Microsoft's data sovereignty: Now with extra sovereignty!
- Reference: 1762518138
- News link: https://www.theregister.co.uk/2025/11/07/microsoft_announces_strengthening_of_sovereignty/
- Source link:
Under the CLOUD Act, US authorities can compel access to information held by American cloud providers irrespective of where in the world that data is housed. Although Microsoft says it has published transparency reports and no European customers, private or public, were yet the subject of any requests, the threat of the law remains and this is making some nervous.
When hyperscalers can't safeguard one nation's data from another, dark clouds are ahead [1]READ MORE
Since President Donald Trump came to power for a second time in January, Microsoft has itself admitted that [2]geopolitical relations between the US and Europe have become volatile , and it has sought to calm jittery customers by outlining measures to harden data sovereignty.
Google has also adopted this strategy, and AWS is getting ready to launch services by year end.
Against this backdrop, Microsoft this week talked up new features. The [3]latest play is unsurprisingly heavy on AI – end-to-end AI data processing can happen in Europe as part of the EU Data Boundary, and in-country processing for Microsoft 365 Copilot interactions is set for 15 countries, although only four – the UK, Australia, India, and Japan – will have the option by the end of 2025.
[4]
The rest, including Germany, Sweden, the United Arab Emirates, and South Africa, will follow in 2026.
[5]
[6]
In addition, Microsoft is increasing the scale of Azure Local (formerly Azure Stack HCI) from 16 physical servers to "hundreds" and adding Storage Area Network (SAN) support. The latter means that organizations can use existing on-premises storage. This also acknowledges that 16 physical servers are insufficient to meet the growing needs of a sovereign private cloud.
General Availability of Microsoft 365 Local was confirmed, which brings Exchange Server, SharePoint Server, and Skype for Business Server to Azure Local. However, these have to be deployed in a connected mode because a disconnected option for full isolation won't be available until early 2026.
[7]
The growing mistrust of US hyperscalers in Europe is palpable. Sources told The Reg that data sovereignty is now among primary questions salespeople at the big three - Microsoft, AWS and Google - receive when in conversation with European customers. Lobbyists and members of the tech community in the region continue to press the European Commission to fund a [8]sovereign infrastructure .
Data sovereignty is not new. For years organizations have managed compliance issues which meant their data should not leave a country or the EU. However, it has been [9]amplified across the wider market since Trump 2.0 .
The latest effort by Microsoft follows the launch of the [10]EU Data Boundary . In June, Microsoft [11]revealed a set of "sovereignty solutions" comprising options in the public cloud, private cloud, or national partner clouds (operators independent from Microsoft).
[12]
Microsoft isn't alone. Google has updated its sovereign cloud services, including a [13]Cloud Airgapped solution . And AWS attempted to assuage customer fears by [14]announcing the establishment of an EU-based cloud unit.
Thierry Carrez, general manager, OpenInfra Foundation, told The Register : "Right now the digital sovereignty concerns are at an all-time-high in Europe. As a result, US hyperscalers like Microsoft are trying to find a mix of technical solutions and legal engineering to isolate their EU products from potential demands from the US government (including but not limited to the CLOUD act).
"This is a positive development, but whether that mix will prove sufficient is unsure and untested."
[15]EU sovereignty plan accused of helping US cloud giants
[16]Time to ditch US tech for homegrown options, says Dutch parliament
[17]'Close to impossible' for Europe to escape clutches of US hyperscalers
[18]International Criminal Court kicks Microsoft Office to the curb
Mark Boost, CEO of UK-based cloud provider, Civo, told The Register , "Microsoft's latest sovereign cloud announcement highlights how blurred the language around 'sovereignty' has become. While adding local processing and new regional AI capabilities sounds positive, this is really about data residency, not true sovereignty.
"You can put a data centre in Paris or London," he said, "but if the company is still governed by US law, the data ultimately sits under US jurisdiction."
Frank Karlitschek, CEO and founder of Nextcloud, branded Microsoft's latest efforts as "sovereignty washing." He said, "In Europe, sovereignty means the absence of strong dependencies on overseas third parties. The sovereign cloud from Microsoft does not deliver that.
"Only open source software," he said, "prevents dependencies on individual providers and allows independent security audits."
European tech firms have obvious skin in the game, and want to loosen the stranglehold that Microsoft and AWS have on the region's cloud market. With Trump in power for many more years, they have time yet to convince customers of the benefits of buying local. ®
Get our [19]Tech Resources
[1] https://www.theregister.com/2025/08/04/when_hyperscalers_cant_safeguard_one/
[2] https://www.theregister.com/2025/04/30/microsoft_getting_nervous_about_europes/
[3] https://azure.microsoft.com/en-us/blog/microsoft-strengthens-sovereign-cloud-capabilities-with-new-services/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aQ4lpmYIAFxNL3WXkgexqwAAAZU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQ4lpmYIAFxNL3WXkgexqwAAAZU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQ4lpmYIAFxNL3WXkgexqwAAAZU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQ4lpmYIAFxNL3WXkgexqwAAAZU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/03/17/european_tech_sovereign_fund/
[9] https://www.theregister.com/2025/02/26/europe_has_second_thoughts_about/
[10] https://www.theregister.com/2022/12/15/microsoft_launches_eu_data_boundary/
[11] https://blogs.microsoft.com/blog/2025/06/16/announcing-comprehensive-sovereign-solutions-empowering-european-organizations/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/paasiaas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQ4lpmYIAFxNL3WXkgexqwAAAZU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2025/05/21/google_sovereign_cloud_updates/
[14] https://www.theregister.com/2025/06/03/aws_european_sovereign_cloud/
[15] https://www.theregister.com/2025/10/27/cispe_eu_sovereignty_framework/
[16] https://www.theregister.com/2025/03/19/dutch_parliament_us_tech/
[17] https://www.theregister.com/2025/05/22/ditching_us_clouds_for_local/
[18] https://www.theregister.com/2025/10/31/international_criminal_court_ditches_office/
[19] https://whitepapers.theregister.com/
21th century colonialism
It is not about Trump. Data sovereignty is about governments protecting their citizens against losing their privacy to third parties, to whom never consent was given for data sharing. EU should not build data-centers, but prohibit export of data to providers operating under different jurisdictions outside of EU, and on top introduce laws enabling citizens to receive significant compensations from organizations ignoring this mandate. But this will never happen, any hospital in the EU can happily dump medical records in Azure. and the US puppet regimes in Netherlands, UK and Germany won't move a finger to end this abuse.
