Microsoft expands control options for its sovereign cloud

In an announcement published on October 20, Microsoft details new Sovereign Cloud features. The company presents an approach tailored to each workload, combining public cloud, environments operated by customers and independent partners. Its private offering includes connected or disconnected operations, according to the company.

External key management with Azure Managed HSM is announced as generally available. It allows customers to keep the root encryption key in hardware they own and operate on-site, or with a trusted third party. Microsoft presents this capability as a response to the need for physical control over key management equipment outside its infrastructure.

For customers in the European Union and the European Free Trade Association, Microsoft says it is rolling out Data Guardian. A trusted European Union partner provides oversight from Europe for certain instances of remote access by its engineers to the production systems concerned. Production Touch Ledger is also being rolled out gradually in these regions: it records these instances of access and the actions performed in a way that makes tampering detectable.

These announcements address different means of control: custody of keys, oversight of interventions and traceability. Their combination may help clarify operational responsibilities. However, it is not sufficient to establish overall compliance or technological independence: the features described remain subject to the supported services, eligible access and scopes announced by Microsoft.