365 shop that wants Entra ID login has to look at a paid plan.

SSO by plan: SAML, OIDC and OAuth single sign-on and AD/LDAP user sync are included from the Professional plan, so Entra ID integration is a paid-plan item.
High availability: Clustering with redundant application servers, database servers and load balancers is limited to Enterprise and Enterprise Advanced.
Shared storage: A cluster needs Amazon S3, an S3-compatible service or NAS mounted on every node, because local file storage risks corrupting files.
Scaling reads: Database read replicas and search replicas distribute reads, while writes go to the primary database.
Main trade-off: Mattermost is the simplest of the three to operate, but the features most regulated buyers ask for sit behind a commercial subscription.

Confirm current plan contents and seat pricing directly with Mattermost, since its pricing page lists no public prices and directs buyers to sales.

Side-by-side fit for a Microsoft 365 shop

This table compares Mattermost, Rocket.Chat and Matrix with Element on the points that matter once Teams is removed from a Microsoft 365 contract: how users sign in with Entra ID, free tier limits, high availability, migration tooling and upgrade effort. Read each row as a question to put to the vendor or your own architects, since several answers depend on the edition you choose.

Criterion	Mattermost	Rocket.Chat	Matrix with Element
Entra ID sign-on path	SSO via SAML or OIDC is included from the Professional plan; confirm the Entra ID setup with Mattermost	SAML and SSO are in paid plans; the free Starter plan includes SSO, confirm the Entra ID configuration	Synapse supports OIDC, SAML2 and CAS; Matrix Authentication Service can federate upstream identity providers
Free tier limits	Team Edition is free for teams under 250 users without SSO; Entry caps history at 10,000 messages	Starter is free for up to 50 users with LDAP, AD, SSO and MFA; Community allows up to 100 concurrent users	Synapse is free under AGPL-3.0; Element Server Suite Community is free, with Pro and Sovereign editions paid
High availability requirements	Requires Enterprise or higher; needs shared storage such as S3 or NAS on each node, not local disk	Three-member MongoDB replica set recommended; multi-instance designs require a paid plan	Scaling uses worker processes with Redis for replication; PostgreSQL is recommended for production
Slack or Teams migration tooling	Slack migration via mmetl and mmctl; Teams data needs conversion to bulk import format	Imports full Slack exports and CSV files; Teams data must be converted to CSV first	No Teams or Slack importer is supplied in the researched facts; confirm with Element and the community tools
Upgrade burden	New server release monthly; ESR v11.7 supported to 2027-05-15; confirm your upgrade window	Standard releases supported 6 months, LTS 12 months; unsupported versions lose client connectivity	Upgrades may change database schema and rollback can be hard; check Synapse upgrade notes each release
Questions to confirm with the vendor	Entra ID SSO setup, Professional plan seat pricing and S3 storage design	Plan needed for Entra ID group mapping and multi-instance designs	Commercial licensing, Teams import options and Entra ID mapping for spaces

Deploying chat beside Microsoft 365 under Entra ID

This sequence takes a chat platform from edition selection to a tested, backed-up and upgradable deployment that signs users in with the organization's existing Entra ID accounts. It keeps Microsoft 365 for mail, calendar and files while the chat server runs in your own infrastructure.

