Microsoft: sovereign cloud controls ask who can reach your data

Oct 20, 2026 | Douglas Phillips - President and Chief Technology Officer, Microsoft Specialized Clouds

Microsoft · source 1

Today, we are sharing the next stage of that work.

Microsoft · source 1

Last year, we introduced Microsoft Sovereign Cloud to give customers more choice in how they address these requirements.

Microsoft · source 1

They also seek to understand who can access and operate their systems, how sensitive digital assets remain protected, which technology dependencies matter most and whether critical services can continue as regulatory, geopolitical, security or network conditions change.

Microsoft · source 1

Organizations are considering more than where data resides.

Microsoft · source 1

Across my conversations with leaders in government, critical infrastructure and regulated industries, one priority consistently rises to the top

Microsoft · source 1

providing a continuum of management, control and options across Sovereign Public Cloud, Sovereign Private Cloud and the Sovereign Partner Ecosystem

Microsoft · source 1

Sovereign Control Panel, entering public preview at Microsoft Ignite, brings these signals together in a unified Azure portal experience.

Microsoft · source 1

It helps organizations understand their sovereignty posture, apply and manage controls, identify gaps and risks and take action to address them.

Microsoft · source 1

helping customers understand workload dependencies and assess portability across operating environments when required.

Microsoft · source 1

Just-in-time Access and Customer Lockbox give customers additional control over access to their environments.

Microsoft · source 1

This visibility complements controls across the operator-access lifecycle.

Microsoft · source 1

For customers in the European Union (EU) and the European Free Trade Association (EFTA), we are rolling out Data Guardian, which adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.

Microsoft · source 1

External key management with Azure Managed HSM is now generally available, allowing customers to keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.

Microsoft · source 1

This gives organizations another option for workloads that require physical control of key hardware outside Microsoft infrastructure.

Microsoft · source 1

Azure Key Vault Managed Hardware Security Module (HSM) already gives customers dedicated, single-tenant protection and control over the encryption keys used by supported Azure services.

Microsoft · source 1

Sovereign Private Cloud, built on Azure Local, extends Microsoft cloud capabilities into environments that customers operate and control.

Microsoft · source 1

Sovereign Private Cloud extends cloud capabilities into customer-operated environments, including connected and disconnected operations.

Microsoft · source 1

A system supporting essential operations may need to continue running locally if connectivity is disrupted.

Microsoft · source 1

At Ignite, Foundry Local will become generally available for connected and disconnected operations on Azure Local, with an expanded model catalog that includes Microsoft, partner, open-weight and open-source models.

Microsoft · source 1

Local inference and agentic retrieval will also enable users to interact with local enterprise data using natural language and receive responses grounded in that data.

Microsoft · source 1

Integration with Microsoft 365 Local, available in preview for approved customers, extends this functionality to locally operated Microsoft SharePoint and Exchange servers.

Microsoft · source 1