Microsoft 365 Sovereignty & Compliance Audit (EU, 2026)

Microsoft Corporation is incorporated in the United States (Redmond, Washington) and is subject to US federal law, including the CLOUD Act.

**GDPR**: Microsoft offers a comprehensive Data Processing Addendum, EU Data Boundary commitments, and extensive compliance documentation. Microsoft 365 can be configured to store core customer data at rest within the EU. However, GDPR compliance does not address the fundamental jurisdiction question—Microsoft remains subject to US government data access requests regardless of data location.

**CLOUD Act / Extraterritorial Access**: As a US company, Microsoft can be compelled to produce customer data stored anywhere in the world. Microsoft has publicly committed to challenging requests that conflict with foreign law, and publishes transparency reports. However, no contractual provision can override US statutory obligations.

**NIS2**: Microsoft 365 is widely used by entities classified as essential or important under NIS2. Organisations relying on Microsoft 365 for critical operations should assess whether US jurisdictional exposure creates unacceptable supply chain risk under NIS2 Article 21 requirements.

**DORA**: Financial entities using Microsoft 365 must assess whether dependency on a US-jurisdictioned provider satisfies DORA's ICT third-party risk management requirements, particularly regarding concentration risk and exit planning.

**Vendor lock-in**: Microsoft 365 creates significant lock-in through deep integration across email (Exchange), identity (Entra ID/Azure AD), document management (SharePoint/OneDrive), and collaboration (Teams). Migration away from Microsoft 365 is one of the most operationally complex transitions an organisation can undertake.

**Auditability**: Enterprise plans (E5) offer extensive audit logging, compliance centre tools, and eDiscovery capabilities. Microsoft Purview provides data governance features. However, full visibility into Microsoft's internal access to customer data is limited.

**Lawful access exposure**: Microsoft publishes semi-annual transparency reports detailing government data requests. In H2 2024, Microsoft received thousands of requests from US authorities. While most target consumer services, enterprise data is not exempt from legal process.

**Switching cost implications**: The total cost of migrating from Microsoft 365 includes not only direct tool replacement but also identity system migration, workflow reengineering, user retraining, and integration rebuilding. For most organisations, this represents a multi-quarter programme.

European alternatives exist across Microsoft 365's functional areas, though no single provider replicates the full suite:

**Productivity & Office**: ONLYOFFICE (Latvia), Collabora Online (UK/EU, LibreOffice-based), CryptPad (France, encrypted). These provide document editing without US jurisdiction exposure. Trade-off: fewer integrations, less polish.

**Email & Calendar**: Infomaniak (Switzerland), Proton (Switzerland), Mailbox.org (Germany). Offer EU-jurisdictioned email with strong privacy. Trade-off: less enterprise feature depth than Exchange.

**File Storage & Sync**: Nextcloud (Germany), Tresorit (Switzerland/Hungary), pCloud (Switzerland). Provide EU-sovereign file management. Trade-off: Nextcloud requires operational investment; others have smaller ecosystems.

**Identity**: Keycloak (open-source, self-hostable on EU infrastructure) can replace Entra ID for authentication. Trade-off: significant implementation effort, no direct equivalent of Entra ID's depth.

These are risk-reduction options, not endorsements. Each introduces its own operational trade-offs. Migration feasibility ranges from moderate (email) to hard (identity/directory services).

**Fractional CTOs and technical advisors**: Microsoft 365 is the most common stack element requiring sovereignty assessment. Clients in regulated sectors or with public sector customers will increasingly face questions about Microsoft dependency.

**Engineering leaders**: Teams building on Microsoft's platform (Azure AD integrations, SharePoint APIs, Teams apps) create deep coupling that compounds switching costs. Architecture decisions should account for sovereignty requirements early.

**Procurement and due diligence**: Microsoft 365 renewals and expansions should include sovereignty risk assessment as standard practice, particularly for organisations subject to NIS2 or DORA.