Microsoft expands sovereign cloud controls for EU and EFTA customers
New tools let European organizations oversee remote access and run AI models on their own hardware without connecting to the internet.
Key points
- Microsoft introduces Data Guardian and Production Touch Ledger to monitor engineer access.
- Foundry Local and GitHub Enterprise Local become generally available for offline AI use.
- Customers can hold master encryption keys on their own hardware via new sovereign controls.
Microsoft CEO Satya Nadella announced new capabilities for the company’s sovereign cloud on October 20, 2026. The updates target government agencies and regulated companies in Europe, offering greater control over system access and data residency. These changes aim to address concerns regarding reliance on US-based cloud infrastructure for sensitive workloads.
Douglas Phillips, who leads Microsoft’s specialized clouds unit, outlined the specific technical additions during the announcement in Paris. The company is extending its Microsoft Sovereign Cloud, which originally launched in June 2025. The new features allow organizations to run more artificial intelligence tools on their own hardware while maintaining strict oversight of who can interact with their production systems remotely.
Enhanced Access Oversight and Control
For customers located in the European Union and the European Free Trade Association, Microsoft is deploying a tool called Data Guardian. This feature requires a trusted European partner to oversee any remote logins made by Microsoft engineers to customer production systems. A second component, the Production Touch Ledger, maintains an immutable record of that access, ensuring any unauthorized changes can be detected.
Microsoft is also allowing customers to retain the master encryption keys for their data on hardware they own, rather than storing them with Microsoft. A new Sovereign Control Panel in the Azure portal will display the status of each system and highlight any compliance gaps. This panel enters public preview at the Ignite conference, scheduled for November 17 to 19 in San Francisco.
Offline AI and Local Infrastructure
Most of these new capabilities operate on Azure Local, the version of Microsoft’s cloud infrastructure that resides in a customer’s data center. Foundry Local, which enables the running of AI models on-site, and GitHub Enterprise Local, which allows developers to use GitHub Copilot with locally hosted models, both become generally available at Ignite. Both solutions are designed to function fully offline, disconnecting from Microsoft’s broader network.
SQL Server on Azure Local is now generally available, while Microsoft 365 Local remains in preview for approved customers. The Microsoft 365 Local offering connects to customers’ own SharePoint and Exchange servers. These systems will also support switching between connected and disconnected modes, providing flexibility for organizations with varying connectivity requirements and security mandates.
What should you do?
Organizations in the EU and EFTA should evaluate their current cloud data residency and access control policies against these new sovereign options. Security teams should review the requirements for Data Guardian and Production Touch Ledger to determine if they align with internal compliance standards. IT leaders should assess the feasibility of migrating workloads to Azure Local or utilizing offline AI tools like Foundry Local for sensitive data processing.
What to do and how to stay safe: Microsoft
- Audit current cloud access logs to identify gaps in oversight that Data Guardian could address.
- Evaluate the security benefits of holding master encryption keys on local hardware versus cloud storage.
- Test offline AI capabilities like Foundry Local in isolated environments to verify performance and security.
- Monitor the public preview of the Sovereign Control Panel for compliance reporting features.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the new sovereign cloud tools be available?
The Sovereign Control Panel enters public preview at the Ignite conference from November 17 to 19, while Foundry Local and GitHub Enterprise Local become generally available at the same event.
Who can use the Data Guardian feature?
Data Guardian is rolling out for customers in the European Union and the European Free Trade Association, allowing a trusted partner to oversee Microsoft engineer access.
Can these AI tools run without an internet connection?
Yes, Foundry Local and GitHub Enterprise Local are designed to work fully offline, running AI models on the customer's own hardware without connecting to Microsoft's cloud.
