Microsoft expanded its sovereign cloud offerings on Tuesday, adding new security, governance and AI capabilities as customers, particularly in Europe, demand greater assurance over where data is stored, who can access it and how critical services operate during disruptions.

The announcement builds on Microsoft’s ongoing digital sovereignty efforts, assisting organizations in applying appropriate levels of control to each workload rather than forcing a rigid, one-size-fits-all approach.

“Organizations are considering more than where data resides. They also seek to understand who can access and operate their systems, how sensitive digital assets remain protected, which technology dependencies matter most and whether critical services can continue as regulatory, geopolitical, security or network conditions change,” Douglas Phillips, president and CTO at Microsoft Specialized Clouds, said in a blog post.

The developments come amid growing international scrutiny of how global tech providers handle sensitive data and the extent of control customers retain over their digital infrastructure.

“Three factors are driving this, including stricter data regulations, rising geopolitical tensions, and growing AI adoption,” said Pareekh Jain, CEO at EIIRTrend & Pareekh Consulting. “Governments and enterprises want greater control over where their data is stored, who can access it, and whether critical systems can operate during disruptions. For instance, governments and big enterprises in Europe are worried about keeping their important data on an American company’s computers. Europe has proposed a new law that would limit the use of US cloud companies for sensitive government data in many areas. Microsoft is responding to these concerns while competing with local sovereign cloud providers.”

New controls across cloud and AI workloads

Microsoft is introducing the Sovereign Control Panel, a unified Azure portal experience that will allow organizations to assess their sovereignty posture, identify risks and gaps, apply controls, and evaluate workload portability. The panel is scheduled to enter public preview at Microsoft Ignite.

Expanding on Azure Key Vault Managed Hardware Security Module (HSM), which gives customers dedicated protection over encryption keys, Microsoft is now extending control beyond its own infrastructure. External key management with Azure Managed HSM is now generally available, enabling organizations to keep root encryption keys in hardware they own and operate on-premises or through a trusted third party.

In limited preview, Azure Confidential Clean Rooms will use confidential computing to support collaboration involving sensitive data, where participants will be able to analyse shared information while limiting broader exposure of the underlying data.

Microsoft is also expanding Azure Local to bring more cloud capabilities into customer-operated environments. The ability to transition workloads between connected and disconnected states is entering public preview. Additionally, DocumentDB and Blob Storage are entering public preview on Azure Local, while SQL Server on Azure Local is already generally available for connected and disconnected deployments.

On the AI front, Foundry Local is scheduled to become generally available at Microsoft Ignite for connected and disconnected operations on Azure Local. It will support local inference and agentic retrieval in natural language, backed by an expanded model catalog from Microsoft, partner networks, and the open-source community.

To further protect data during processing, Confidential Virtual Machines on Azure Local is now generally available, leveraging hardware-encrypted memory and isolation alongside workload attestation before sensitive keys or data are released.

While these additions give enterprises greater flexibility, industry analysts emphasize that localized deployments do not automatically erase vendor dependency.

“Depending upon the deployment model, in the public cloud, enterprises get better visibility, stronger access controls, and more control over encryption keys,” said Ashish Banerjee, senior principal analyst at Gartner. “In the Sovereign Private Cloud, they can operate infrastructure locally and even disconnect selected workloads from Azure. But I would not call this complete control. Enterprises still need to check whether Microsoft remains involved in identity, software updates, management, or technical support for the services they use.”

The article originally appeared on CIO.

European oversight and partner options

For customers in the EU and the European Free Trade Association (EFTA), Microsoft is rolling out Data Guardian. Under this model, a trusted regional partner will provide independent oversight of remote access requests by Microsoft engineers. Simultaneously, a Production Touch Ledger will create tamper-evident logs of all technical actions performed.

Microsoft is also broadening its Sovereign Partner Ecosystem, highlighting regional operators like Bleu Cloud in France and Delos Cloud in Germany, alongside independent software vendors specializing in security, identity, observability, and backup.

Geopolitical realities and market limits

Despite these additions, analysts note that technical controls cannot eliminate geopolitical dependence entirely. US hyperscalers (Amazon, Google, and Microsoft) continue to account for roughly 70% of the European cloud market, whereas European providers’ market share has contracted over the last decade.

The new measures introduced under Microsoft Sovereign Cloud do reduce risks but cannot eliminate them. “Local infrastructure, independent encryption keys, and disconnected operations make it harder for external parties to access data or disrupt services. However, Microsoft remains subject to applicable US laws, sanctions, and export restrictions. Enterprises gain greater operational independence but not complete legal or technological independence,” added Jain.

Furthermore, while sovereign cloud capabilities can offer greater control over data, infrastructure, and operations, this often comes with trade-offs in cost, performance, scalability, and access to services.

Banerjee noted that sovereignty should be assessed workload by workload, rather than applied as a label to the entire cloud environment. Greater sovereignty generally comes with greater cost and responsibility. Local or disconnected environments may not receive every Azure service at the same time. Enterprises may also need dedicated infrastructure, specialist skills and separate continuity arrangements. On top of that, they may lose some elasticity and economies of scale.

“So, I would not recommend maximum sovereignty for every workload. Reserve it for workloads where the legal, operational or geopolitical risk genuinely justifies the additional complexity,” added Banerjee.

Take a close look at your monthly software bills. The charges that once seemed small and separate can add up to a new kind of dependency: subscriptions for word processing, creative tools, storage, and now AI features bundled into products, whether you asked for them or not.

For many people, it’s no longer a choice between buying software or renting it. The software they used to run on a PC increasingly depends on an account, an internet connection, a cloud service, or a particular plan. Even when an application runs locally, its essential features may rely on online authentication, remote storage, or services that can change without much notice.

Microsoft and Adobe are prominent examples of this shift. Their subscriptions offer real benefits, including frequent updates, collaboration, and access across devices. But people who are looking for a dependable word processor or video editor can find themselves navigating bundles, account requirements, cloud storage prompts, and AI features they don’t want. Users are growing frustrated that they have little choice about being forced into cloud services.

Interest in local computing

The response is a renewed interest in local computing: software that runs on a person’s own computer, stores work where they choose, and does not require a recurring payment for basic use. This isn’t a rejection of cloud computing. It’s a demand for a more balanced relationship between local machines and remote services. Home users and small businesses are turning to open source and other locally installed applications. They may not offer every advanced feature of a commercial suite, but many users don’t need every feature. If a free, locally run tool can handle the work, then “good enough” can be a rational decision.

The same logic applies to AI. Some users want powerful models hosted in the cloud. Others want to experiment with AI on their own hardware, keep sensitive information close, or avoid paying for an always-online service. Local AI still has limitations, including hardware demands and uneven performance. But it gives people another option, and options matter when customers feel locked into a remote service.

Cloud computing is also no longer limited to systems an organization deliberately chooses to put in a public cloud. It is embedded in everyday software. A productivity application can depend on identity services, online licensing, synchronization, remote storage, telemetry, or AI services. A tool that looks like a desktop program may be part of a much larger cloud relationship. Such an arrangement can be useful. Centralized updates and shared documents make work easier for distributed teams. But when software depends on a provider’s back end, the organization inherits risks it may not have assessed: outages, price changes, loss of access, data retention questions, and shifting product terms.

Users are voting with their feet when they choose local alternatives. Providers should read that vote as feedback, not nostalgia. Customers want the convenience of cloud services without surrendering control over where their software runs, where their files live, or whether an AI assistant is part of the package.

Providers should offer real options

The answer is not to abandon cloud platforms. For many workloads, cloud infrastructure remains the best option for scale, resilience, collaboration, and access to managed services. The answer is to stop treating cloud dependence as the inevitable price of using modern software.

Providers can make the choice real by offering offline access where practical, clear and durable licensing, straightforward file export, and local storage as a genuine option. They should explain which features require connectivity and what happens when a subscription ends. If AI is included, users should be able to understand what it does and how to turn it off without losing unrelated functionality.

This is not just a consumer relations issue. It is strategic planning. Enterprises should consider three things now.

First, inventory the software employees rely on and identify which functions depend on a vendor’s cloud. Include desktop applications, browser extensions, identity systems, storage, and AI features. Record what breaks during an outage or after a license expires. A dependency map can reveal that a supposedly local workflow relies on remote services for authentication, collaboration, or even basic operation. That knowledge helps organizations plan for continuity and negotiate from a position of understanding.

Second, establish policies for where work data may be stored and processed. Decide which information can go to external services, which AI tools are approved, and how employees can use local alternatives. These rules should be practical enough to follow. A blanket prohibition may drive users toward unsanctioned tools. A clear set of approved choices can reduce risk while recognizing that teams have different needs.

Third, build flexibility into long-term procurement and architecture. Evaluate products not only for features and subscription cost, but also for offline capability, data portability, exit terms, and support for local deployment. Keep important workflows from depending on a single vendor when a reasonable alternative exists. This does not mean avoiding subscriptions. It means knowing what the organization receives for the recurring cost and how it can leave if the deal changes.

The local computing movement is a reminder that technology is valuable when it solves a problem on terms users and organizations can accept. For some needs, that’s a managed cloud service. For others, it’s a dependable application running on a computer the user controls.

Cloud providers that dismiss this movement risk confusing convenience with consent. Customers will keep choosing tools that fit their work, budgets, and privacy expectations, even when those tools are simpler. The winning strategy is not to force every workload into the cloud. It is to make cloud services compelling enough that customers deliberately choose them, while preserving a credible path to local computing when they do not.

Every quarter, I look at the capital expenditure numbers coming out of the major cloud providers, and every quarter, they manage to surprise me. This time, though, we’ve crossed into territory that’s genuinely hard to process. The five biggest US cloud and AI infrastructure providers (Microsoft, Alphabet, Amazon, Meta, and Oracle) have collectively committed to spending between $660 billion and $690 billion on capex in 2026, nearly doubling what they spent just a year ago.

