Microsoft Sovereign Cloud: testing control and continuity for enterprise AI
Microsoft’s October 20, 2026 announcement calls for sovereignty to be assessed workload by workload. For Belgian and French IT leaders, the practical decision is to define the evidence required before choosing a public, private or hybrid AI architecture.
1. What Microsoft announces, and when
Microsoft announces general availability of external key management with Azure Managed HSM. Data Guardian and Production Touch Ledger are being rolled out in phases in the EU and EFTA. Sovereign Control Panel is due to enter public preview at Ignite. Transitioning from connected to disconnected operations is also entering public preview; Foundry Local on Azure Local is due to become generally available at Ignite. These statuses do not mean uniform availability for every customer.
2. What changes for a Belgian or French company
Our assessment: these announcements provide more specific criteria for supplier discussions. For each proposed service, request confirmation of actual availability, contractual scope and evidence of the stated control. An SME should start with a bounded use case, such as searching non-critical internal documentation. Mid-market companies, large enterprises and public administrations should distinguish processing that can wait from services whose interruption blocks an essential operation.
3. Underside analysis: test the entire RAG and agent chain
We recommend mapping a complete journey: authentication, document retrieval, inference, tool calls, logging and backup. At each step, identify the operator, exposed data and network dependency. In RAG, require document filtering based on the user’s permissions. For an agent connected to Odoo Enterprise, separate reads from writes and require business approval before sensitive actions. These are architecture requirements proposed by Underside, rather than Odoo features announced by Microsoft.
4. Test continuity before production
We propose testing a network outage in a representative environment using test data. Check whether identity, models, indexes, licences and tools remain usable; record what stops and who authorises restart. Also test revocation of operator access and loss of key availability, with a controlled recovery procedure. Agree an acceptable interruption period and tolerable data loss with business owners, then measure both. Local operation should be demonstrated across the complete journey.
5. A documented, proportionate decision that can be revisited
We recommend comparing scenarios against the same criteria: processed data, administrative access, exportable evidence, operating costs and recovery. Request demonstrations of functions actually available rather than relying on a roadmap alone. Have legal and security owners validate applicable obligations; a vendor announcement is insufficient to establish regulatory compliance. Finally, plan an export test for data, configurations and logs to prepare for a change of provider.
Operational recommendation: create an acceptance record for each AI use case, naming a business owner, the status of every function, dependencies, access evidence and a dated continuity test. Make ERP write access conditional on this approval.
Assess a sovereign AI architecture