Which Skype for Business Server alternative works on an air-gapped network
On an isolated network, the two self-hosted options with a documented air-gapped path are Mattermost Enterprise Advanced and Element Server Suite Sovereign. Mattermost lists air-gapped deployment as a feature of its Enterprise Advanced plan, and Element offers its Sovereign edition of Element Server Suite for air-gapped deployments. Both are paid tiers, so air-gapped support should be treated as a licensing decision before it is treated as a technical one. The free editions cover chat on a connected network, but the air-gapped capability sits in the commercial plans, and you should confirm the exact entitlements in writing with each vendor before you size the project.
Mattermost is a single Linux binary backed by PostgreSQL, so an offline install means moving the binary, its dependencies and the database packages across the boundary as a verified set. Element Server Suite Sovereign bundles the Synapse homeserver and Element clients for Matrix, and its voice and video depend on Element Call, which you should confirm works from offline media in your environment. For meetings, Jitsi runs on your own servers and can be installed from offline packages, but you must check every container image, package and web asset that Jitsi pulls during setup. Plan a separate, documented transfer process for each component, and ask each vendor how they deliver updates to disconnected systems.
Because nothing can be fetched from the internet, each update is a transfer decision. Ask each vendor for the offline update procedure, the release notes for every version you intend to carry, and the checksums or signatures you will verify before loading media into the enclosure. Confirm the support window for the version you deploy, since it determines how often you must move a new release across the boundary. Certification status for classified use is a separate question. Neither product should be assumed accredited, so confirm with your accreditation authority and the vendor which configurations, if any, have been evaluated for your network.
What an air-gapped constraint requires from a chat platform
On a disconnected network, the chat platform must be installable, run and patched without reaching the internet. Each requirement below is a check you can apply to Mattermost, Element Server Suite or any other candidate before you commit to a design.
Offline installation from media
Every binary, container image, database package and dependency must arrive on approved media and install without a package manager reaching external mirrors. Ask each vendor which edition includes the offline installation documentation and whether the air-gapped option is licensed separately. Mattermost lists air-gapped deployment in Enterprise Advanced, and Element offers a Sovereign edition for air-gapped deployments. Build a manifest of every artifact before the install window opens.
No runtime dependency on external services
Check whether the server calls out for licence validation, telemetry, push notifications, font or script CDNs, email relays, or time sources at runtime. Any outbound call that fails silently can break login or messaging in ways that only show up during an incident. Test the platform with egress blocked at the firewall and with DNS resolving only internal names, then record every failed connection attempt.
Offline updates with verified packages
Each update must be verified for integrity and authenticity before it crosses the boundary, which is the control behind NERC CIP-013-2 for utilities and a sound practice for any classified network. Record the hash, signature and source of every package, and keep the previous release available for rollback. Mattermost publishes a new server version on the 16th of each month, so plan a recurring transfer cycle and confirm which releases your edition supports.
Authentication against the internal directory
Chat must sign users in against Active Directory or another internal identity provider, because Skype for Business users already depend on it. Confirm whether the edition you choose includes SSO and AD/LDAP sync, since Mattermost includes both from the Professional plan. Synapse supports OpenID Connect, SAML2 and CAS. Test account disablement, group changes and certificate chains inside the isolated network, not after cutover.
Data residency and retention controls
Messages, files and metadata should stay on storage you control, with retention and deletion rules you can prove. Confirm where attachments are stored in a clustered deployment, since Mattermost requires shared storage on each node and local file system storage will not work correctly. Decide retention before migration so that history from Skype for Business persistent chat is not lost or kept longer than policy allows.
Frameworks to confirm for your environment
Whether NERC CIP-005-7 applies depends on whether you operate BES Cyber Systems, in which case remote access to those systems must pass through an Intermediate System with encryption and multi-factor authentication. For defense contractors, confirm with your contracting office whether CMMC under 32 CFR Part 170 applies, and for cloud service providers serving federal agencies, confirm FedRAMP scope with your authorizing official. Your compliance lead should map these to the platform before design sign-off.
