Microsoft's "sovereign" cloud: what it protects, what it doesn't

By the Archibou Team

On 20 October 2026, Microsoft presented a new "sovereign" cloud offering in Paris. It answers a real question: who accesses your data? It does not answer another: who can force Microsoft to hand it over? As long as the two questions are confused, the offering looks more protective than it is.

1. The word "sovereign" covers two questions

In the cloud debate, the word "sovereign" is used to mean two different things.

The first is access. Who can read, modify or copy your data while it sits with the provider? A Microsoft engineer, a subcontractor, an attacker, an over-curious administrator? That is a technical question. It is answered with access controls, logs, encryption and keys.

The second is legal compulsion. If a foreign judge orders the provider to hand over your data, can the provider refuse? That is a legal question. It is answered by the law that applies to the company holding the data, by the group structure and, sometimes, by encryption.

Microsoft has done a lot of work on the first. The second depends on something else.

An offering can therefore be excellent on security and insufficient on sovereignty.

2. What Microsoft added

Three new features matter, and they are concrete.

A European third party supervises remote access. When a Microsoft engineer works remotely on a system located in Europe, a European partner supervises the session and keeps a record. The goal is simple: know who enters, when, and what they do. Microsoft calls this Data Guardian.

The customer can keep the encryption key. A company can keep the root key in hardware it controls, on premises or with a trusted third party. Microsoft then stores data it cannot decrypt alone. That is the strongest protection against content being read.

Part of the service can run on premises. Azure Local lets Microsoft services run on the customer's premises, including without an internet connection. Useful when the service must keep running if the network fails, or when data must not leave.

3. What these tools really prevent

These are not empty marketing tools. For a hospital, a town hall or a company that must prove to an auditor who accesses its data, they change something: the risk of untraced access goes down, control of the keys is real, and the service can continue when the internet does not keep up.

They also address a real risk: administrative access by Microsoft, a subcontractor or an attacker. Data Guardian makes it visible and framed, and a customer-held key prevents Microsoft from reading the content, even if the service is compromised.

That is progress, and it should not be minimised.

4. What these tools do not prevent

Take a concrete case. A French company stores its documents with Microsoft, in a datacenter located in Paris. A US judge orders Microsoft to hand over those documents as part of an investigation.

What happens?

The CLOUD Act, a 2018 US law, lets a US judge order a US provider to produce data it possesses, keeps or controls, wherever it is stored.¹ The criterion is not the server location. The criterion is the link between the provider and US law.

Microsoft Corporation is a US company. The US entity of the group can receive the order. The European partner supervising access is not the service provider. It is therefore not the recipient. It can observe the access, it cannot cancel the order.

Neither the server location nor the partner's nationality blocks the request. The question is who the provider is under US law, and who controls the data.

Encryption with a customer-held key complicates producing the content. If Microsoft does not have the key, it cannot hand over a readable document. But that does not settle everything: metadata, backups, logs and unencrypted data remain accessible. And in some proceedings, the user themselves can be forced to provide the key. Encryption is a strong barrier, not immunity.

The European data protection authorities say it in their own way: technical measures may not suffice when the provider depends on the law of a third country.² That is not an opinion, it is a legal warning.

The GDPR and the EU-US data protection framework, the DPF, regulate transfers of personal data. They do not amend the CLOUD Act and do not cover non-personal data. That is another layer, useful but distinct.

5. Why a European partner is not enough

Microsoft's announcement stresses one point: engineers' access is supervised by a European partner. That is a good answer to the access question. It is not an answer to the injunction question.

The reason is simple: an order is addressed to a legal person. If the legal person providing the service is American, or controlled by an American company, it is the one that must respond. The European partner supervising access is not a party to the proceedings. It cannot object in Microsoft's place.

A European subsidiary, a contract with a European entity or local governance can change the answer. But you have to look at who signs the contract, who holds the data and who can receive an injunction. These are legal questions, not checkboxes in an interface.

This is where Bleu comes in. Bleu is a joint venture of Orange and Capgemini, 100% owned by European players. Since 15 October 2026 it has offered around a hundred Azure services, with centers in Île-de-France and Rennes, and aims for SecNumCloud qualification by the end of 2026. Microsoft 365 is targeted for the first half of 2027.³

Bleu changes the owner of the company operating the service, not the technology. That is already a lot for the legal question: a European company operating American technology can reduce exposure to an injunction, depending on the contractual structure. But the technical dependence remains, and qualification has not yet been granted. An offering "being qualified" is not a qualified offering.

6. The four European levels

To get out of the fog, the European Commission proposed in June 2026 to classify cloud offerings into four levels.⁴ It is not yet law, and the criteria may evolve. But the grid is useful.

Microsoft's offering sits between levels 1 and 2. Level 3 requires a European owner. Level 4 requires controlling the software, which is difficult with American code.

The sentence to remember is not an image: level 3 depends on who owns the company, not on an option in the Azure portal.

7. And the price?

The commercial side tells the same story as the technical side: control becomes an add-on.

Since 8 October 2026, new Microsoft 365 Family and Premium subscriptions go from 6 TB for six accounts to 2 TB shared, at the same price: €129 per year for Family, €219 for Premium. Existing subscribers switch at the first renewal from 2 May 2027.⁵ For a family using 4 TB, about 2 TB must be added, at about €20 per month, and the bill rises to about €369 per year.⁶ For businesses, prices rose by 5 to 17% on 1 July 2026, then by 5% on some subscriptions on 1 October.⁷

The detail will be the subject of the next episode. What to remember here: control is sold as a feature, and the storage cut is sold as an adjustment. Both moves point the same way, towards an add-on.

8. The three questions to ask before signing

Whether you are a family or a company, ask your provider these three questions.

1. Who owns the company holding my data? An American company, a foreign fund, a French company?
2. Which judge can order it to hand it over? A French judge, a US judge, both?
3. What protects me if that judge is not mine? A contract, a key I keep, a European subsidiary, nothing?

And a bonus question: what happens if the service is cut off tomorrow? Continuity is not sovereignty, but it is part of it.

For a hospital, the answer may be level 3, with a European operator. For a trivial app, level 1 may be enough. For family photos, the question is simpler: a French host, under French law, with no American parent company. That is Archibou's choice.⁸

9. What to remember

Microsoft did not lie. It answered a real question, the access question, and left the other open, the injunction question.

The lesson of the A/I case, told in the first episode, applies to everyone: even a European server with a European host can be copied for a foreign authority if the state cooperates. Sovereignty is not an address. It is a chain.

Microsoft has just strengthened a few technical links. It has not changed the legal link: the company receiving the request remains American.

So the right question is not "is this cloud sovereign?". It is "which level do I need, for which data, and who owns the company holding it?".

Next week: what the Microsoft 365 storage cut really costs you.

Article published by Archibou. November 2026.

May be freely shared and reproduced under CC-BY-4.0 licence, with attribution.