Will EU and EFTA customers gain full offline AI and data access control via Microsoft's new sovereign cloud features?
New Microsoft Sovereign Cloud features give EU and EFTA customers more control over data access and enable fully offline AI operations.
Key points
- Data Guardian and Production Touch Ledger provide oversight of remote engineer access.
- Foundry Local and GitHub Enterprise Local allow AI model execution without internet connectivity.
- Sovereign Control Panel enters public preview at the Ignite conference in November.
Microsoft announced new capabilities for its Sovereign Cloud offering, targeting government agencies and regulated enterprises in the European Union and the European Free Trade Association. CEO Satya Nadella revealed the changes in Paris, emphasizing expanded choice and control for organizations managing sensitive workloads across public and private cloud environments.
Root cause
The initiative addresses growing European concerns regarding reliance on US-based cloud providers. Microsoft first launched its Sovereign Cloud in June 2025 to meet these specific regulatory and sovereignty requirements. Douglas Phillips, who leads the company’s specialized clouds unit, stated that their approach to digital sovereignty begins with the workload itself.
Attack path
This is not a security breach but a feature expansion. Microsoft is rolling out Data Guardian, which allows a trusted European partner to oversee remote logins by Microsoft engineers to customer production systems. Production Touch Ledger will maintain immutable records of such access events, ensuring any unauthorized changes are detectable.
Affected versions
The Sovereign Control Panel enters public preview at the Ignite conference from 17 to 19 November in San Francisco. Foundry Local and GitHub Enterprise Local become generally available at the same event. SQL Server on Azure Local is now generally available, while Microsoft 365 Local remains in preview for approved customers.
Mitigation
Customers can now retain the master key protecting their data on their own hardware instead of storing it with Microsoft. Most new tools operate on Azure Local, which resides in the customer’s data center. Systems will also support switching between connected and disconnected modes to maintain operational continuity.
What it means for organisations
Leaders should review current data residency policies and verify that new sovereign controls align with internal compliance requirements. IT teams need to assess whether local hardware can support offline AI tools like Foundry Local. Procurement should evaluate partner ecosystems, such as the listed European vendors, to ensure supply chain resilience. Executive sponsors must understand how master key retention shifts liability and operational responsibility away from the cloud vendor.
What to do and how to stay safe: Microsoft
- Verify that your organization qualifies for Sovereign Cloud features in the EU or EFTA regions.
- Plan hardware upgrades if you intend to run Azure Local or offline AI models on-site.
- Review access logs and partner oversight agreements once Data Guardian is available.
- Monitor the Sovereign Control Panel preview for gaps in your current system configurations.
Step-by-step guide: Identity and Access Management System: How It Controls Cloud Access
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who announced the new sovereign cloud capabilities?
Microsoft CEO Satya Nadella announced the changes in Paris, with details provided by Douglas Phillips.
When does the Sovereign Control Panel become available?
It enters public preview at Microsoft’s Ignite conference, which runs from 17 to 19 November.
Which partners are involved in the sovereign cloud effort?
Microsoft listed 29 partners, including Bleu, Delos Cloud, Mistral, Nvidia, and Dell.