Confirm the edition that includes single sign-on
Your team confirms which edition covers the identity features it needs before any build work starts. For Mattermost, the pricing page places SSO (SAML, OIDC, OAuth) and AD/LDAP sync from the Professional plan, and Team Edition is aimed at teams under 250 users that do not need SSO. For Rocket.Chat, the free Starter plan includes single sign-on for up to 50 users, and the paid plans add SAML user group mapping. Ask the vendor to confirm in writing which plan covers SSO, sync and any high availability needs at your user count. The output is a signed edition decision with its license terms on file.
Register the chat application in Entra ID
Your identity administrator creates an enterprise application in Entra ID for the chat server and records the redirect URI, client identifier and tenant details that the chat product issues. Limit assignment to the security group of licensed users so that only intended accounts can sign in. Both Mattermost's SAML guide and Matrix Authentication Service's upstream identity provider guide describe the setup, so confirm which protocol your chosen product supports in its current release. The output is a registered application with documented endpoints and a test sign-in from one pilot account.
Configure SAML or OIDC on the chat server
Your platform engineers enter the Entra ID values into the server configuration and map claims for username and email. Mattermost supports SAML and OIDC on its paid tiers, Rocket.Chat supports SSO and SAML on its plans, and Synapse accepts OpenID Connect providers through the oidc_providers setting, SAML2 through saml2_config and CAS. Decide whether local password logins remain enabled as a break-glass path and document who holds those credentials. The output is a server that redirects to Entra ID for sign-in, with one tested login per role and the break-glass account verified separately.
Set up the database tier
Your database administrators provision the database that the chat product requires. Mattermost uses PostgreSQL. Synapse recommends PostgreSQL for production and needs version 14 or newer from release 1.143.0. Rocket.Chat 8.x requires MongoDB 8.0 or later running as a replica set, and a three-member replica set is strongly recommended for high availability. Confirm the database versions against each product's current requirements before installation, since upstream end-of-life dates change. The output is a reachable, backed-up database with replication confirmed for Rocket.Chat and a documented connection string for the application team.
Place shared file storage for any Mattermost cluster
If you plan a Mattermost high availability cluster, your storage team provides shared file storage that every node can mount, such as Amazon S3, an S3-compatible service or a NAS. Mattermost states that local file system storage will not work correctly in a cluster and risks corrupting files. High availability is available only on the Enterprise and Enterprise Advanced plans, so confirm that tier before buying storage capacity. Rocket.Chat's reference architectures use a single instance up to 500 concurrent users, and multi-instance designs require a paid plan. The output is shared storage mounted identically on every node, with a test upload visible from each application server.
Add links into Outlook and SharePoint
Your Microsoft 365 administrator and chat administrator agree on the links that users will see: a chat link in Outlook signatures or meeting invitations, and a pinned chat address in SharePoint team sites where project documents live. The chat platform's own integrations and bots must be checked separately, because the migration guidance for Slack states that integrations do not carry over and similar limits may apply to other sources. Confirm whether your chosen product offers any calendar or document connector on your plan, and plan manual links where it does not. The output is a short, approved list of links with owners, tested by opening each from Outlook and SharePoint.
Test, back up and schedule upgrades
Your operations team runs a pilot with a small group, tests sign-in failure and account removal in Entra ID, and restores a backup into a separate environment to prove recovery. Schedule upgrades against the vendor's release cadence: Mattermost publishes server releases on the 16th of each month and marks some releases as Extended Support Releases, and Rocket.Chat supports standard releases for 6 months and LTS releases for 12 months. Unsupported versions can also lose connection to official mobile and desktop clients, so an upgrade calendar is part of operating the platform. The output is a passed restore test, a written upgrade calendar and a runbook that names the owner for each task.

Evidence that the chat stack meets your controls

A security or compliance reviewer will ask for proof, not design intent. The artifacts below connect the identity, licensing, data retention, recovery and administration decisions behind a self-hosted chat platform that replaces Teams chat while Microsoft 365 stays in place. DeployOpen prepares this evidence, and independent auditors issue any assessment.

SSO configuration and sign-in logs

Capture the identity provider configuration for the chat platform, including the Entra ID application, the SAML or OIDC settings, and the attribute mapping for user and group claims. Keep sign-in test records from named accounts in each role, and show that a disabled Entra ID user loses chat access. Mattermost lists SSO from its Professional plan, while Rocket.Chat lists SSO on its Starter plan, so confirm the tier your configuration depends on. Ask for a dated test log, not a screenshot of the settings page.

License file and edition in use

Record the exact edition, plan and license file deployed, because the controls you can claim depend on it. Mattermost Team Edition, Entry, Professional, Enterprise and Enterprise Advanced differ in SSO, clustering, compliance export and air-gapped support, and Rocket.Chat's Starter, Commercial, Government and Defense plans differ in the same way. Confirm the license terms against the repository license for each component, since the code under some directories uses a separate enterprise license. Keep the file with the change record for every edition change.

