On September 1, Azure Updates confirmed that the Auxiliary table plan in Azure Monitor Logs is now generally available in Azure Government (Fairfax) and Azure China (operated by 21Vianet), alongside a companion release adding Azure standard table support and in-place plan switching — moving an existing table between Analytics and Auxiliary without recreating it. Microsoft's own recap frames these as three long-standing customer requests shipping together. Two of the three are straightforward tooling improvements. The third — sovereign cloud availability — is the one worth reading past the headline for.
What Auxiliary Logs actually is
Azure Monitor Logs ships three table plans: Analytics (full interactive queries, the expensive default), Basic (cheaper, reduced feature set, for troubleshooting), and Auxiliary — the low-touch, low-cost tier Microsoft positions explicitly for "verbose logs" and "data required for auditing and compliance," retained in-workspace for up to twelve years. It was already generally available across essentially every commercial Azure region except Qatar Central. What shipped on September 1 is the extension of that same plan into the two boundaries where it wasn't available before: US federal (Azure Government) and China.
Framed that way, this is a real and useful gap-closer — the same pattern I flagged in last week's VM Image Builder GA: another tooling parity story where "sovereign clouds" means the US federal and China boundaries, not the European ones. Auxiliary Logs was already sitting in EU Data Boundary regions as part of commercial Azure; nothing about this release changes anything there. If your practice is EU-focused, the honest takeaway is narrower than the headline: this closes a gap for Azure Government and China customers, not a European one.
The gap that's still open, in every region
Here's the part that applies everywhere Auxiliary Logs runs, EU included. Microsoft's own table plan comparison lists what each plan supports. Analytics and Basic both get a ✅ on Customer Lockbox — the control that requires your explicit approval before a Microsoft support engineer can access your data during a support case. Auxiliary gets a ❌. The plan Microsoft markets by name for "auditing and compliance" is the one plan in the lineup where the access-approval workflow an auditor would actually ask about isn't available.
It doesn't stop at Lockbox. On the same table, Auxiliary also shows ❌ for Alerts, Insights, Data export rules, the Export job preview, Restore, and Workspace replication. What it does keep: Microsoft Sentinel ingestion, search jobs, and single-table summary rules. So the realistic use case is narrow and specific — cheap long-term storage for verbose logs you rarely query, that you can still hunt through via Sentinel or a search job if an incident demands it, but that you can't alert on directly, can't export via a standing rule, can't restore from long-term retention the way you can with Analytics or Basic, and can't replicate across regions for resilience.
Why the naming is the trap
None of these are hidden — they're in a published comparison table, not fine print. The risk is the naming. A compliance officer who hears "there's a plan called Auxiliary, purpose-built for auditing and compliance, and it's now GA in our sovereign cloud" reasonably assumes it inherits the governance controls of the plans around it. It doesn't. Cost efficiency and long retention are real; the access-governance layer that usually accompanies "compliance" workloads is a separate line item you still architect for — most likely by keeping your genuinely sensitive, access-controlled logs on Analytics or Basic, and reserving Auxiliary for the high-volume, low-sensitivity verbose data it's actually built for.
What's not answered yet
- No stated roadmap for Customer Lockbox on Auxiliary. Nothing published commits to closing this gap, in any region.
- No confirmation of feature parity timeline between Azure Government/China and commercial regions beyond this specific GA — whether Restore or Workspace replication ever reach Auxiliary in any boundary is unaddressed.
- No mention of Sovereign Public Cloud or EU Data Boundary in the release note — consistent with this being a US-federal/China parity story, not a new European capability.
Who should care
Azure Government and Azure China customers get a genuine win: the same low-cost, long-retention log tier commercial customers have had, finally available in their boundary, plus table-switching flexibility that makes adopting it less risky. For anyone advising on log architecture in a regulated or sovereign landing zone anywhere — EU included — the more durable lesson is the table-plan comparison itself: "built for compliance" describes retention economics here, not an access-governance upgrade. Check the row for Customer Lockbox before you route audit-critical logs to the cheap plan.
A table plan can be named for compliance and still ship without the one control your compliance team will ask for by name. Read the comparison table, not the plan name.
I'm tracking whether Customer Lockbox ever lands on Auxiliary tables — that's the change that would actually make "compliance plan" mean what it sounds like. If you want that update when it lands, subscribe to Sovereign Cloud Watch or find me on LinkedIn.