Microsoft's sovereign cloud: what it solves and what it does not

You are the IT manager and your organisation works in Microsoft 365. A director or customer points to Microsoft's announcements about a sovereign cloud and asks whether that settles the problem. You want an answer that neither overestimates Microsoft nor brushes it aside.

This piece puts three things side by side: what Microsoft says its sovereign cloud solves, which exceptions Microsoft's own documentation names and what the CLOUD Act provides. The facts come from Microsoft's own publications and from the text of the law, each with the date on which we read them.

What does Microsoft call a sovereign cloud?

Microsoft presented its Sovereign Cloud on 16 June 2025 as a package with three components (Microsoft, 16 June 2025, accessed 5 October 2026):

• Sovereign Public Cloud: the regular Microsoft cloud in the existing European data centre regions, with additional controls
• Sovereign Private Cloud: Microsoft 365 Local and Azure Local, with Exchange Server and SharePoint Server in your own data centre
• National Partner Clouds: Bleu in France and Delos Cloud in Germany, operated by a partner

About the Sovereign Public Cloud, Microsoft writes that it keeps data in Europe, under European law, with operations and access by European personnel and with encryption under the customer's control. At the announcement, the Sovereign Public Cloud was a preview and Microsoft expected general availability in all European cloud regions later in 2025 (same source). The Microsoft Learn page on Microsoft Sovereign Cloud, updated on 15 July 2026, now writes that this cloud is available in European data centre regions for European customers and supports services such as Azure, Microsoft 365, Microsoft Security and Power Platform. It names the Sovereign Public Cloud as one of the models (Microsoft Learn, updated 15 July 2026, accessed 5 October 2026). Which features are available per service or per tenant is not stated on that page.

For an organisation that uses Microsoft 365 in the regular cloud, the first variant comes closest. The documentation describes it for governments and regulated sectors and builds it on Azure and on Advanced Data Residency in Microsoft 365 (Microsoft Learn, accessed 5 October 2026). Whether your own tenant falls under it cannot be derived from those pages. Ask Microsoft or your partner in writing.

What does it solve?

The EU Data Boundary is one of the features Microsoft names with the Sovereign Public Cloud (Microsoft Learn, updated 31 March 2026, accessed 5 October 2026). The documentation of the boundary itself does not name that cloud as a condition. Within that boundary, Microsoft commits to storing and processing customer data and personal data of, among others, Microsoft 365 in the EU and EFTA. Microsoft 365 customers with a sign-up location in the EU or EFTA already fall under it, except customers with Multi-Geo (Microsoft Learn, accessed 5 October 2026). On 29 April 2026, Microsoft wrote that the boundary is complete and that the processing of customer data for tools such as Copilot can also take place within Europe (Microsoft, 29 April 2026, accessed 5 October 2026).

On top of that, Microsoft names these commitments:

• A commitment to challenge an order that would shut down European cloud services. Microsoft laid this down in contracts with European national governments and the European Commission; the post names no other customers (same post of 29 April 2026)
• A commitment to challenge requests: Microsoft writes that it challenges requests from governments for data of customers in the EU, in the public sector or in business, where it has a legal basis to do so (Microsoft, 29 April 2026, accessed 5 October 2026)

Which exceptions does Microsoft name itself?

Microsoft's documentation itself says where the boundary ends:

• The EU Data Boundary has limited circumstances in which customer data and personal data still end up outside the boundary (Microsoft Learn, accessed 5 October 2026)
• Remote access by Microsoft personnel from outside the boundary counts as a transfer under European privacy law, even if the data stays in a European data centre. Microsoft calls that rare. For customer data, Microsoft points to Customer Lockbox, a setting that exists for many Microsoft cloud services and with which you make access by Microsoft personnel to customer data for work on the service generally subject to your explicit approval. The implementation differs slightly per service, and for pseudonymised personal data in log files and for data from professional services Microsoft describes other measures (Microsoft Learn, updated 30 March 2026, accessed 6 October 2026)
• Some services fall entirely outside it, such as Azure Front Door and Azure CDN (Microsoft Learn, accessed 5 October 2026)
• For Microsoft 365, the boundary applies to customers with a sign-up location in the EU or EFTA, not to customers with Multi-Geo (Microsoft Learn, accessed 5 October 2026)

According to Microsoft, Data Guardian is meant to bring remote access by Microsoft engineers to the systems that store and process your data in Europe under the supervision of personnel in Europe. Microsoft called it an upcoming feature on 4 November 2025 (Microsoft, 4 November 2025, accessed 5 October 2026). On 12 August 2026, Microsoft Learn described it as a feature of the Sovereign Public Cloud, without saying whether it is generally available (Microsoft Learn, updated 12 August 2026, accessed 5 October 2026). The post of 29 April 2026 says that Microsoft has announced it (Microsoft, 29 April 2026, accessed 5 October 2026). None of those sources gives a date of general availability.

