Microsoft Cloud for Sovereignty

Data sovereignty is the concept that data is under the control of the customer and governed by local law. While data residency ensures that data stays in a specified geographical location, data sovereignty makes sure that data adheres to the regulations of the country where the public sector customer is located.

Every government has a unique view and requirements when addressing their sovereignty needs and requirements. Microsoft believes that many of these requirements are addressed through our public cloud offerings. Microsoft Cloud for Sovereignty provides an additional layer of policy and auditing capabilities that will address individual public sector and government customer needs.

The Sovereign Landing Zone (SLZ) deploys and configures various Azure resources in a manner that aligns with the enterprise-scale landing zone—which is part of the Cloud Adoption Framework (CAF) best practices—and provides appropriate guardrails an organization can configure to help achieve their data sovereignty requirements. For a detailed overview of an SLZ and its capabilities, see the Sovereign Landing Zone documentation on GitHub.

Microsoft Cloud for Sovereignty will be generally available on December 14, 2023. Discover how government customers worldwide are using the powerful capabilities of the Microsoft Cloud to meet sovereignty requirements and start your journey by visiting Microsoft Learn.

Sovereign requirements vary dramatically by country. As such, Microsoft will work with local in-country partners to tailor and customize Microsoft Cloud for Sovereignty for individual customers while also ensuring maximum re-use for benefits of scale and secure implementation. The Sovereign Landing Zone will aggregate requirements and best practices to benefit future countries and customers.

Sovereignty requirements vary dramatically by country, by data classification, and sometimes even by workload. Your Microsoft account team or partner can help you determine which elements of Microsoft Cloud for Sovereignty might help you meet your requirements.

Governments around the world have varied preferences on sovereignty and residency. For some customers, in-country residency is not a pre-condition to sovereignty. Anyone can use our sovereign controls anywhere in the world, even if they don’t have an in-country hyperscale region. Our hybrid cloud options can be deployed anywhere as well.

Each jurisdiction has its own classification requirements, and no blanket statement can be made about what data classifications are applicable for Microsoft Cloud for Sovereignty without local domain understanding. Our approach with Microsoft Cloud for Sovereignty is to provide a menu of capabilities and then empower partners and customers to determine what is appropriate for their specific needs. For the most sensitive workloads that cannot be hosted in the public cloud, we offer hybrid options that enable customers to keep the data on their premises.

Microsoft provides detailed information about data residency in the Microsoft Cloud through its documentation and the Microsoft Trust Portal. Additional measures to maximize data residency have been announced under the EU Data Boundary.

Microsoft commits to challenge every government request for public sector or enterprise customer data where there is a lawful basis for doing so. This includes any request under the CLOUD Act. In addition, to strengthen customer privacy and data security, Microsoft makes available a variety of tools that provide customers with additional control over their data. For example, when Azure confidential computing is enabled and properly configured, Microsoft is not able to access customer data in-use.

No. The CLOUD Act amends US law to make clear that law enforcement may compel US-based service providers to disclose data that is in their “possession, custody, or control,” regardless of where the data is located. This law, however, does not change any of the legal and privacy protections that previously applied to law enforcement requests for data—and those protections continue to apply. Microsoft adheres to the same principles and customer commitments related to government demands for user data.

In the first half of 2022, Microsoft received 5,560 legal demands for consumer data from law enforcement in the United States. Of those, 96 warrants sought content data, which was stored outside of the United States.

In the same time frame, Microsoft received 41 legal demands from law enforcement in the United States for commercial enterprise customers who purchased more than 50 seats. Of those demands, there were no disclosures of content data related to a non-US enterprise customer whose data was stored outside of the United States. For more information, visit Law Enforcement Request Report | Microsoft CSR.

Visit Microsoft Learn to explore documentation and how-to articles that help you make the most of Microsoft Cloud for Sovereignty.