Capabilities of Sovereign Public Cloud

Microsoft’s Sovereign Public Cloud approach lets governments and regulated industries use the hyperscale Microsoft cloud and add controls for data residency, operational oversight, and customer‑controlled encryption. This article introduces four foundational capabilities and provides links to more information.

Data Guardian

Data Guardian enhances operational sovereignty by ensuring that authorized regional personnel approve and monitor remote access by Microsoft personnel to sovereign‑region services. All access is recorded in a tamper‑evident ledger.

Data Guardian helps customers:

• Establish local oversight for support and operator actions.
• Provide transparent, auditable operations via immutable logs.
• Build trust while retaining the benefits of the hyperscale cloud.

For more information, see Data Guardian.

External Key Management

External Key Management allows customers to generate, store, and manage encryption keys outside Microsoft’s cloud boundary (for example, in customer‑operated or trusted third‑party HSMs) while still using those keys with Azure services.

External Key Management enables customers to:

• Maintain exclusive control over encryption keys.
• Align with regulatory expectations for key ownership and residency.
• Add a defense‑in‑depth layer separating cloud operations from key custody.

For more information, see External Key Management and Encryption overview.

Confidential Computing

Confidential Computing protects data in use by running computations inside hardware‑based Trusted Execution Environments (TEEs). Azure offers confidential options for VMs and containers.

Confidential Computing:

• Complements encryption at rest and in transit by protecting data in memory.
• Helps address operational access concerns by limiting visibility during processing.
• Aligns with sovereign landing zone patterns for confidential workloads.

For more information, see Confidential Computing and Sovereign Landing Zone.

Sovereign Control Panel (SCP)

Sovereign Control Panel (SCP) is a unified Azure portal experience for viewing, managing, and evaluating sovereignty posture across tenant resources. It aggregates sovereignty signals into a centralized and intuitive console for end users and reviewers to view and verify sovereignty requirements.

For more information, see Sovereign Control Panel.

Choose the right capability for your goal

The following table summarizes how these capabilities help address common sovereignty goals.

How these capabilities work together for sovereign workloads

Sovereign Public Cloud capabilities are most effective when used with policy‑as‑code guardrails and reference architectures. Sovereign Landing Zone (SLZ) applies region/location, encryption, and configuration policies to create a compliant baseline for workloads.

See also

• External Key Management
• Data Guardian
• Confidential Computing
• Sovereign Control Panel
• Discover Microsoft Sovereign Cloud (product overview and EU focus)
• Sovereign Landing Zone overview