How Mattermost, Element, Rocket.Chat and Jitsi meet the air-gapped constraint
This table compares the editions of each chat platform against the air-gapped requirement, along with the free baseline editions used on connected networks. Read each row as a question to put to the vendor: which edition carries offline deployment, and what you give up on the cheaper tiers. The main takeaway is that air-gapped support is usually a paid edition feature, so the licensing decision comes before the architecture decision.
| Platform and edition | Offline deployment | Edition that carries it | Trade-offs to weigh |
|---|---|---|---|
| Mattermost Enterprise Advanced | Air-gapped deployment is listed for this plan on the pricing page | Enterprise Advanced, sold as prepaid annual seat subscriptions | Requires a contract for seats and support; confirm offline update delivery terms with Mattermost sales |
| Mattermost Team Edition (baseline) | Self-hosted and free, but air-gapped use is not listed as a feature | Free, open source, aimed at teams under 250 users without SSO | No SSO or AD/LDAP sync; plan a separate path for air-gapped licensing |
| Mattermost Entry (free commercial tier) | Not listed for air-gapped use | Free tier of the commercial build | Caps channel message history at 10,000 messages and has no compliance features or high availability |
| Element Server Suite Sovereign | Built for air-gapped deployments | Sovereign edition, distinct from the free Community edition | Confirm what Sovereign includes for Synapse updates, Element Call and client builds delivered offline |
| Element Server Suite Community (baseline) | Self-hosted under AGPL, suitable for connected networks | Free AGPL Community edition with Synapse and Element Call | Synapse federation is off-by-default in practice; set federation_domain_whitelist and firewall the federation listener deliberately |
| Rocket.Chat Government or Defense plans | Support for on-premises, air-gapped and sovereign deployments is listed | Commercial, Government and Defense plans | Free Starter excludes air-gapped use; SSO and directory features depend on the plan you sign |
| Jitsi (meetings only) | Self-hosted on your own servers, so it runs without internet access once deployed | Open source, no commercial edition required for the core stack | Not a chat product; pair it with one of the chat platforms above for presence and messaging |
Why Skype for Business dependencies are hard to remove on isolated networks
On an isolated network, the hard part of leaving Skype for Business is rarely the chat client. It is the set of dependencies the estate quietly relied on: Edge servers for remote and federated access, federation with partner organizations, public DNS and certificate paths, and any Microsoft-hosted services wired into presence, meetings or dial-in. An isolated network cannot reroute those dependencies to the internet, so each one has to be replaced by a component inside the enclave or removed by a documented decision. Start by inventorying every Edge, federation and external hostname in the current topology, then mark each as internal replacement, retired, or needing a sponsor decision.
Cloud Teams is not a neutral fallback for disconnected sites. Microsoft's licensing change, effective April 1, 2024, introduced Microsoft 365 and Office 365 suites without Teams outside the EEA and Switzerland, plus a standalone Teams offering, and existing suites with Teams are no longer sold to new subscribers worldwide. Whether a given tenant or contract can still reach Teams depends on the agreement, region and classification rules, so confirm eligibility with the licensing team and the authority to operate before treating it as a target. Your own network rules will also decide whether a cloud service is permitted at all.
Exporting history from a cloud tenant is a separate step to plan, not a byproduct of moving. The Microsoft Teams Export APIs in Microsoft Graph cover one-to-one, group, meeting and channel messages, and meeting recording and transcript links, but they use admin-approved application permissions and require an active Teams license on each user being exported. Ask whether the tenant still holds those licenses, who approves the permissions, and where exported records will be stored under the enclave's retention rules. Decide these questions before the isolated platform is built, because a license that lapses can end the export path.
How to deploy a chat stack on an air-gapped network
This sequence moves a chat server, its database and meeting components from an internet-connected staging area into a disconnected network, with each package verified and each release chosen deliberately so the stack runs and stays patchable without outbound access.
Choose the release and edition to carry in
The platform owner and the architect decide which chat edition, server version and database version the enclave will run. For Mattermost, confirm that air-gapped deployment is included in the edition you need, since the pricing page places it in Enterprise Advanced. Mattermost releases server binaries on the 16th of each month, and each version has its own support end date, so pick a version whose support window covers the time the enclave will run before the next planned transfer. Confirm the same for Matrix or Rocket.Chat, where air-gapped use is also tied to paid plans. Done when the version, edition and support end date are written into the change record.
