The CLOUD Act: facts over fear, and what Azure External Key Management changes

The United States (US) Clarifying Lawful Overseas Use of Data Act, better known as the CLOUD Act, is often presented as a back door through which the United States can read European data at will. That picture is wrong, and decisions based on it are usually wrong too. This is how we look at it, and what a new Azure capability changes.

What the CLOUD Act is, and is not

The CLOUD Act is not an espionage law and not a tool for mass data access. It is a criminal-procedure instrument for targeted evidence gathering in concrete investigations of serious crime, always on the basis of a court order. It applies to US-based service providers, wherever the data is physically stored.

That calls for sober risk management, not panic. Europe has comparable powers of its own, through national criminal law and the European Union (EU) e-Evidence Regulation. For most organisations the CLOUD Act risk is low and largely theoretical, as long as there is no criminal context.

So the relevant question is not “is the CLOUD Act frightening?” but “who has technical and legal access to my data, and how do I limit that?”

How we limit access

We approach the CLOUD Act factually and through architecture, not by rejecting the cloud on principle. The aim is to make the risk measurable and manageable. In practice we advise and implement:

• Customer-managed encryption keys, so the keys that protect your data are yours to control and to revoke.
• Double Key Encryption and Hold Your Own Key for the most sensitive information, so the data cannot be read without your cooperation.
• Strict identity and access models, so only the people and services that need data can reach it.
• Data classification, because not all data needs the same degree of sovereignty.

The principle: technical measures before contractual promises.

What External Key Management changes

Until recently, most of these controls still left one thing inside the provider: the root of trust. Even with customer-managed keys in a dedicated hardware security module (HSM), the key itself lived in Microsoft’s infrastructure.

In July 2026 Microsoft released External Key Management for Azure Key Vault Managed HSM in public preview. With it, the key that protects your other keys lives in an HSM that you own and operate, on your own premises or with a trusted third party. Managed HSM no longer holds that key. It forwards the cryptographic operations to your HSM through a proxy that you run, and you can disconnect your HSM at any moment to stop decryption in Azure.

That moves the discussion from Microsoft’s legal position to Microsoft’s technical inability. Even with a valid legal order in hand, a provider that never holds the key cannot extract it and cannot decrypt the data. For boards, risk committees and regulators focused on digital sovereignty, that distinction carries weight.

A reality check

• It is a preview. It has to be enabled for your subscription by your Microsoft account team, and preview features carry no production guarantees.
• It is limited in scope. It covers wrapping and unwrapping of keys, for Azure services that already support customer-managed keys in Managed HSM.
• The availability is yours. If your HSM or proxy is unreachable, the services that depend on it stop. There is no Microsoft service level for the external key, and every operation adds a network round trip.
• Most organisations do not need it. Microsoft itself recommends standard Managed HSM for the majority of cases. External Key Management is for organisations with a hard requirement that the cryptographic root of trust sits outside the cloud provider.

Facts over fear

External Key Management does not remove every legal risk. It does materially strengthen the position of organisations that must show their most sensitive keys are under their own physical and operational control. Good governance means knowing the law, understanding how it is applied, and designing your architecture accordingly. If data sovereignty is high on your risk register, it is worth evaluating, and we are happy to test the business case with you.

See what we offer in cybersecurity and compliance and private and hybrid cloud.