Microsoft Expands Sovereign Cloud Controls

Microsoft has set out the next stage of its Microsoft Sovereign Cloud, adding tools meant to give governments and regulated industries more control over who can access their systems and where workloads run. In a blog post on 20 October 2026, Douglas Phillips, president and chief technology officer of Microsoft Specialized Clouds, announced features across public cloud, customer-run environments and partner clouds.

Phillips says customers in government, critical infrastructure and regulated industries want to put technology to work on their most important systems “while maintaining the control those systems require”. Microsoft frames sovereignty as a “continuum of control” chosen workload by workload, not a single product. Several of the features are not yet available: some arrive “at Microsoft Ignite”, some are in preview, and one is promised with no date at all.

In brief

A new Sovereign Control Panel, “entering public preview at Microsoft Ignite”, aims to show organisations their sovereignty posture in the Azure portal.
Microsoft says external key management with Azure Managed HSM is “now generally available”, and it is rolling out Data Guardian in the EU and EFTA.
GitHub Enterprise Local and Foundry Local are due to become generally available at Ignite on Azure Local; Azure Local “will support multitenancy”, with no date given.

More visible controls in the public cloud

Microsoft says the Sovereign Control Panel, “entering public preview at Microsoft Ignite”, brings sovereignty signals together in one Azure portal view. It is designed to help organisations understand their posture, manage controls, identify gaps and risks, and assess how portable workloads would be across environments.

For customers in the European Union and the European Free Trade Association (EFTA), Microsoft says it is “rolling out Data Guardian”. This adds “European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.” A companion feature, Production Touch Ledger, “also launched with phased rollout in the EU and EFTA”, creates tamper-evident records of that access and of the actions performed.

On encryption, Microsoft says “External key management with Azure Managed HSM is now generally available”. It lets customers keep the root encryption key in hardware they own and run on-premises or through a trusted third party. Azure Confidential Clean Rooms, “now in limited preview”, uses confidential computing so several parties can analyse shared sensitive data while limiting exposure of the underlying information.

Running more locally, even offline

For workloads that need to keep running if connections fail, Microsoft points to Sovereign Private Cloud, built on Azure Local, which supports connected and disconnected operation. It says the ability to move workloads from connected to disconnected operation “is entering public preview”. It is also publishing new sovereign business continuity guidance and architecture patterns.

Microsoft is bringing more of the software stack inside customer-controlled sites. SQL Server on Azure Local is “already generally available”, while DocumentDB and Blob Storage on Azure Local are “both entering public preview”. “GitHub Enterprise Local will become generally available at Microsoft Ignite as a validated GitHub Enterprise Server appliance on Azure Local,” Phillips wrote, and developers can use GitHub Copilot with locally hosted models.

“At Ignite, Foundry Local will become generally available for connected and disconnected operations on Azure Local,” Microsoft says, with a catalogue spanning Microsoft, partner, open-weight and open-source models. Integration with Microsoft 365 Local, “available in preview for approved customers”, extends this to locally run SharePoint and Exchange servers. Confidential virtual machines on Azure Local “are generally available”.

Finally, Microsoft says “Azure Local will support multitenancy”, letting organisations separate resources and governance across multiple tenants on shared infrastructure. It gives no date for this.

Partners fill the gaps

Microsoft also highlights its Sovereign Partner Ecosystem. National Partner Clouds, “including Bleu in France”, provide independently operated environments for customers that need a different ownership and operating model. Software partners can add security, identity, backup, networking and other capabilities to Azure Local, while specialist partners bring local knowledge.

“Digital sovereignty should give organizations greater control and security over the technology they depend on, while continuing to innovate,” Phillips wrote. The post gives no pricing for any of the new features.

Our read

Most of what matters here is still on the way: the Control Panel, GitHub Enterprise Local and Foundry Local all hinge on Ignite, and multitenancy has no date. The pieces that are live, notably external key management and confidential VMs on Azure Local, address the sharpest European worry: who holds the keys and who can get in. Buyers will want detail on Data Guardian’s partners and scope before treating it as a sovereignty guarantee.