What does the CLOUD Act say, and what does a European data centre change about it?

Microsoft describes the CLOUD Act as follows: US law enforcement can compel a provider with sufficient ties to the US to disclose data in its possession or control, wherever that data is stored. The existing legal protections continue to apply (Microsoft, report on government requests, July to December 2025, accessed 6 October 2026).

The text of the law says the same, with a condition. Section 2713 of title 18 of the United States Code (Pub. L. 115-141, 23 March 2018) says that a provider of an electronic communication service or a remote computing service must comply with the obligations of that chapter to preserve, back up or disclose the contents of communications and records about a customer, if they are within its possession, custody or control, regardless of whether they are located within or outside the United States (text of the law, Cornell Law School, accessed 5 October 2026). The obligation therefore exists within the procedures of that chapter. Section 2703 names among them a warrant, a subpoena, a court order and a request to preserve data. For an order to disclose the contents of communications, a provider can, under conditions, ask for the order to be modified or quashed. It must reasonably believe that the customer is not a US person and does not reside in the US, and that the disclosure would create a material risk that it would violate the laws of a 'qualifying foreign government'. That is a country with which the US has an agreement in force under section 2523 and whose laws offer providers comparable substantive and procedural opportunities. The court decides on this (text of the law, Cornell Law School, accessed 6 October 2026).

Our reading of those two sources is that the law attaches to the provider and not to the data centre. A European region therefore does not change whether the provider can receive such an order.

For enterprise customers, according to Microsoft generally organisations with more than 50 seats (see below), Microsoft says that it first tries to redirect law enforcement to the customer itself and that, if necessary, it can also start a formal procedure in court to have an order modified or quashed. It also says that it informs those customers beforehand unless the law prohibits this (Microsoft, report on government requests, July to December 2025, accessed 6 October 2026). Microsoft also writes that the law safeguards its right to object to orders from US law enforcement for access to European data that conflict with EU law (Microsoft, 30 April 2025, accessed 5 October 2026). For a municipality, you can read about it in our piece on the CLOUD Act and Microsoft 365 at the municipality.

How often does that happen?

Microsoft publishes this itself. In the second half of 2025, it received 190 requests from law enforcement agencies worldwide for accounts of enterprise customers. In this report, Microsoft generally describes those as organisations (businesses, governments or educational institutions) that purchase more than 50 seats for a commercial cloud service such as Microsoft 365 (Microsoft, Enterprise Disclosures to Law Enforcement, July to December 2025, accessed 6 October 2026). These are therefore figures about enterprise customers under that description, not about all customers. In 3 cases, Microsoft disclosed content of an enterprise customer outside the US, with data outside the US, to US law enforcement, and one of those customers was in the EU or EFTA (Microsoft, report on government requests, July to December 2025, accessed 6 October 2026). Orders on national security grounds are in a separate part of the report and are not counted here (same PDF).

On 10 June 2025, a French Senate committee asked a director of Microsoft France whether he could guarantee under oath that data of French citizens entrusted to Microsoft via the French government purchasing organisation Ugap would never be transferred after a US order without the explicit consent of the French authorities. He answered that he could not guarantee that, but that it had never happened (Sénat, record of 10 June 2025, accessed 5 October 2026).

What you can do tomorrow

1. Ask Microsoft or your partner in writing whether your tenant falls under the Sovereign Public Cloud, and which components are available today. Ask that per component, such as Data Guardian and External Key Management.
2. In the Microsoft 365 admin center, check the country or region of your tenant and whether you have bought Multi-Geo, and compare the list of excluded services with the services you use.
3. Decide per type of data whether it matters that the provider falls under US law, and record that assessment in your risk register.

Where Noveu fits

Noveu is a Dutch supplier, with data and backups in a Hetzner data centre in Falkenstein (Germany). At the edge of the network, we use Cloudflare, Inc. (United States) for DNS, CDN, DDoS protection and TLS, under the EU-US Data Privacy Framework and standard contractual clauses. All sub-processors are on the list of sub-processors. If you want to assess a supplier, use the seven questions for choosing a sovereign workplace.