Microsoft adds European oversight of its own engineers' access for EU and EFTA customers

Microsoft is starting to roll out an arrangement in which a European partner oversees remote access by Microsoft's own engineers to customers' production systems. The arrangement is called Data Guardian and applies to customers in the European Union and the European Free Trade Association (EFTA). At the same time, Azure customers can now keep the root encryption key in hardware they own, outside Microsoft's data centers.

Douglas Phillips, President and Chief Technology Officer of Microsoft Specialized Clouds, announced the changes on the Official Microsoft Blog on 20 October. According to Microsoft's RSS feed, the post was published at 08:20 UTC.

Oversight of Microsoft's own access

Data Guardian adds European-resident oversight by a trusted EU partner when Microsoft engineers get qualifying remote access to in-scope production systems. Microsoft says it is rolling the arrangement out, but does not name the partner, list the services in scope or say when the rollout will be complete.

Production Touch Ledger has launched with a phased rollout in the EU and EFTA. It creates tamper-evident records of that access and of the actions performed. It sits alongside Just-in-time Access and Customer Lockbox, which already give customers control over access to their environments.

Sovereign Control Panel is meant to bring the status of these controls together in the Azure portal. Microsoft says it enters public preview at Microsoft Ignite. The tool is designed to show gaps and risks and to help customers assess whether workloads can move to another operating environment.

The root key can stay with the customer

External key management with Azure Managed HSM is now generally available. Customers can keep the root encryption key in hardware they own and operate on-premises, or through a trusted third party. Microsoft describes this as an option for workloads that require physical control of key hardware outside Microsoft infrastructure.

Azure Confidential Clean Rooms is in limited preview. According to Microsoft, it lets several parties analyze shared sensitive data while limiting broader exposure of the underlying information.

AI and code on customer-run infrastructure

Most of the AI news concerns Azure Local, Microsoft's platform for running cloud services on customer premises. Foundry Local is set to become generally available at Ignite for both connected and disconnected operations. Microsoft says the model catalog includes Microsoft, partner, open-weight and open-source models. Local inference and agentic retrieval are meant to let users query local enterprise data in natural language.

GitHub Enterprise Local will become generally available at Ignite, according to Microsoft, so that repositories and development artifacts can stay under local control. Developers can use GitHub Copilot with locally hosted models. Integration with Microsoft 365 Local, covering locally operated SharePoint and Exchange servers, is in preview for approved customers.

Several building blocks are already in place or on the way. Confidential virtual machines on Azure Local are generally available. DocumentDB and Blob Storage on Azure Local are entering public preview. The ability to move workloads from connected to disconnected operation is also entering public preview. Microsoft also says Azure Local will support multitenancy on shared infrastructure, without giving a date.

What Microsoft does not say

The post gives no prices, no date for Ignite and no list of which Azure or Microsoft 365 services Data Guardian covers. It names Bleu in France as an example of a national partner cloud. It does not address legal questions about government access to data. Microsoft itself says the controls can support a broader digital sovereignty strategy that has to be aligned with an organization's legal, policy, security and business requirements.

What it means for leaders

Assessment: For organizations in the public sector, healthcare, finance and critical infrastructure that already use Azure, this gives them new questions to put to their supplier rather than a finished answer to control and vendor-dependency requirements.

• Ask Microsoft or your partner for a written list of the services Data Guardian and Production Touch Ledger cover, who the European partner is, and when your organization is included.
• External key management adds control but also moves responsibility in-house. Assessment: Operations, backup and contingency plans for the key hardware should be settled before adopting it.
• Foundry Local and GitHub Enterprise Local are announced, not shipped. Plans for AI on your own infrastructure should rest on what is actually available after Ignite, and on the cost of running the hardware yourself.

Sources and media

• Microsoft: "Advancing digital sovereignty with greater control and choice", by Douglas Phillips, published 20 October 2026 at 08:20 UTC according to Microsoft's RSS feed
• The source was checked on 20 October 2026.
• Illustration: AI-generated with Grok Bot / hogby.ai