Microsoft Will Now Watch Its Engineers Very Carefully

Pillar 02 · Legal

Bias declaration. I founded SkyeConnex. We sell data custody. I sold my last company to Microsoft, worked there, and still recommend Azure to customers every week. I am about to be rude about it anyway. Adjust for bias.

Supervision is a confession

Microsoft announced this morning that it will now watch its own engineers very carefully. In Europe, a trusted local partner will watch them too. Every time one of them touches a production system, a tamper-evident ledger will write it down.

To be fair, this is serious engineering. It is also an admission. Nobody builds a supervision system for access that doesn’t exist.

The guard dog problem

Data Guardian. Production Touch Ledger. Customer Lockbox. Just-in-time Access. Four products, one assumption. Somebody at Microsoft can reach your data, and the best they can offer is a better view of when that happens.

We started from the opposite assumption. Nobody at SkyeConnex should be able to read customer data. Me included.

So every file key is wrapped under a key derived from the customer’s own secret. Then it gets sealed again with post-quantum encryption to the member and the company. When our Coordinator restarts, it sits there locked until a human with the right secret signs in.

That last part is annoying. It has inconvenienced us more than once. I’d build it the same way again. A system that can unlock itself can be unlocked by someone else.

Your key, their building

External key management with Azure Managed HSM is now generally available. You keep the root key in your own hardware. Polite applause is appropriate.

Now follow the data. It still lives in Azure. Azure services still unwrap the working keys so they can process it. Owning the root key gets you a very expensive off switch. While it’s on, your data is exactly where it was yesterday.

We do it the other way around. The client encrypts. Each file gets cut into shards. The shards go to separate vendors, and each vendor holds pieces it can’t read.

Azure is welcome to be one of those vendors. We like Azure. We just don’t think it should hold the whole file. Neither should anyone else. Us included.

The CLOUD Act doesn’t read blog posts

The CLOUD Act attaches to the company. Lockbox doesn’t change which company. Neither does a European guardian or a nicer ledger. The order still goes to Redmond. What improves is the paperwork that comes back.

A vendor holding a shard has nothing useful to hand over. No key in its HSM. No complete file on its disks. You can compel a company. Compelling arithmetic is harder.

Assessing the exit

The new Sovereign Control Panel will help customers assess portability across operating environments. Read that twice. The vendor will help you assess whether you could leave the vendor. I’m sure it will be rigorous.

Our customers own their storage accounts. Leaving SkyeConnex means rebuilding files from shards they already hold, without calling us first. That’s a procedure you can run on a Tuesday afternoon. It doesn’t need a dashboard to tell you it’s possible.

Can support

Microsoft’s own wording is that these controls “can support” a broader sovereignty strategy. Can support. That is the phrasing of a company with excellent lawyers.

We would rather show receipts. Custody attestations. A hash-chained audit log for every tenant. A probe that checks where each provider actually is, instead of trusting the label on the region. If a provider says Canada and the packets say Virginia, I’d like to find out before the auditor does.

Meanwhile, in Canada

Data Guardian is for the EU and EFTA. So is the Touch Ledger. Canada gets a Control Panel in public preview. Europe got a chaperone. We got a dashboard.

SkyeConnex runs a sovereign plan with Canadian residency today. We didn’t need a press cycle for it. We live here.

Sovereign AI, some assembly required

Foundry Local goes generally available at Ignite, on Azure Local. So the Microsoft recipe for sovereign AI starts with a purchase order. Validated hardware first. Licensing second. The update channel comes free.

Our Coordinator and agents run on machines our customers already own. Windows PCs. Macs. Whatever is under the desk.

When a workload is restricted to a jurisdiction and nothing in that jurisdiction is available, the build refuses. It doesn’t quietly wander off to find a spare GPU in Ohio.

Bring your hyperscaler

First, a thank you. Microsoft just spent a whole blog post telling governments that residency doesn’t settle sovereignty, and that the real question is who can reach your data. We’ve been saying that for a while. It lands differently coming from Redmond. So thanks for validating the market. Genuinely. The category needed a sponsor with a bigger marketing budget than ours.

I’ll say what I always say. Keep Azure. It’s excellent and it’s already in your estate. Turn on every control Microsoft shipped today. They’re good controls.

Then make Azure one vendor among several, holding pieces it can’t read. That’s the version of sovereignty where you don’t have to trust anybody’s engineers. Ours included.

Sovereignty by architecture, not by promise.

Source: “Advancing digital sovereignty with greater control and choice,” Microsoft, October 20, 2026. blogs.microsoft.com