Tested, not paraphrased.
Hands-on writing on Azure sovereignty: Microsoft Sovereign Cloud, Azure Local, landing zones, and migrations — with the labs to prove it.
Azure Just Set a Retirement Date for Arc's Key Vault Secrets Provider — Its Replacement Doesn't Support a Single Sovereign Cloud
Microsoft retires the Azure Key Vault Secrets Provider extension for Arc-enabled Kubernetes on October 9, 2027. Its recommended replacement, built for disconnected clusters, documents zero sovereign cloud support.
Read article →Azure's Copilot Migration Agent Has Two Data-Residency Guarantees, and Only One Is EU-Only by Default
Azure Migrate project data stays region-locked everywhere. The new Copilot migration agent's own conversational data gets that same guarantee automatically only if you're in the EU.
Read article →Regulated Environment Management Is Now Sovereign Control Panel — the Cloud Adoption Framework Still Calls It by the Old Name
The product page carries the rename notice as of August. Two Cloud Adoption Framework governance pages linking to the same URL are still introducing it by the retired name.
Read article →The Sovereign Landing Zone Accelerator Just Adopted Built-In Policy — on a Repo Microsoft Says It's Archiving
v1.1.0 finally moves Sovereign Landing Zone onto Azure Policy's built-in initiatives. The repo shipping that improvement carries its own banner: archived in the first half of 2026 — a window that's already closed.
Read article →CAF Renamed Landing Zones on October 1 — Sovereign Landing Zone's Governance Page Is Still a Month Behind
The Cloud Adoption Framework retired "application landing zone" for "workload landing zone" across its guidance on October 1. Sovereign Landing Zone's own governance page was last touched September 4 and still uses the old term in every section, including Azure Local disconnected mode.
Read article →SQL Server on Azure VMs Is GA in Azure Bleu — Bleu Itself Still Isn't SecNumCloud-Qualified
Microsoft marked SQL Server on Azure VMs generally available in Azure Bleu on October 5, framed around "data residency and sovereignty requirements." Bleu itself passed its SecNumCloud 3.2 audit milestone in 2025 but still hasn't been qualified — and eligibility is restricted to begin with.
Read article →AKS Flex Nodes: The Data-Residency Pitch the Shared-Responsibility Table Doesn't Back Up
AKS Flex Nodes went to public preview on September 22, pitched partly as a way to pin regulated workloads to on-premises hardware. Microsoft's own support policy hands you the network, the CNI, the host, and the residency enforcement itself.
Read article →Azure Payment HSM v2 Enters Preview With "Key Sovereignty" in the Docs — Its Compliance Page Hasn't Caught Up
Azure Payment HSM v2 went to public preview on September 17 in West US and West Europe, with Microsoft's own docs using the phrase "key sovereignty." Its predecessor ships a 14-standard compliance page with Germany C5 and downloadable Service Trust Portal attestations. The v2 docs don't have one yet.
Read article →Confidential VMs for Azure Linux Are GA on AKS — But Not on the Hardened Image You'd Actually Deploy
AKS confidential VM node pools reach GA for Azure Linux on September 1. The catch: Azure Container Linux — the immutable, SELinux-enforcing image built for exactly this kind of workload — is explicitly excluded, alongside FIPS, Trusted Launch, and ARM64.
Read article →Azure Monitor's Cheap Compliance-Log Plan Goes GA in Sovereign Clouds — Minus the Control Your Auditor Asks About First
Auxiliary Logs — Azure Monitor's low-cost, 12-year-retention plan built for auditing and compliance — is now GA in Azure Government and Azure China. Read the table plan comparison and it skips Customer Lockbox, the one control that actually governs who can touch your compliance data.
Read article →The Cyber Resilience Act's First Real Deadline Is 11 September — and It's Not the Law You Think It Is
EU Cyber Resilience Act reporting obligations go live on 11 September: 24-hour disclosure of actively exploited vulnerabilities and severe incidents. It's easy to confuse with NIS2 — it isn't the same law, and for anyone shipping Arc-connected or Azure Local appliances, it's closer than it looks.
Read article →Azure VM Image Builder Goes GA in Sovereign Clouds — But Not the Ones Europe Cares About
Microsoft just gave VM Image Builder parity across Azure Government, China North 3, and the Secret/Top Secret clouds. Here's what that tooling parity actually closes — and why it still leaves the EU Sovereign Cloud and Azure Local disconnected gaps untouched.
Read article →Azure Local 2608's Key Vault Split: A New BYOK Preview, and a KMS Warning Nobody's Enforcing
Multi-rack deployments can now supply their own key to encrypt secrets before Key Vault ever sees them. Meanwhile, AKS Arc keeps repeating a KMS v1 deprecation warning that hasn't changed since release 2510. Two very different stories, easy to conflate.
Read article →Azure Enclave: Microsoft's Prefab Answer to "Build Us a Sovereign Landing Zone"
A new public preview promises to cut the time to deploy an isolated, policy-governed cloud environment from months to days — and it ships pre-approved for Azure Government Secret and Top Secret. Here's what it actually is, and what's still unproven.
Read article →Rack-Aware Clustering: Azure Local's Answer to "We Can't Replicate Outside This Building"
Azure Local 2608 quietly shipped a second local availability zone architecture — two racks, one storage pool, no second site required. Here's what it actually requires, and the tradeoff nobody's flagging.
Read article →Azure Local 2608: The Portal Finally Manages the Fleet — But Not the Disconnected Half
August's release brings Arc Site Manager, portal-driven node scale-out, and GPU management from Azure. All three assume a live connection to Azure — which is exactly the half of this platform's sovereignty story they don't touch.
Read article →AVS License-Included Is Retiring: The VMware Decision Every Sovereign Cloud Customer Now Has a Deadline For
Microsoft just put a hard date on the last way to run VMware on Azure without buying Broadcom's full VCF bundle. Here's what that retirement actually forces, and why it puts Azure Local back on the table.
Read article →Running Mistral on Azure Local Disconnected: What It Actually Takes
Microsoft and Mistral just promised frontier AI in fully disconnected environments. Here's the architecture behind that promise — and the questions the press release doesn't answer.
Read article →Why I'm betting on Azure sovereignty
Europe's sovereignty conversation moved from policy papers to procurement. Here's why I'm focusing my practice on Microsoft Sovereign Cloud and Azure Local — and what this site will deliver.
Read article →