Sovereign Washing 2.0

What Microsoft’s new Sovereign Cloud really means – and what it doesn’t

Microsoft has delivered. At least at first glance.

With the updated Sovereign Cloud roadmap from June 2025, the corporation responds to geopolitical tensions, European data protection requirements, and increasing regulatory pressure. New products like “Data Guardian,” “EU Data Boundary,” or “Microsoft 365 Local” aim to provide control and transparency for European customers.

The message is clear: You can trust us again.

The reality: You still have to.

Technical Advancement – Under Legal Control

Microsoft’s new Sovereign Cloud architecture is technically well thought out. Some highlights:

These measures undoubtedly offer more control – but no legal independence.

Because Microsoft is and remains a US company. Thus, the CLOUD Act applies. This law obliges US companies to hand over data to American authorities – regardless of where this data is stored. And regardless of whether the customer is aware of it.

This is not a theoretical threat. It is a practiced reality.

Control on Display – Trust in the Background

The new sovereign offerings are a toolbox. They allow European companies to better secure certain processes and data flows – within a system that still lies outside their legal sphere.

Technically more sovereign – legally not.

Even with External Key Management and local hosting, the factual control over infrastructure, updates, services, and backdoors remains with Microsoft. Whoever has access to the cloud platform controls the cloud. And whoever is subject to US law ultimately controls nothing themselves.

Why Microsoft Acts Anyway

That Microsoft is now delivering is not a sign of insight. It is a sign of market observation.

More and more European customers are asking uncomfortable questions:

• Where is our data stored – and who has access?
• What happens in the event of geopolitical tensions?
• How secure is compliance really if the infrastructure doesn’t belong to us?

And more and more companies are taking action. They evaluate alternatives, reduce dependencies, and rely on European providers. This creates pressure. And pressure creates change – at least on the surface.

The new sovereign offerings are exactly that:

An attempt to buy back trust. With features. Not with real sovereignty.

What Does This Mean for Companies?

The question is not: Should we use Microsoft or not?

Instead: What is our risk profile – and what control do we really need?

For many use cases, Microsoft is well-positioned. Those who need simple collaboration tools will continue to do well with Azure and Microsoft 365.

But for organizations with high demands on data protection, governance, and control – especially in regulated industries or the public sector – that’s not enough. It’s no longer about features. It’s about fundamental principles.

And this is where European providers come into play. Providers who are not bound by US law. Who operate infrastructure in European hands. Who do not base their business models on data aggregation. And who are willing to truly take responsibility for sovereignty – instead of simulating it.

Conclusion

Microsoft has improved. But not because they had to – but because they had to, to remain relevant in Europe.

The new tools offer more control. But no independence. Those who want to be sovereign must also build sovereignly. And that means: not just changing something in the cloud console. But thinking strategically.

Sovereignty is not a licensing option. It is a decision. A decision for genuine European cloud infrastructure and independent Kubernetes platforms that are truly under European control.