MUMBAI: Microsoft is taking cloud computing off the grid, at least for workloads that cannot afford to be exposed to the wider internet. The technology company is expanding its sovereign cloud portfolio with new tools designed to give organisations greater control over sensitive data, encryption keys and artificial intelligence operations, including options to run critical systems in disconnected environments.
Announced on 20 October, the developments build on Microsoft Sovereign Cloud, a framework intended to help organisations meet digital sovereignty requirements across public cloud infrastructure, privately operated systems and partner-run environments. The expansion comes as governments and businesses face growing pressure to determine where their data resides, who can access it and how critical systems continue operating when connectivity is disrupted.
Douglas Phillips, president and chief technology officer of Microsoft Specialized Clouds, said organisations needed to retain control over critical technology while continuing to benefit from cloud and AI capabilities. Microsoft’s approach, he said, allows customers to choose different levels of control according to the requirements of individual workloads.
The distinction is important because not every organisation can operate its most sensitive systems in the same way. Some may be comfortable using public cloud services, while others need infrastructure under their own operational control or a locally managed environment. Organisations handling sensitive information or supporting essential services may also need systems that continue functioning when an internet connection is unavailable.
Microsoft’s latest additions are intended to address these different requirements, combining new oversight tools with options to run more applications and AI workloads locally.
One of the key additions is the Sovereign Control Panel, which will enter public preview at Microsoft Ignite. Integrated into the Azure portal, the tool is designed to help organisations monitor their sovereignty requirements, manage controls, identify potential risks and assess whether workloads can be moved between operating environments.
For businesses operating across different cloud arrangements, the ability to monitor controls and understand where workloads can run could make governance more manageable. Rather than treating sovereignty as a single setting, the tool is intended to provide visibility into how individual workloads meet an organisation’s requirements.
Microsoft is also introducing additional safeguards around remote access to production systems. Its Data Guardian capability will provide oversight by a trusted European Union partner for qualifying remote access by Microsoft engineers to covered production systems in the EU and European Free Trade Association countries.
Alongside this, Production Touch Ledger will create tamper-evident records of access and related actions, with a phased rollout planned in these regions. Such records are intended to provide an auditable trail of activity, helping organisations review how production environments are accessed and managed.
Encryption key management is another focus. External key management with Azure Managed Hardware Security Module is now generally available, allowing customers to retain their root encryption keys on hardware they operate themselves or through a trusted third party, outside Microsoft’s infrastructure.
The capability gives organisations another option for controlling access to the keys that protect their data. However, retaining encryption keys outside a cloud provider’s infrastructure is one element of a broader sovereignty arrangement; it does not, on its own, determine every aspect of data access, processing or operational control.
Microsoft is also developing ways for organisations to collaborate using sensitive information without unnecessarily exposing the underlying data. Azure Confidential Clean Rooms has entered limited preview, using confidential computing to support approved data collaboration while limiting exposure of the information involved.
The offering could be relevant to organisations that need to work with external partners but cannot freely share the underlying datasets. Its availability remains limited preview, so it should not be confused with a generally available service.
Beyond oversight and data protection, Microsoft is expanding its private cloud capabilities through Azure Local, with the aim of allowing more applications and data services to operate within locally controlled environments.
DocumentDB and Blob Storage on Azure Local are entering public preview. These additions extend the range of data-management capabilities available for local deployments, giving organisations more options for keeping applications and associated data within infrastructure they control.
GitHub Enterprise Local is scheduled to become generally available at Microsoft Ignite. The service is designed to help organisations keep code repositories and development assets within locally controlled environments, a consideration for businesses working with sensitive software, proprietary code or tightly regulated systems.
Microsoft is also expanding Foundry Local, which will become generally available for connected and disconnected operations on Azure Local at Ignite. The service’s expanded model catalogue will include Microsoft’s own models alongside partner models, open-weight models and open-source options.
Foundry Local will also support natural-language interaction with local enterprise data through local inference and agentic retrieval. In practical terms, the capabilities are intended to let organisations use AI to work with business information without necessarily sending every request or data interaction to a remotely hosted service.
The disconnected operating option is particularly relevant for environments where internet connectivity is restricted or cannot be relied upon. Running AI locally could allow certain workloads to continue operating in those circumstances, although the precise capabilities available will depend on the deployment, models and applications involved.
Microsoft 365 Local is also available in preview to approved customers, extending the local operating model to Microsoft SharePoint and Exchange servers. Azure Local will support multitenancy as well, allowing organisations to separate management, governance and resources for different tenants while sharing infrastructure.
These additions broaden the range of workloads that organisations can potentially operate outside a conventional public cloud environment. Instead of limiting local deployments to a narrow set of applications, Microsoft is extending the approach across data storage, software development, collaboration and AI.
The company is also addressing the question of what happens when systems lose connectivity or face disruption. It is publishing new guidance and architecture patterns for sovereign business continuity to help organisations prepare for interruptions.
Connected-to-disconnected workload transitions are entering public preview, allowing organisations to plan for critical services that need to continue operating as connectivity conditions change. The capability is intended to help customers prepare for scenarios in which a workload must move between connected and disconnected modes rather than depend on uninterrupted internet access.
Microsoft’s Sovereign Partner Ecosystem is another part of the strategy. It includes independently operated cloud environments, specialised software providers and partners offering local implementation expertise. The company cited Bleu in France as an example of a national partner cloud for customers seeking an alternative ownership and operating model.
The partner approach gives organisations another route to meeting local requirements, particularly where the choice of operator or the structure of the service matters as much as the technology itself. It also means that sovereignty arrangements can differ across markets and deployments rather than follow one uniform model.
The broader challenge for cloud providers is that data sovereignty increasingly involves more than knowing where information is stored. Organisations may also need to consider who operates the infrastructure, who can access production systems, where encryption keys are held, how AI processes sensitive information and whether essential services can continue without connectivity.
Microsoft’s expanded portfolio addresses these issues through a combination of governance tools, external key management, confidential computing, locally operated applications and disconnected AI capabilities. The offerings do not all have the same availability status: some are generally available, others are entering public preview or limited preview, while several are scheduled for release at Microsoft Ignite.
For customers, that distinction will matter when deciding which capabilities can be deployed immediately and which still require further evaluation. Public preview and limited-preview services may not yet be ready for all production requirements.
The expansion also reflects the growing importance of control in enterprise AI adoption. As AI systems interact with internal documents, business processes and sensitive datasets, organisations must weigh the benefits of advanced tools against their requirements for privacy, oversight and operational continuity.
Microsoft is betting that the answer does not have to be an all-or-nothing choice between public cloud convenience and tightly controlled local infrastructure. Its strategy is to let organisations combine public cloud, customer-operated systems and partner services according to the needs of each workload.
Whether that flexibility meets individual regulatory and operational requirements will depend on how the services are configured and deployed. But the direction is clear: Microsoft is broadening its cloud offering for organisations that want the benefits of AI and cloud computing without surrendering control over every part of the underlying environment.