---
id: video/n9HaH2dZUaU
type: video
title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
summary: "Business Central 2026 release wave 1 session on Cloud for Sovereignty in the public cloud. It first covers Microsoft's five European digital commitments. It then covers the four functional areas: access controls (RBAC, PIM, conditional access, GDAP), security controls (isolated SQL databases, customer-managed encryption key, service tag), sovereignty controls (environment localization, Azure geo, region and availability zones) and transparency controls (Purview, change log, JIT access, customer lockbox)."
tier: official
language: en
tags:
  - cloud sovereignty
  - data protection
  - access controls
  - encryption
  - compliance
  - audit logging
  - geographic data placement
  - privileged access management
  - customer lockbox
  - environmental isolation
system: administration
review:
  state: reviewed
  by: opus
  at: "2026-10-07T22:49:57.804Z"
  flags: []
generated:
  at: "2026-10-07T22:49:57.843Z"
  pipeline: 0.2.0
  prompts:
    extract-video: 1
    summarize-video: 2
  input_hash: b85732b553118cbb53e70ebb0103667960a34d27db142dde890830f6b695d27e
evidence:
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=33s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 33
    quote: Cloud for Sovereignty which is about controlling and securing your data in the public cloud
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=114s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 114
    quote: Last year in Europe, Microsoft uh shared a commitment that we want to increase our capacity on data centers with 40% across 16 uh
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=237s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 237
    quote: Microsoft has made a promise to compensate customers if their data is disclosed within a violation of EU law
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=356s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 356
    quote: the Cloud for Sovereignty makes up four separate functional areas that help customers protect their environments and their their data.
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=592s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 592
    quote: make sure you select Dynamics 365 Business Central as target resource for your access policy.
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=680s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 680
    quote: it also enables the customer to revoke Microsoft's access to this key, uh which immediately makes their data in the Business Central database on
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=968s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 968
    quote: by default, no Microsoft employee has any access to a customer data
  - kind: video
    url: https://www.youtube.com/watch?v=n9HaH2dZUaU&t=1021s
    title: "What's New: Cloud for Sovereignty (2026 release wave 1)"
    date: "2026-04-01T12:00:52.000Z"
    commit: null
    t: 1021
    quote: Should a customer wish to be part of this approval flow, we offer a feature called customer lockbox
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
video_id: n9HaH2dZUaU
channel: yt-microsoft
source_name: Microsoft Dynamics 365 Business Central (YouTube)
url: https://www.youtube.com/watch?v=n9HaH2dZUaU
published_at: "2026-04-01T12:00:52.000Z"
duration_s: 1109
captions: full
audience:
  - administrator
  - decision maker
  - functional consultant
  - partner
chapters:
  - t: 0
    title: Introduction and Agenda
  - t: 60
    title: Microsoft's Five Digital Commitments for Europe
  - t: 331
    title: Cloud for Sovereignty Overview and Access Controls
  - t: 404
    title: Role-Based Access Control and Privileged Identity Management
  - t: 632
    title: Security Controls and Data Isolation
  - t: 707
    title: Sovereignty Controls and Geographic Data Placement
  - t: 881
    title: Transparency Controls and Audit Features
  - t: 1067
    title: Conclusion and Next Steps
features:
  - name: Role-Based Access Control (RBAC)
    status: unclear
    t: 378
    verified: false
    status_source: video
  - name: Privileged Identity Management (PIM)
    status: unclear
    t: 390
    verified: false
    status_source: video
  - name: Granular Delegated Admin Permissions (GDAP)
    status: unclear
    t: 390
    verified: false
    status_source: video
  - name: Isolated SQL Database per Environment
    status: unclear
    t: 632
    verified: false
    status_source: video
  - name: Encryption at Rest
    status: unclear
    t: 648
    verified: false
    status_source: video
  - name: Dynamics 365 Business Central Service Tag
    status: unclear
    t: 690
    verified: false
    status_source: video
  - name: Environment Localization and Geographic Data Placement
    status: unclear
    t: 719
    verified: false
    status_source: video
  - name: Azure Region Pairing and Backup
    status: unclear
    t: 804
    verified: false
    status_source: video
  - name: Purview Audit and Monitoring
    status: unclear
    t: 906
    verified: false
    status_source: video
  - name: Change Logs and Field Monitoring
    status: unclear
    t: 906
    verified: false
    status_source: video
  - name: Just-In-Time (JIT) Access Controls
    status: unclear
    t: 968
    verified: false
    status_source: video
  - name: Customer Lockbox
    status: unclear
    t: 1021
    verified: false
    status_source: video
objects_mentioned: []
quotes:
  - t: 33
    text: Cloud for Sovereignty which is about controlling and securing your data in the public cloud
    check: exact
  - t: 114
    text: Last year in Europe, Microsoft uh shared a commitment that we want to increase our capacity on data centers with 40% across 16 uh
    check: exact
  - t: 237
    text: Microsoft has made a promise to compensate customers if their data is disclosed within a violation of EU law
    check: exact
  - t: 356
    text: the Cloud for Sovereignty makes up four separate functional areas that help customers protect their environments and their their data.
    check: exact
  - t: 592
    text: make sure you select Dynamics 365 Business Central as target resource for your access policy.
    check: exact
  - t: 680
    text: it also enables the customer to revoke Microsoft's access to this key, uh which immediately makes their data in the Business Central database on
    check: exact
  - t: 968
    text: by default, no Microsoft employee has any access to a customer data
    check: exact
  - t: 1021
    text: Should a customer wish to be part of this approval flow, we offer a feature called customer lockbox
    check: exact
---

