Advancing digital sovereignty with greater control and choice

When chatting with leaders from government, essential services, and regulated sectors, one key priority always comes up: effectively utilising technology for their crucial systems while ensuring the necessary control over them.

This challenge is growing as advanced cloud and AI technologies continue to integrate into public services and essential operations. Organisations are now looking beyond just where their data is stored. They want to know who can access and manage their systems, how to keep sensitive digital assets secure, which technology dependencies are most important, and whether they can sustain critical services during shifts in regulations, geopolitics, security, or network conditions. Embracing digital sovereignty should empowering organisations with increased control and security over the tech they rely on, all while driving innovation forward.

Last year, we launched Microsoft Sovereign Cloud to give customers better options for tackling these challenges. Since then, we’ve been committed to transforming our promises into practical solutions across public cloud and customer-controlled environments, and we’re expanding how we help partners meet sovereignty needs in their own markets. Today, we’re excited to share the next phase of our journey.

A Flexible Approach to Control Around Workloads

Our strategy for digital sovereignty is primarily focused on workloads. Every workload has unique requirements concerning data, operations, technology dependencies, continuity, and risks. Microsoft Sovereign Cloud aims to simplify how organisations can apply the right level of control to each workload without forcing every application into the same deployment style.

Different organisations have varied needs; for example, a public-facing digital service might thrive on the scale and rapid innovation of the public cloud. Conversely, systems supporting essential operations might need to function independently if connectivity falters. Meanwhile, an AI workload managing highly sensitive information may need to process its data within an environment exclusively controlled by the customer.

Microsoft Sovereign Cloud is tailored for this workload-driven philosophy, offering a flexible management and control continuum across Sovereign Public Cloud, Sovereign Private Cloud, and the Sovereign Partner Ecosystem. This lets organisations exert the appropriate control over each workload while ensuring a consistent governance and operational approach throughout their digital setup. Sovereign Public Cloud enhances capabilities for those workloads requiring additional control and transparency without sacrificing the advantages of scale and innovation found in Azure.

Sovereign Private Cloud broadens cloud capabilities into customer-operated environments, catering to both connected and disconnected operations. Moreover, the Sovereign Partner Ecosystem further extends this continuum through independently operated environments, trusted partners, and localised expertise that help fulfil customers’ sovereignty needs.

These options are interconnected; customers can seamlessly integrate public cloud, private cloud, and partner functionalities across their digital landscape, tailoring control levels to fit the unique demands of each workload as their operational needs evolve.

Enhancing Control Visibility in Sovereign Public Cloud

For many workloads, the public cloud presents a blend of expansive scale, continuous innovation, integrated security, and compliance. Organisations can enjoy these features whilst integrating additional sovereignty controls regarding residency, confidentiality, operator access, policy, and continuity. Our efforts in the Sovereign Public Cloud make these controls clearer, easier to apply, and demonstrate.

Sovereign Control Panel, which will enter public preview at Microsoft Ignite, unifies these signals within a single Azure portal experience. It empowers organisations to assess their sovereignty stance, implement and manage controls, pinpoint vulnerabilities and risks, and take measures to rectify them. This tool also enhances business continuity by assisting customers in understanding workload dependencies and evaluating portability across operating environments whenever necessary.

This clarity augments controls within the operator-access lifecycle. Just-in-Time Access and Customer Lockbox provide customers with further control over who accesses their environments. For those in the European Union (EU) and European Free Trade Association (EFTA), we are rolling out Data Guardian, which provides European-resident oversight by a trusted EU partner for qualifying Microsoft engineers with remote access to relevant production systems. Additionally, the Production Touch Ledger, currently being rolled out in phases within the EU and EFTA, establishes tamper-evident records of access and the activities performed.

With Azure Key Vault Managed Hardware Security Module (HSM), customers already receive dedicated protection and control over encryption keys for supported Azure services. Last year, we pledged to extend that control beyond Microsoft infrastructure. External key management with Azure Managed HSM is now widely available, enabling customers to retain the root encryption key within hardware they manage, either on-site or via a trusted third party. This option suits workloads demanding physical control over key hardware beyond Microsoft’s infrastructure.

Through Azure confidential computing, we protect sensitive data during processing within a secured hardware-based environment. We are also increasing transparency surrounding the technologies fostering that trust. The Azure Confidential Clean Rooms, which are now in limited preview, applies confidential computing principles to approved multi-party collaborations, allowing participants to analyse shared sensitive data while restricting wider exposure of the underlying information.

Together, these features offer enhanced technical and operational controls, bolstering a comprehensive digital sovereignty strategy aligned with an organisation’s legal, policy, security, resilience, and business necessities.

Building Resilience and Operational Independence

For specific workloads, digital sovereignty means ensuring critical operations can continue seamlessly when connectivity, geopolitical shifts, or operational conditions change. Resilience must be integrated from the outset so essential workloads remain functional even amidst disruptions.

To assist customers in preparing for such situations, we are releasing new sovereign business continuity guidance and architecture patterns. These resources will help organisations convert resilience requirements into practical architectures they can plan, implement, and test before facing real-world needs.