Re: 21th century colonialism
"But this will never happen"
Never is a long time.
Meanwhile, as TFA points out, the message is starting to get through.
Re: 21th century colonialism
It's starting to hit their bottom line, so of course they're worried. But since Microsoft has a presence in the US and therefore they can be compelled to hand over info...is this any more than window dressing?
Re: 21th century colonialism
"Data sovereignty is about governments protecting their citizens against losing their privacy to third parties,"
From the point of view of home governments, yes. But I'm more troubled by the endless snooping powers my own government awards itself regarding my data than I am by the prospect that foreign governments might get their hands on my data.
Re: 21th century colonialism
prohibit export of data to providers operating under different jurisdictions outside of EU
The best way of achieving that is by:
• ensuring that the data-canter owner is not beholden to non EU laws, ie is an EU company
• does not run software that it does not know what it does - ie not use closed source code. Who knows what Microsoft telemetry does ? (Ditto for not MS s/ware). Open source is the only way to go
Even this is no guarantee but is a good start.
Trumpers to cloudy CEO: "give us all your EU data or take a one-way trip to the Red Onion"
In the spirit of St William of Vancouver
Does Microsoft have to remain an American company? A quick check suggests $39b US vs $37b non-US quarterly revenue.
Departure would certainly be viewed dimly in some quarters, but those customers would face the same problem Europeans do in finding a credible alternative to the desktop application monopoly.
They would also have the same assurance that their data would remain hosted in their case within the continental US. All MS need is a legal home that does not assert the sovereign right to issue a writ for any data it pleases. Candidates?
And of course any of the tech giants might do this, especially if they "fall out of favour" with any given US administration.
I think we'll save full extraterritoriality and private armies for the next decade.
Re: In the spirit of St William of Vancouver
Does Microsoft have to remain an American company?
Well they'd need to retain a US stock market listing, because that offers much higher prices for a given performance than say LSE or Euronext. In theory they could move their legal HQ but keep a US listing, but even that won't actually help because the scope of the CLOUD act (according to AWS) is "all electronic communication service or remote computing service providers that operate or have a legal presence in the U.S." So even an EU company that operates in the US such as SAP is in scope, and their data in Europe could be demanded by the US authorities under the CLOUD Act.
The only protection is either that you're a foreign company whose government will say no to Uncle Sam (not a long list there), or not to do business in the US, nor to have any legal presence there. And even then, do you think they wouldn't use a few zero days if it suited them?
Copium
Let's call this what it is. EU leaders have been caught pants down, hopelessly locked into the US tech ecosystem. Now they need a political excuse to keep using it, even though their own courts have said it's illegal.
This "sovereign cloud" is that excuse. It's commercial "copium."
The fundamental, unchangeable fact is this: If a company is ultimately controlled from the US, no technical or contractual "solution" can make it immune to the CLOUD Act.
All these new features are just Microsoft scattering Lego pieces on the floor. The hope is that a US data request would be difficult and painful. But it absolutely will not stop them from taking the data.
Not worth the virtual paper it is written on
MS is an American company. America thinks and acts like it owns the world. The USA is not Europe's friend.
>> it couldn't guarantee that data will not be transmitted to the US government when it is legally required to do so
That is being generous. Let me reword it for you. MS effectively said it would break EU law to comply with US law. On that basis, MS should be considered to be a hostile state-backed actor.
Re: Not worth the virtual paper it is written on
The other option, breaking US law to comply with EU law, does not make it a hostile state-backed actor?
Re: Not worth the virtual paper it is written on
Since when is US law valid in the EU?
UK data is where?
Then we get to the, what strongly appear to be, abject lies about the location of UK data.
For example, take Microsoft 365 SharePoint Online and configure it for "UK" and then check where it is actually operating using GeoIP lookups and the locations quickly switch from lonXX.ntwk.msn.net, which is recorded as being located in London - UK to IP addresses that are recorded as being located in Redmond - USA. This very strongly indicates that UK data, despite the claims of Microsoft 365 SharePoint Online Administration Centre, is being stored in a different country, in this case the US where the regime has no worthwhile data protection laws whatsoever.
Just in case this could just be administration related, and these IP addresses are in fact located in the UK where Microsoft claim, I also ran speed tests from various locations throughout the world. London and UK based speed tests all operated somewhat slower than USA originating speed tests.
Failures within Microsoft 365 infrastructure, of which there have been a few in the last month, that affect North America also tend to affect "UK" services too.
All of which indicates that Microsoft are lying when it comes to the location of UK data.
Re: UK data is where?
The UK does not count. It is owned by the USA.
UK Police National Database
Is supposed to be moving to the “cloud”.
Really?
Risky business - any way you turn it
Even when you run that MS stuff locally, how do you guarantee that your data will not be exfiltrated by them (*) ?
See for example the whole Windows 7, 8, 10, 11 adventures that constantly sends data to MS' servers, with increasing volume every update you get. Just wait for it and your data will be gone before you can say shutdown in one strategic update.
(*) for quality assurance only, really, we promise.