On October 20, 2026, Microsoft’s Douglas Phillips (President and CTO, Microsoft Specialized Clouds) published what Microsoft calls the next stage of Microsoft Sovereign Cloud. Here is what changed, sorted by maturity.
Generally available or rolling out
- External key management with Azure Managed HSM: generally available.
- Data Guardian (EU and EFTA): rolling out. Adds oversight by a trusted EU partner for qualifying engineer access. Its Production Touch Ledger, which logs that access, is in phased rollout.
- Confidential VMs on Azure Local: generally available.
- GitHub Enterprise Local and Foundry Local: generally available at Microsoft Ignite.
Preview or limited
- Sovereign Control Panel in the Azure portal, showing a customer’s sovereignty posture: public preview at Ignite, no date given.
- Azure Local: moving workloads from connected to disconnected operation, DocumentDB and Blob Storage (public preview); Foundry Local with Microsoft 365 Local (preview for approved customers).
- Azure Confidential Clean Rooms: limited preview.
- Azure Local multitenancy: no date.
Microsoft also published new business continuity guidance. Several pieces, including Data Guardian and disconnected Azure Local, were announced earlier (June 2025 and February 2026); this post extends them.
What the post does not say
Analysis by ATAILA found that the post does not address the US CLOUD Act, government compulsion orders or who can legally compel Microsoft, and does not repeat the 2025 language that data stays in Europe “under European law”. Exit is also not addressed beyond a note that the control panel can help assess portability. We read this from ATAILA’s text search and have not independently re-verified the omissions.
Where to be skeptical
- Technical controls (keys, access logs, disconnected operation) reduce exposure, but they do not by themselves change which country’s law applies to the vendor.
- Much of the new capability is preview. Procurement should rely on generally available features and contract terms, not roadmap slides.
- Availability by region and licensing is not detailed here; confirm for your tenant.
Takeaway
For regulated buyers, this is a real step on technical controls and transparency. The unresolved questions are legal and contractual: jurisdiction, compelled access and exit. Ask for written answers on those before treating the label as a compliance outcome.
