Is Microsoft's Sovereign Cloud Sovereign?

My Medium friends can read this over on Medium.

Microsoft sells Europe something called the Microsoft Sovereign Cloud. Amazon has the AWS European Sovereign Cloud. Google has partners with sovereign in the name.

Everybody is sovereign all of a sudden.

That's because Europe wants off American tech, and the American companies don't want Europe to leave. Understandably so. So, let's look into what Microsoft is selling here.

The product

Microsoft announced it in June 2025. It comes in three flavors.

The Sovereign Public Cloud is Azure and Microsoft 365 in the EU regions, with extras. Your encryption keys can sit in your own hardware. And when a Microsoft engineer needs remote access, that access gets approved and monitored by staff who live in Europe. Microsoft calls that Data Guardian.

The Sovereign Private Cloud is Microsoft software running in your own data center.

And then there are partner clouds. Delos Cloud in Germany, run by an SAP subsidiary. Bleu in France, owned by Orange and Capgemini. Microsoft technology, European operator.

On top of that came a list of European digital commitments. A European board of directors, European nationals only. A promise to fight any order to shut down European operations, in court if needed. A backup of the code in Switzerland.

Sounds like a lot. And some of it is.

But Microsoft's own documentation has one line about the public version: it is "built on Microsoft's global Azure infrastructure."

One sentence

In June 2025, Anton Carniaux, the legal director of Microsoft France, sat in front of the French Senate. Under oath.

The question: could he guarantee that French citizens' data would never go to US authorities without the explicit consent of the French authorities?

His answer, per the Senate transcript: "No, I cannot guarantee it, but, again, this has never happened yet."

He told the truth.

The CLOUD Act

The reason he can't guarantee it is an American law from 2018. The CLOUD Act makes US providers hand over data in their "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."

That's the text of the law. Where the server stands doesn't matter. Who owns the company does.

And Microsoft knows it. Read the commitments again. Microsoft will challenge government demands for European customer data "where we have a legal basis for doing so."

Where they have a legal basis. Against a US law, in a US court, that's a pretty short list, I would guess.

A European board doesn't change that. Keys in your own hardware help a bit more, because data Microsoft can't decrypt is data Microsoft can't hand over in readable form. But the public version still runs on the same global Azure, owned by the same company in Redmond.

A sovereign cloud owned by a US company is still a cloud owned by a US company.

Karim Khan

In 2025, Karim Khan, the chief prosecutor of the International Criminal Court, lost access to his Microsoft email after the Trump administration sanctioned him.

In February 2026, a Microsoft representative told a parliamentary hearing that this had been the ICC's decision. Then Microsoft corrected itself: "We were in touch with the ICC throughout the process that resulted in the disconnection of its sanctioned official."

The ICC had already decided to move from Microsoft Office to openDesk, the German open-source suite. I wrote about how slow Europe's tech breakup with the US is going. This was one of the moments that sped it up.

Amazon and Google

Amazon's version, the AWS European Sovereign Cloud, went live in January 2026. First region in Brandenburg. Physically and logically separate from the rest of AWS, run by German companies led by EU citizens.

That's more separation than Microsoft's public version. But the parent company is still Amazon. Same law, same question.

Google went a different way in France. S3NS is controlled by Thales, a French company, and runs Google's cloud technology. Thales announced a German version in May 2026, fully owned by Thales.

That's a model where a European company owns the thing. Google delivers the software. Interesting.

Europe is choosing

In April 2026, the European Commission awarded a 180 million euro cloud tender with sovereignty criteria. Four winners. STACKIT, Scaleway, a Post Telecom group with OVHcloud, a Proximus group with S3NS and Mistral.

Microsoft and AWS won nothing.

In June, the Commission proposed the Cloud and AI Development Act. It sorts cloud providers into assurance levels, and level 3 reads "owned and controlled from the EU." No sovereign label gets a US company there.

And in Schleswig-Holstein, where I live, the state government moved more than 40,000 mailboxes from Exchange and Outlook to Open-Xchange and Thunderbird. Done in October 2025, per heise. LibreOffice, Nextcloud and Linux are next on their list.

To be fair

Some of what Microsoft built is useful. Microsoft 365 Local can run fully disconnected now, Exchange and SharePoint on your own servers, supported through at least 2035. That is an answer to the demand. Nobody in Redmond can turn off a server they can't reach.

The partner clouds are closer to the real thing too. Delos and Bleu are European companies. Though Bleu is still waiting for the French SecNumCloud qualification, and Delos said in 2024 it would cost 10 to 20 percent more than Microsoft's regular cloud.

And Europe doesn't have clean hands here either. Since August, the e-Evidence Regulation lets a prosecutor in one EU country order data from a provider in another, often without a judge there looking at it first. Europe has its own CLOUD Act now. Sovereign doesn't mean nobody can reach your data. It means fewer foreign governments can.

For a small business, most of this is far away anyway. You're not the ICC. Probably. But still…

The Bottom Line

Microsoft is not lying about the product. The board exists, the keys work, the private version runs offline.

But its own legal director said it under oath. The company can't promise your data stays out of US hands.

And that is what "sovereign" was supposed to mean. Right?

If you're not already, follow me on Medium.