Build the offline media set
The integration team, working on a connected staging network, collects everything the stack needs: server binaries or container images, PostgreSQL packages, the chat client packages, Jitsi packages and any operating system dependencies. If the chosen stack runs on Kubernetes, use kubeadm config images list and kubeadm config images pull to fetch the control plane images in advance, then push the workload images to a registry that will exist inside the enclave. Record a checksum and a source reference for every artifact. Done when the manifest lists every item, its version, its hash and its origin.
Transfer and scan packages across the boundary
Move the media set through your approved cross-domain or removable media process, and scan it on the inside before anything is installed. Verify each checksum against the manifest and run malware and vulnerability scanning on the packages and images. Keep a signed record of who verified what. This is the control that supports the software integrity and authenticity expectations in NERC CIP-013-2 for utilities, and similar supply chain expectations apply in other regulated sectors. Done when every artifact matches its manifest hash and the scan results are filed with the change record.
Install the database and chat server offline
The platform engineer installs PostgreSQL first, then the chat server, using only the internal repositories or registries. For Kubernetes, point kubeadm init at the internal registry with the --image-repository flag so no pull reaches the public internet. Set the server to use the internal database and the internal file store, and disable any setting that calls an external service such as push notification relays or telemetry. Done when the server starts, passes its health check, and a test user can send a message between two internal clients with no outbound connection.
Connect internal SSO or LDAP
The identity team points the chat server at the enclave's directory or identity provider. For Mattermost, SSO over SAML, OIDC or OAuth and AD/LDAP user sync are part of the paid Professional and higher plans, so confirm licensing before relying on them. For Synapse, the configuration manual documents OpenID Connect, SAML2 and CAS options, and an upstream provider such as the one in Matrix Authentication Service can front the login. Test sign-in, deprovisioning of a disabled account and group membership mapping. Done when a directory user signs in, a removed user is blocked, and the access results are logged.
Deploy meetings and presence components
Install Jitsi or the meeting component from the same offline media set, and configure it to use internal DNS, internal TURN relays where needed and the internal chat identity. Confirm that clients on the enclave network can join a meeting from a link with no call to an external STUN or TURN service. Verify presence behavior separately, since presence in the replacement platform may differ from Skype for Business. Done when two internal clients connect to a meeting with audio and video, and the network logs show no external destinations.
Set up a recurring offline update cycle
The operations team defines a repeatable cycle: check the vendor's release page for the next server version and its support end date, build a new offline media set, transfer and scan it, then apply the update in a test instance inside the enclave before production. Keep the previous database backup and read the upgrade notes first, because some releases change the database schema and rollback can be difficult. For Synapse, confirm the minimum PostgreSQL and Python versions in its upgrade notes before each move. Done when a dated update runbook exists, one update has been rehearsed in the test instance, and the next cycle has an owner.
Document evidence for the assessment
The compliance lead assembles the artifacts that show how the stack was built, transferred, configured and updated: the release decision, the manifest, scan results, configuration baselines, access test results and update records. DeployOpen can prepare these systems, controls and evidence for an assessment, but independent auditors or certification bodies issue any audit report or certification. Ask your assessor which evidence formats they accept before the first update cycle. Done when the evidence index maps each control your assessor cares about to a file in the enclave's document store.
How updates and licenses work with no internet connection
A disconnected network changes how software arrives, how it is checked and how it is licensed. The four cards below cover the workflow that moves packages across the boundary, the integrity checks that should happen before import, the licence questions to settle with vendors early, and the release cadence that sets your patching rhythm.
Obtaining update packages on approved media
Every update must be downloaded on a connected staging system, reviewed, and carried across on media your security policy approves. Build a repeatable transfer log that records what was downloaded, when, by whom and from which source. For Mattermost, the server ships as a binary that you can stage alongside its database migration notes. For Synapse, pull the release from the element-hq repository and keep the exact version with its Python and PostgreSQL requirements. Confirm with each vendor which artifacts they publish for offline use, including container images, dependency bundles and documentation.