For most workloads, the expansive scale and geographic reach of the public cloud provide a robust foundation for resilience across various locations and operating conditions. For workloads that require increased operational independence, the Sovereign Private Cloud extends that framework into customer-managed environments encompassing both connected and disconnected operating models. The capability to transition workloads from connected to disconnected operations is now entering public preview, giving organisations more flexibility to uphold critical services as connectivity and operational requirements transform.

Gaining Local Control of the Application Lifecycle

Achieving operational independence necessitates more than just infrastructure. Now, organisations require data, development tools, model capabilities, and productivity services that their applications rely on to function within the same customer-controlled space.

Sovereign Private Cloud, built upon Azure Local, expands Microsoft cloud capabilities into customer-operated environments. SQL Server on Azure Local is already widely available for both connected and disconnected deployments. Both DocumentDB and Blob Storage on Azure Local are entering public preview, providing organisations an array of choices on how to manage essential data within customer-controlled settings.

GitHub Enterprise Local will become generally available at Microsoft Ignite, serving as a validated GitHub Enterprise Server appliance on Azure Local, keeping repositories, code, and development artifacts within local control. Developers can also benefit from GitHub Copilot with locally hosted models for inference, bringing AI-supported development closer to their code and data in managed environments.

The local application environment is further expanding with Foundry Local. At Ignite, Foundry Local will be available for both connected and disconnected operations on Azure Local, featuring an enhanced model catalog, which includes Microsoft, partner, open-weight, and open-source models. Local inference and agent retrieval will allow users to engage with local enterprise data using everyday language and receive responses grounded in that data. Integration with Microsoft 365 Local, now in preview for approved customers, extends this capability to locally operated Microsoft SharePoint and Exchange servers.

Confidential virtual machines on Azure Local are now widely available, bringing confidential computing capabilities to customer-managed infrastructure. Hardware-encrypted memory and hardware-based isolation safeguard sensitive data during processing. Workload attestation ensures additional reassurance is provided before sensitive data or keys are accessed. These protective measures offer another level of security for regulated, sensitive, and mission-critical workloads, granting organisations improved control over where their data and applications run.

Additionally, Azure Local will support multitenancy, enabling organisations to segregate resources, governance, and management across multiple tenants while utilising shared underlying infrastructure. This significantly enhances the capabilities of customers with distinct business divisions or security boundaries using Sovereign Private Cloud. Furthermore, multitenancy opens up fresh opportunities for local operators and service providers to deliver distinct sovereign cloud services using Azure Local infrastructure.

These enhancements place more elements of the application lifecycle under local control, encompassing data, development, productivity, AI, and operations. Organisations can decide what to run locally based on each workload’s specific needs.

Expanding the Continuum with Partnerships

Navigating the complexity of sovereignty can be challenging. Regulatory, security, operational, and business demands differ across countries, industries, and workloads. Organisations need to adapt these requirements into technology and operational models that cater to their local context. Often, managing these needs necessitates a mix of technology, local authority, industry knowledge, and specialised solutions.

The Sovereign Partner Ecosystem broadens the range of ways customers can tackle these requirements. National Partner Clouds, like Bleu Cloud in France and Delos Cloud in Germany, offer independently operated environments for customers seeking alternative ownership and operational models. Software partners can enrich Azure Local environments with capabilities covering security, identity, observability, backup and recovery, migration, data, networking, and applications. Digital sovereignty specialised partners integrate Microsoft technologies with local insights and practical expertise. Additionally, Platform co-innovation partners enhance infrastructure options from datacenter to edge.

This ecosystem offers customers the freedom to blend technology, operational models, and trusted expertise in alignment with their unique workload requirements.

A New Era of Digital Sovereignty

AI is not only amplifying opportunities but also intensifying the implications of technology choices. As AI systems engage with sensitive data, business processes, and vital infrastructure, they introduce additional security considerations that organisations must address. Companies require clear oversight on the deployment of these systems, the authorised personnel who manage them, the actions they can perform, and how critical services are maintained amid changing conditions.

Microsoft Sovereign Cloud unifies these options in a continuum of control across public cloud, customer-operated settings, and our partner ecosystem. It provides organisations with the flexibility to apply the correct level of control to each workload while continuing to harness the immense power of cloud capabilities and innovation.

We are committed to continuously expanding this continuum, allowing organisations to leverage cloud and AI technologies while retaining the control, confidentiality, resilience, and operational authority that their most essential workloads demand.

Douglas Phillips heads the global engineering initiatives for Microsoft’s specialised, sovereign, and private clouds. He oversees Microsoft’s worldwide strategy, product offerings, and operations that provide its industry-leading solutions—including Azure, the adaptive cloud portfolio, and the Microsoft 365 collaboration suite—tailored for customers with additional sovereignty, security, edge, and compliance needs.

Find out more

Tags: Azure, Azure Local, Foundry Local, Microsoft 365 Local, Microsoft Sovereign Cloud, Sovereign Private Cloud, Sovereign Public Cloud