Retention and export settings

Document the message retention period, file retention rules and the export procedure your organization will use for legal hold and departing users. Microsoft 365 retention policies do not apply to a self-hosted chat server, so the platform's own retention configuration becomes the record. Test an export from a private channel and a direct message, then confirm the output opens and contains the expected content. Mattermost Entry caps channel history at 10,000 messages, so check whether the edition you run has that limit before you set retention targets.

Backup and restore test records

A backup that has never been restored is not evidence. Record each restore test with its date, the database and file store restored, the time to a working chat, and the named person who verified message and attachment integrity. For Mattermost high availability, include the shared file store on Amazon S3, an S3-compatible service or NAS, since local storage on each node risks file corruption. For Rocket.Chat, include the MongoDB replica set members. Repeat the test after every major upgrade.

Upgrade and end-of-life register

List each deployed component with its current version, its support end date and the owner of the next upgrade. Mattermost publishes monthly server releases and an Extended Support Release line, and Rocket.Chat standard releases receive support for 6 months while LTS releases receive 12 months. After end of life, a version receives no security fixes and may lose connection to the official mobile and desktop clients. Review the register at a fixed interval and record each decision to upgrade or accept risk.

Admin access review

Keep a current list of every account with server, database, object storage and workspace administrator rights, and review it on a set schedule with a named approver. Include the operating system and Kubernetes or Docker access that can reach the database, since those paths bypass application roles. Remove accounts for staff who have left, and record the date of each removal. Confirm that privileged actions are logged and that the logs are kept outside the chat server.

Questions buyers ask before hiring a deployment partner

What drives the cost of a self-hosted chat platform after dropping Teams?

The cost is set mostly by the edition you choose, where it runs, and who operates it. Mattermost sells Professional, Enterprise and Enterprise Advanced as prepaid annual subscriptions based on seat licenses, and its pricing page lists no public prices, so you must request a quote. Rocket.Chat prices its Commercial, Government and Defense plans by quote as well. Cost components include the licence or subscription, servers or cloud resources, database and file storage, backups, and the staff time for upgrades, monitoring and user support. Ask any vendor or partner for a written breakdown that separates one-time work (planning, configuration, migration) from recurring items (subscriptions, hosting, upgrades, support).

Can our IT team run a self-hosted chat platform without an outside partner?

Often yes, if you have people who can operate a Linux service, PostgreSQL or MongoDB, a reverse proxy, backups and a regular upgrade routine. The harder parts are identity integration, high availability and keeping up with releases. Mattermost high availability requires redundant application servers, database servers and load balancers, plus shared file storage on Amazon S3, an S3-compatible service or NAS on each node, and it is limited to the Enterprise and Enterprise Advanced plans. Rocket.Chat 8.x requires MongoDB 8.0 or later as a replica set. Score your team against these items honestly, and consider a retainer for upgrades if the in-house capacity is thin.

How long does a deployment take, and what changes the timeline?

No supplied figure gives a standard duration, so treat any number from a vendor as a claim to verify. The timeline depends on scope: a single-region pilot with one identity provider differs from a multi-site rollout with high availability, data migration from Teams, and integrations with Outlook and SharePoint. Other drivers include the size of the Teams history you must move, the number of channels and users, the approval cycle for admin-approved Graph permissions, and network change windows. Ask for a written scope with phases, deliverables and dependencies on your side, and confirm which steps are fixed before work begins.

What do Entra ID and network administrators need to provide?

Plan to involve your Entra ID administrators for the application registration, the SSO protocol setup, and the group or attribute mapping that decides who can sign in. Mattermost lists SSO through SAML, OIDC and OAuth from its Professional plan, and AD/LDAP sync from the same tier, so confirm the edition matches your need. Network administrators must publish the chat hostname over TLS, open the required paths, and plan DNS and certificates. If you run Synapse for Matrix, federation uses port 8448 by default, and the docs recommend firewalling the federation listener if you do not federate. Get the exact ports, redirect URIs and certificate requirements in writing from your chosen platform before the first change request.

Can we export our Teams chat history before the license ends?