Verifying integrity before import
Before any package enters the isolated network, check its checksum or signature against the value published by the vendor, and record the result in the change ticket. This is the control concept behind NERC CIP-013-2, which asks utilities to set supply chain procurement processes that address verification of software integrity and authenticity for vendor software and patches. Apply the same check to plugins, container images and Python or Go dependencies. Confirm with each vendor how they publish signatures and which key to trust, because that trust anchor must reach the offline side through a separate channel.
Licence keys and subscription validation
Commercial editions can depend on a licence check that expects internet access. Mattermost sells Enterprise Advanced, which includes air-gapped deployment, as an annual subscription based on seat licenses, so ask how seat counts are reported and renewed when the server cannot phone home. Element Server Suite Sovereign is designed for air-gapped deployments, so ask how its licence is activated and refreshed offline. Rocket.Chat's Government and Defense plans cover air-gapped use, so request the same answer in writing. Treat every offline activation method as something to confirm with the vendor before the cutover date is set.
Release cadence and ESR planning
Mattermost publishes a new server version in binary form on the 16th of each month, and its Extended Support Release track gives a longer window for regulated sites. Mattermost v11.7 is the ESR, released on 2026-05-15 with support ending 2027-05-15, which suggests a planning horizon for that branch. Standard releases such as v12.0 move faster, so an offline site must decide which track it follows and how many monthly drops it can absorb. Confirm the support window for your chosen track before you commit.
Rollback risk from schema changes
Rolling back a chat server after an upgrade is often harder than rolling forward, because database schemas change between releases. The Synapse upgrade notes warn that rollback can be difficult for this reason, so take a verified database backup before each upgrade and keep the previous package on the offline media. Plan a test restore in a staging enclave. Also watch for runtime support: Synapse drops Python and PostgreSQL versions once they reach upstream end of life, which forces an upgrade even when no feature is needed.
Questions buyers ask before replacing Skype for Business on an isolated network
What drives the cost of replacing Skype for Business on an air-gapped network?
The biggest drivers are the chat platform edition, the meeting stack, the database and file storage, and the staff time spent on offline update cycles. Mattermost air-gapped deployment is listed in its Enterprise Advanced plan, and Element Server Suite has a Sovereign edition for air-gapped use, so the license line is often the largest recurring item. Subscription licenses recur each year, while the build, integration and hardening work is usually one-time. Ask any vendor for its air-gapped edition price in writing, and ask for the update and support terms that apply when no internet connection is available. Your own costs also include Windows or Linux hosts, PostgreSQL, shared file storage for clustered Mattermost, and the people who package and verify each offline update.
Can our internal team run a self-hosted chat platform on an isolated network alone?
It is possible for a team with Linux, database and identity skills, but the workload is larger offline than online. Every package, container image and rule set has to be fetched on a connected system, checked for integrity and authenticity, carried across the boundary and installed, which is the kind of supply chain control NERC CIP-013-2 describes for utilities. Plan for an owner for each layer: the chat server, the database, identity integration, the meeting service and the update pipeline. Many organizations keep operations in-house and bring in an outside team for the initial build, hardening or documentation. DeployOpen implements, hardens, backs up, upgrades and documents self-hosted platforms inside the client's own network, and support is available as a retainer.
How long does a fixed-scope deployment take?
The duration depends on the scope, which is why DeployOpen agrees scope, deliverables and timelines in writing before work starts. The main variables are the number of users, whether single sign-on and directory sync are required, how many meeting rooms and dial-in paths must be rebuilt, the state of the isolated network's hosting platform, and how many approval steps your change process needs for each transfer. Ask for a timeline tied to named deliverables, including the parallel running period while Skype for Business and the replacement both operate. Do not accept a duration that is not tied to a written scope.
Does Mattermost air-gapped deployment require the Enterprise Advanced plan?
According to the Mattermost pricing page, air-gapped deployment is included in the Enterprise Advanced plan, while SSO and AD/LDAP sync start at Professional and high availability clustering starts at Enterprise. Mattermost Team Edition is free and open source, but it is aimed at teams under 250 users that do not need single sign-on, and it does not replace the features that Skype for Business administrators usually rely on for directory-based management. Confirm the current plan terms with Mattermost sales before you commit, since pricing is not published and plan features can change. Also confirm how the Enterprise Advanced license is validated when the server has no internet connection.
