ComputePublished Top storyAll news from that day
Microsoft lets Azure customers keep root encryption keys outside Azure
In a post of 20 October 2026, Microsoft said external key management with Azure Managed HSM is generally available and Data Guardian is rolling out for EU and EFTA customers.
Check our sources · 6 facts from 1 source
Illustration made with AI for ai notis
Key points
- Microsoft says external key management with Azure Managed HSM is generally available, so customers can hold the root encryption key in hardware they operate or via a trusted third party.
- Data Guardian is rolling out for EU and EFTA customers and adds European-resident oversight by a trusted EU partner of qualifying Microsoft engineer remote access to in-scope production systems.
- Confidential virtual machines on Azure Local are generally available. GitHub Enterprise Local and Foundry Local will become generally available at Microsoft Ignite.
What happened
Microsoft's post of 20 October 2026 sets out its sovereign cloud offer for European customers. External key management with Azure Managed HSM is generally available, so customers can keep the root encryption key in hardware they own or run through a trusted third party.
Data Guardian is rolling out for EU and EFTA customers, adding European-resident oversight of certain Microsoft engineer remote access. SQL Server and confidential virtual machines on Azure Local are generally available. Several items, including GitHub Enterprise Local and Foundry Local, are described as arriving at Ignite.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 2 of 6 · from Microsoft, 20 Oct 2026
External key management with Azure Managed HSM is now generally available, allowing customers to keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.
Fact 3 of 6 · from Microsoft, 20 Oct 2026
For customers in the European Union (EU) and the European Free Trade Association (EFTA), we are rolling out Data Guardian, which adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.
Fact 4 of 6 · from Microsoft, 20 Oct 2026
SQL Server on Azure Local is already generally available for connected and disconnected deployments. ... Confidential virtual machines on Azure Local are generally available, extending confidential computing capabilities to customer-controlled infrastructure.
What it means for you
Our viewMicrosoft describes these as sovereignty controls for European customers. Available now are external key management with Azure Managed HSM and confidential virtual machines on Azure Local.
Data Guardian is still rolling out, and GitHub Enterprise Local and Foundry Local will become generally available at Microsoft Ignite, so neither can be planned on as available today. The post is Microsoft's own description, and it does not show how these controls compare with what a regulator or a customer contract may require.
If you handle data under EU rules, ask Microsoft when Data Guardian reaches your tenant, and have your security team check who would hold the key under external key management.
It adds no new facts.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Advancing digital sovereignty with greater control and choice
Open the source archived copy-
Microsoft's post of 20 October 2026 is titled Advancing digital sovereignty with greater control and choice and is written by Douglas Phillips, President and CTO of Microsoft Specialized Clouds.
citeAdvancing digital sovereignty with greater control and choice Oct 20, 2026 | Douglas Phillips - President and Chief Technology Officer, Microsoft Specialized Clouds
-
The post says external key management with Azure Managed HSM is generally available, letting customers keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.
citeExternal key management with Azure Managed HSM is now generally available, allowing customers to keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.
-
The post says Data Guardian is rolling out for EU and EFTA customers and adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.
citeFor customers in the European Union (EU) and the European Free Trade Association (EFTA), we are rolling out Data Guardian, which adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.
-
The post says SQL Server on Azure Local and confidential virtual machines on Azure Local are generally available.
citeSQL Server on Azure Local is already generally available for connected and disconnected deployments. ... Confidential virtual machines on Azure Local are generally available, extending confidential computing capabilities to customer-controlled infrastructure.
-
The post says GitHub Enterprise Local and Foundry Local will become generally available at Microsoft Ignite.
citeGitHub Enterprise Local will become generally available at Microsoft Ignite as a validated GitHub Enterprise Server appliance on Azure Local ... At Ignite, Foundry Local will become generally available for connected and disconnected operations on Azure Local
-
The post names Bleu Cloud in France and Delos Cloud in Germany as independently operated National Partner Clouds.
citeNational Partner Clouds, including Bleu Cloud in France and Delos Cloud in Germany, provide independently operated environments for customers that require a different ownership and operating model.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · Microsoft · 20 Oct 2026
Advancing digital sovereignty with greater control and choice
Microsoft's post of 20 October 2026 is titled Advancing digital sovereignty with greater control and choice and is written by Douglas Phillips, President and CTO of Microsoft Specialized Clouds.
Advancing digital sovereignty with greater control and choice Oct 20, 2026 | Douglas Phillips - President and Chief Technology Officer, Microsoft Specialized Clouds
The post says external key management with Azure Managed HSM is generally available, letting customers keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.
External key management with Azure Managed HSM is now generally available, allowing customers to keep the root encryption key in hardware they own and operate on-premises or through a trusted third party.
The post says Data Guardian is rolling out for EU and EFTA customers and adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.
For customers in the European Union (EU) and the European Free Trade Association (EFTA), we are rolling out Data Guardian, which adds European-resident oversight by a trusted EU partner for qualifying Microsoft engineer remote access to in-scope production systems.
Show all 6 factsShow fewer facts
The post says SQL Server on Azure Local and confidential virtual machines on Azure Local are generally available.
SQL Server on Azure Local is already generally available for connected and disconnected deployments. ... Confidential virtual machines on Azure Local are generally available, extending confidential computing capabilities to customer-controlled infrastructure.
The post says GitHub Enterprise Local and Foundry Local will become generally available at Microsoft Ignite.
GitHub Enterprise Local will become generally available at Microsoft Ignite as a validated GitHub Enterprise Server appliance on Azure Local ... At Ignite, Foundry Local will become generally available for connected and disconnected operations on Azure Local
The post names Bleu Cloud in France and Delos Cloud in Germany as independently operated National Partner Clouds.
National Partner Clouds, including Bleu Cloud in France and Delos Cloud in Germany, provide independently operated environments for customers that require a different ownership and operating model.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep