Key takeaways
- Microsoft Sovereign Cloud in three variants: Public and Private (on Azure Local) as well as National Partner Clouds in France and Germany
- Three new capabilities: Data Guardian (EU-only personnel for remote access), External Key Management (customer-controlled encryption) and Regulated Environment Management
What is the Microsoft Sovereign Cloud?
The Microsoft Sovereign Cloud is a suite of cloud offerings and features that allows organizations and government agencies in Europe and Switzerland to determine for themselves where their data is stored, who can access it, and who controls the encryption keys. In Switzerland, it is available as both a public and a private cloud.
Microsoft introduced the offering in June 2025, initially as a preview. The sovereignty features are now available in all European data center regions, including Switzerland. The idea behind it: many Swiss organizations want to leverage the benefits of the cloud but must meet strict requirements regarding data protection, data residency, and resilience. The Sovereign Cloud brings both together without requiring you to give up familiar tools like Microsoft 365, Azure, or Microsoft Security.
Why digital sovereignty is important for Swiss companies
Digital sovereignty means that a company can make its own decisions regarding its data and IT systems. For Swiss companies, three points are particularly relevant.
The Revised Federal Act on Data Protection (FADP): The revised FADP has been in effect in Switzerland since September 1, 2023. Among other things, it requires companies to know where personal data is being processed and to implement appropriate technical and organizational measures. Additional requirements apply if data is disclosed abroad.
Industry requirements: Banks and insurance companies must meet FINMA requirements for outsourcing. Hospitals, public administrations, and operators of critical infrastructure are subject to their own regulations regarding data storage and resilience. It is often crucial that data remains in Switzerland and that access is fully traceable.
The US CLOUD Act: This US law allows American authorities to request data from US providers under certain conditions, even if that data is stored in Switzerland. For many Swiss companies, this is the primary reason for exploring sovereign cloud solutions. Having your own keys and controlled access significantly reduces this risk.
Read how you can centrally manage data protection and compliance in your Microsoft environment on our page about Data protection and compliance with Microsoft Purview.
Public or Private Cloud? Comparing the options
With the Sovereign Cloud, the customer is king. Swiss companies can choose between two variants, which differ in who operates the infrastructure and the extent of your control.
For most Swiss companies, the Sovereign Public Cloud is the obvious starting point: you use familiar Microsoft services in Swiss regions and supplement them with additional controls, without having to move to separate data centers.
The Sovereign Private Cloud is worthwhile if business-critical communication and collaboration solutions are to run in your own data center or with a Swiss partner. It is based on Azure Local, which integrates Microsoft 365 Local and the Microsoft Security platform, and meets high requirements for resilience and business continuity. You can find out how we implement and operate Azure Local for Swiss companies on our Azure Local expertise page. You can find more about the possibilities of a modern sovereign cloud infrastructure in our solutions section.
Sovereignty features at a glance
Regardless of the variant, Microsoft provides three features that allow you to become more independent and strengthen control over your data. All three are also available in the Swiss regions.
Data Guardian: Remote access only by personnel in Europe
Data Guardian expands the promise of the EU Data Boundary. When this feature is active, only Microsoft employees residing in Europe are permitted to log into your systems and administer them remotely. Remote access is approved and monitored in real time, and every access event is logged in a tamper-proof ledger. This allows you to demonstrate to auditors and FINMA who accessed what and when.
External Key Management: Keys in your own hands (HYOK)
External Key Management complements Azure Managed HSM and enables fully customer-controlled encryption. You connect Azure with keys on your own hardware security modules (HSM), on-premises in Switzerland or with a trusted third-party provider. This principle is also known as "Hold Your Own Key" (HYOK). Without your keys, the data remains unreadable, even to Microsoft.
Regulated Environment Management
Regulated Environment Management consolidates the administration of all sovereignty features in one place. You configure policies centrally and maintain an overview at all times of whether your environment meets the defined requirements. This saves effort during audits and reduces the risk of misconfiguration.
Microsoft 365 Local and Azure Local: Local control complements the cloud
For Swiss companies that want to operate central services on-premises, Azure Local and Microsoft 365 Local form the foundation of the Sovereign Private Cloud.
Azure Local (formerly Azure Stack HCI) provides Microsoft cloud services directly at your locations. This allows you to meet requirements for data residency and data sovereignty. Azure Local is particularly suitable for services that need to run close to where data is generated or regulated: in Switzerland, on-premises, or in partner data centers. You manage the local infrastructure using the same tools as your cloud resources. Azure Local now also supports larger environments with hundreds of servers, external SAN storage, and the latest GPUs for AI applications. You can find out everything else about the platform on our page for Azure Local.
Microsoft 365 Local brings familiar Microsoft services together in an Azure Local environment that can run entirely within your own data center. Specifically, you operate Exchange Server, SharePoint Server, and Skype for Business Server on Azure Local. The solution is based on a validated reference architecture and is now generally available. You retain full control over security, compliance, and governance, and email, document storage, and communication continue to function even if the connection to the public cloud is interrupted.
Microsoft Cloud in Switzerland: Data centers and data boundary
Microsoft has been operating its own cloud regions near Zurich and Geneva since 2019. This allows Swiss companies to store their data within the country while meeting disaster recovery requirements, as two locations are available within Switzerland.
In addition, the EU Data Boundary applies to the EU and EFTA states. It ensures that customer data for Microsoft 365, Dynamics 365, Power Platform, and most Azure services is stored and processed within this region. This has recently been extended to include data processing for AI services. You can find out how to Microsoft Azure securely integrate these into your IT landscape on our Azure page.
Which option is right for your company?
The following checklist will help you with an initial assessment:
- You want to store data in Switzerland and track access: Swiss region plus Sovereign Public Cloud with Data Guardian.
- You need to ensure that only you can decrypt your data: plus External Key Management (HYOK).
- Certain data must not leave your data center: Sovereign Private Cloud with Azure Local.
- Email and collaboration must continue to function even during a cloud outage: Microsoft 365 Local.
- You are subject to the requirements of FINMA or other regulatory authorities: A combination of public and private cloud, tailored to your compliance requirements.
In practice, many companies combine several building blocks. The key is to classify your data and determine the appropriate level of protection for each data category. Our cloud consulting.
Cloud Assessment: How Baggenstos can support you
As a Swiss Microsoft partner, we guide companies on their journey toward a sovereign cloud. In our cloud assessment, our specialists work with you to determine:
- which data and applications require the highest level of protection,
- which requirements from the revised FADP, FINMA, or your specific industry apply to you,
- which combination of public cloud, private cloud, and sovereignty features makes the most sense.
Based on this, you will receive a concrete architectural proposal, including the estimated effort and next steps.
You might also be interested in