How do we migrate chat history from Skype for Business or Slack exports?
Slack history can be moved with an export. Mattermost converts a Slack export with mmetl into its bulk import format and loads it with mmctl, and users, channels, direct messages, threads and attachments move, while integrations, custom emoji images, user groups and Slack Connect channels do not. Rocket.Chat imports users, channels and messages from a Slack export and recommends splitting large exports into files under 15 MB. Skype for Business keeps conversation history in its own database, so the export path is usually a custom extraction from the SQL Server archive if your policy requires it. Confirm with each platform whether that history is kept in a readable format, and decide retention rules before any data crosses the isolated boundary.
What does Element Server Suite Sovereign add over the Community edition?
Element Server Suite Community is free under AGPL and includes Synapse and Element Call. The Pro edition adds Synapse Pro, and the Sovereign edition is the one built for air-gapped deployments. The pricing page describes these as separate editions, so confirm in writing which support, update delivery and offline packaging each one includes before you choose. Community can be run on an isolated network too, but the update process, the license terms and any vendor support for disconnected installs are your responsibility unless the Sovereign contract covers them. Ask Element for the update channel and support terms that apply to a disconnected environment.
What changes for users when the isolated network cuts over
Persistent chat rooms that lived in Skype for Business become channels in Mattermost or rooms in Matrix, and users have to find them under new names and new structures before they can post. Plan for that rename step in the user communication, not after the cutover. Presence works differently too: on an isolated network, presence and directory lookup depend entirely on the internal identity source you connect, such as Active Directory through LDAP or an OIDC or SAML provider. If a user is missing from that source, they will not appear in search, and their status will not update until the sync or login works. Confirm which identity source feeds the new platform and how often it syncs before you promise users that a colleague will be findable.
Meetings change the most visibly. Skype conferencing links will stop working, so every recurring meeting invite needs a new join link from the video service you deploy, typically Jitsi on the same network. Confirm how invite links reach calendars in your environment before cutover, because a link that works from one network segment may not resolve from another. Also tell users plainly that history does not follow them. Where Skype for Business chat was stored only on your own servers, you can migrate or archive it under your own controls. Any history held in a cloud service, including Microsoft Teams exports or Slack workspaces, is not moved automatically, and some sources expire data on their own schedule, so users should export what they need first, and you should confirm the export rights your licensing gives you.
Run the old and new systems in parallel for a defined window, long enough for users to move their regular conversations and meetings, and short enough that nobody keeps two chat tools indefinitely. Set the start and end dates in writing, state which system is authoritative for each kind of conversation, and announce the retirement date early. Use this window to test directory sync, meeting joins from every network zone that matters, and the export of retained records. The step-by-step cutover, including Active Directory sync, room conversion and the order in which to retire Edge and front end servers, is covered in the migration guides linked from this page, so follow those for the technical sequence.
How DeployOpen deploys chat and meetings under air-gapped constraints
DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including air-gapped networks. For a Skype for Business Server replacement, that means chat, presence and meetings are built and run entirely inside the disconnected environment, with every package and image carried across the boundary under documented control.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before any work starts.
- We inventory the chat, presence, meeting and federation features your Skype for Business estate actually uses, including Edge and telephony dependencies.
- We confirm which edition fits the air-gapped requirement, since Mattermost air-gapped deployment and Element Server Suite Sovereign are licensed as paid editions.
How we build
- We stage every container image, package and update in the enclave, then install Mattermost or Synapse with PostgreSQL and Jitsi on your hardware or private cloud.
- We wire SSO through your directory, configuring the identity integration Mattermost or Synapse supports in your environment and testing login before cutover.
- We harden the deployment, configure backups and document the procedure for verifying the integrity of each package carried across the isolated boundary.
How we hand over
- You receive architecture, runbooks, configuration records and the offline update procedure written for your own operators.
- We run acceptance testing for chat history, user sync, meetings and failover against the scope agreed in writing.
- We prepare the evidence and control documentation your compliance team needs, while independent auditors and certification bodies issue any formal assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- We plan each upgrade cycle around the vendor release schedule and re-verify the offline media before it enters the network.
- Ask any proposal to name the support hours, response expectations and upgrade responsibilities in writing before you sign.