Yes, but only with the right setup. The Microsoft Graph Teams Export APIs return 1:1, group, meeting and channel messages, along with meeting recording and transcript links. They use admin-approved application permissions and require an active Teams license on each user being exported. That means the export should run while licenses are still active, so plan the extraction window before you remove any Teams seats. Ask your partner to confirm how they will handle users who have left the organization, and to document what was exported and what could not be retrieved.

Does a fixed-scope engagement exist for this kind of work?

Yes. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen does not publish a price list, and a quote follows from the written scope. Ask for the list of deliverables, the acceptance criteria, what is excluded, and which costs you pay directly to software vendors.

Which compliance evidence does a self-hosted chat platform produce?

A self-hosted platform gives you control over where messages, files and logs live, but it does not certify anything by itself. DeployOpen prepares systems, controls and evidence for compliance assessments, while independent auditors and certification bodies issue any audit report or attestation. Useful evidence includes access reviews tied to SSO, retention settings, backup and restore test records, patch and upgrade logs, and audit trails. Rocket.Chat lists tamper-evident audit trails in its paid plans, and Mattermost lists compliance export in its paid tiers. Confirm with your assessor which control evidence they expect before you design the platform.

Why does the Rocket.Chat or Matrix choice change the work involved?

Each platform changes the integration and operations work. Rocket.Chat imports Slack exports through its admin import tools and recommends splitting large exports into files under 15 MB, but it has no built-in Teams importer, so Teams history must be converted to CSV first. Matrix with Synapse expects PostgreSQL 14 or newer for recent releases, Redis for workers at scale, and careful planning for server_name and federation settings, and its upgrade notes warn that rollback can be difficult. Compare the operational load of each stack against your team's skills before choosing.

What happens to Teams history when chat moves

Teams history does not move on its own. It has to be pulled out of Microsoft 365 with the Microsoft Teams Export APIs in Microsoft Graph, which return 1:1, group, meeting and channel messages along with meeting recording and transcript links. The export runs under application permissions that a Microsoft 365 administrator must approve, and the users whose content is exported must hold an active Teams license. That second condition matters for this topic: if you drop the Teams license before the export finishes, the content of those users may not be retrievable. Confirm the license and permission requirements in the Microsoft Learn documentation for your tenant before you cancel anything.

Once extracted, the content is loaded into the chat platform through its own import route. Slack importers are a useful example of how these routes work: Mattermost converts a Slack-format export with mmetl, and Rocket.Chat imports Slack exports through its administration console. Neither importer reads Teams data directly, so the Teams export must be converted into a format the target accepts. Ask your implementation partner which intermediate format they will use, how user identities will be matched to accounts in your directory, and what happens to threads, attachments and reactions. Confirm each of these against the current documentation of the platform you choose.

The details of each route belong on the sibling migration pages, so this section sets the decisions to make early. Decide who approves the Graph permissions, which users are in scope, and how long the extraction window must remain open. Also decide whether the history is migrated, archived in read-only form, or left in Teams for a defined retention period. Each choice affects the license you keep and the work that recurs after cutover.

How DeployOpen works on this

DeployOpen plans, implements and hardens self-hosted chat inside your own infrastructure, so Microsoft 365 can stay in place while chat moves to a platform you control. We start from your identity, file and retention requirements, then build and document the chosen platform in your cloud account, data center or air-gapped network.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
We map which Microsoft 365 links you need in Outlook and SharePoint, and which can be handled as shared links rather than integrations.
We confirm Entra ID single sign-on requirements, user counts and the edition needed for SSO before choosing Mattermost, Rocket.Chat or Matrix.

How we build

We deploy the chosen platform in your environment with its database, file storage and reverse proxy configured for your network.
We configure single sign-on against Entra ID and test login, role mapping and account deprovisioning with your identity team.
We test backup, restore, retention settings and upgrade paths, and record the results before any users are onboarded.

How we hand over

You receive architecture notes, configuration records, runbooks and the test evidence collected during the build.
We document the Microsoft 365 integration points, including which SharePoint and Outlook links remain and how they are maintained.
We walk your administrators through daily operations, upgrade steps and the decisions your team must keep owning after handover.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover version upgrades on the platform's release cycle, so your team is not left on an unsupported build.
We prepare systems and evidence for compliance assessments, while independent auditors and certification bodies issue any attestation.