Microsoft Sovereign Cloud

Sovereign Public Cloud is not a separate Azure. It's the same control plane with a Sovereign Landing Zone (SLZ) laid on top: a stack of policy initiatives — L1 isolation, L2 confidentiality, L3 availability, plus a security baseline — assigned at specific management group scopes, and a Data Guardian boundary that keeps EU customer data stored, processed, and administered inside Europe.

Two structural starting points: a policy assignment that puts SLZ's L2 confidentiality controls on the Landing Zones management group, and a Managed HSM pool so the customer — not Microsoft — holds the root key. Treat both as a shape to adapt, not a copy-paste deploy: pin the exact provider and apiVersion against Microsoft Learn before you run them.

Terraform

resource "azurerm_management_group_policy_assignment" "slz_l2_confidentiality" {
  name                 = "slz-l2-confidentiality"
  management_group_id  = data.azurerm_management_group.landing_zones.id
  policy_definition_id = data.azurerm_policy_set_definition.slz_l2.id
  display_name         = "SLZ L2 - Confidentiality controls"
  description          = "Enforces private endpoints, CMK encryption and allowed-region restrictions for sovereign workloads."

  parameters = jsonencode({
    listOfAllowedLocations = {
      value = ["westeurope", "northeurope"]
    }
  })

  non_compliance_message {
    content = "This resource violates an EU Data Boundary control required for sovereign workloads."
  }
}

resource "azurerm_key_vault_managed_hardware_security_module" "sovereign_hsm" {
  name                       = "hsm-sovereign-weu-01"
  resource_group_name        = azurerm_resource_group.sovereign.name
  location                   = "westeurope"
  sku_name                   = "Standard_B1"
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  admin_object_ids           = [data.azurerm_client_config.current.object_id]
  purge_protection_enabled   = true
  soft_delete_retention_days = 90
}

Bicep

// Assign the SLZ L2 (Confidentiality) initiative at the
// Landing Zones management group scope.
resource slzL2Assignment 'Microsoft.Authorization/policyAssignments@2024-04-01' = {
  name: 'slz-l2-confidentiality'
  scope: tenant()
  properties: {
    displayName: 'SLZ L2 - Confidentiality controls'
    policyDefinitionId: slzL2InitiativeId
    parameters: {
      listOfAllowedLocations: {
        value: [
          'westeurope'
          'northeurope'
        ]
      }
    }
    nonComplianceMessages: [
      {
        message: 'This resource violates an EU Data Boundary control required for sovereign workloads.'
      }
    ]
  }
}

// Customer-managed key held in a Managed HSM pool
resource sovereignHsm 'Microsoft.KeyVault/managedHSMs@2024-11-01' = {
  name: 'hsm-sovereign-weu-01'
  location: 'westeurope'
  sku: {
    family: 'B'
    name: 'Standard_B1'
  }
  properties: {
    tenantId: subscription().tenantId
    initialAdminObjectIds: [
      currentUserObjectId
    ]
    enablePurgeProtection: true
    softDeleteRetentionInDays: 90
  }
}