Amazon leads the pack with a projected $200 billion, most of it directed at data centers and AI compute. Alphabet has committed $175 to $185 billion, up from $91 billion in 2025. Microsoft is tracking toward $120 billion or more, having already spent $37.5 billion in a single quarter. Meta is at $115 to $135 billion, and Oracle is targeting roughly $50 billion. For context, four companies alone plan to invest about $630 billion, a 62% increase from the record $388 billion they spent in 2025.

What are they buying? Mostly chips, buildings, and electricity. The spending splits across the AI data center stack: GPUs and custom accelerators such as Google’s Tensor Processing Units and Amazon’s Trainium, the physical data centers themselves with their liquid cooling and high-density floors, and often the power infrastructure to run it all, including power purchase agreements and even on-site gas-fired generation where the grid can’t keep up. Roughly two-thirds of the money goes to compute, and one-third goes to facilities, power, cooling, and networking, with the power share rising every quarter.

Where the market is heading

My take on the market is that we’re in the steep part of a demand curve that has a few more solid years left in it. Short-term demand over the next two years is already firm. Every hyperscaler reports being supply-constrained rather than demand-constrained, and Microsoft is sitting on an $80 billion backlog of Azure orders it can’t fulfill, largely because of power availability. Enterprises are panic-buying cloud capacity and computing gear right now because they’re convinced the AI boom will leave the unprepared behind, and they want their infrastructure in place so they can take advantage of whatever form the transformation takes. I get it. Nobody wants to explain to their board in 2028 why they spent 2026 waiting in line.

This means hardware vendors such as Dell, HPE, and IBM, along with the hyperscalers themselves, are going to see sustained growth as long as the demand continues. Some of it is real, and some of it is fear driven, but for the vendors, it all spends the same. The shortages enterprises are seeing today for processors and RAM, along with the associated price increases and stretched lead times, will most likely persist through that window because global silicon and memory supply is being absorbed by AI clusters faster than the manufacturers can expand it.

But my long-term forecast is deliberately less rosy than the providers’ own. The build-out cycle runs three to four years from commitment to full utilization. A lot can change in the AI market in that time. Model efficiency improvements could slash compute requirements per unit of output. Enterprises may discover that their AI workloads don’t justify the cloud spend once the novelty fades. Competitive dynamics could compress pricing. By 2028 and 2029, I expect the growth rate to be real but not at the scale builders assume today, and I expect the industry to carry the weight of capacity committed in the panic phase of 2026.

Are vendors overbuilding?

Here is where I part ways with the prevailing wisdom, and where I think we need some disciplined skepticism. The thinking right now is that for every bit of data center capacity you build, someone will use it, if not the hyperscaler that owns it, then some other tenant. Given Microsoft’s $80 billion backlog, that logic holds for the near term.

But I’ve been around long enough to be suspicious of “this time is different” arguments. I watched the fiber overbuild in the late 1990s, and I watched the first cloud buildout get ahead of itself as well. The concern is that the cloud providers are getting out over their skis, building capacity for demand that may not show up at the scale they’re projecting. The revenue those investments depend on is largely speculative. If AI adoption progresses more slowly than anticipated, or if efficiency gains reduce the compute required per workload faster than expected, the return on this spending could disappoint badly. There is also the uncomfortable possibility that a meaningful share of today’s demand is circular: Enterprises and vendors may be panic-buying capacity from each other in a stack of commitments that may never consolidate into actual sustained workloads.

By the time these data centers come online—and we’re talking about capacity committed now for delivery in 2027—the growth may not be at the scale the builders are expecting. I expect many of the data centers being committed now won’t be utilized at the rates people are assuming today for 2029. That’s not a prediction of collapse. It’s an acknowledgement that the industry has seen a similar pattern before in fiber, colocation, and the first cloud buildout itself.

Advice for enterprise buyers

If you’re running enterprise IT, this cycle cuts both ways. In the near term, you’re facing higher prices, allocation limits, and longer lead times for processors, RAM, and cloud capacity. Budget accordingly, lock in what you genuinely need, and resist buying out of the fear that drives the very shortages you’re suffering from.

But in the next few years, the picture flips. Overbuilt supply means lower prices. If the providers overshoot, then cloud rates soften and less expensive data center space becomes available for enterprises that need it, including capacity for your own AI ambitions at prices that would be unthinkable today. The overbuilding that will burn the hyperscalers’ investors will create a bargain for their customers.

The playbook I recommend is the one I’ve always recommended. Architect for the cloud on your own terms, stay out of long-term capacity commitments you can’t justify with current demand, and let the providers take the utilization risk. They’re betting hundreds of billions that the demand curve keeps climbing. You don’t have to make the same bet to benefit. The oversupply, if it comes, will find you, and at a price you’ll like a lot better than today’s.