# What's New: Cloud for Sovereignty (2026 release wave 1)

> Business Central 2026 release wave 1 session on Cloud for Sovereignty in the public cloud. It first covers Microsoft's five European digital commitments. It then covers the four functional areas: access controls (RBAC, PIM, conditional access, GDAP), security controls (isolated SQL databases, customer-managed encryption key, service tag), sovereignty controls (environment localization, Azure geo, region and availability zones) and transparency controls (Purview, change log, JIT access, customer lockbox).

[Watch on YouTube](https://www.youtube.com/watch?v=n9HaH2dZUaU) · Microsoft Dynamics 365 Business Central (YouTube) · 2026-04-01 · 18:29 · tier official · reviewed (checked by Opus)

## Overview

The session explains how Business Central supports data sovereignty in the public cloud. It starts with Microsoft's digital commitments for Europe, then goes through access controls, security and isolation, sovereignty controls and geographic data placement, and transparency and audit features.

Access is layered through security groups, Entra ID groups, entitlements and permission sets, with PIM for temporary elevated access and GDAP for partner access. Each environment has its own isolated SQL database and is encrypted at rest. On the Microsoft side, engineers get no default access to customer data. Access goes through just-in-time approval, and customers can add their own approval step with customer lockbox.

## Key points

- Business Central runs in the public cloud. Cloud for Sovereignty is about controlling and securing data there, and it is separate from sovereign private cloud and national partner clouds.
- Microsoft's five European digital commitments: expand datacenter capacity by 40% across 16 European countries; operational and legal resilience under EU law; the completed EU data boundary, with a promise to compensate customers if data is disclosed in violation of EU law; cybersecurity; and economic competitiveness, including switching to another cloud provider without a fee.
- Cloud for Sovereignty has four functional areas: access controls, security controls, sovereignty controls and transparency controls.
- Access is layered: environment security groups, Entra ID groups, license entitlements and permission sets. PIM gives temporary, reviewed elevated access to Entra roles or security groups.
- Conditional access policies in Entra, with Dynamics 365 Business Central as the target resource, can restrict sign-in, for example by IP address or by requiring 2FA.
- For partner access via GDAP, the Dynamics 365 Business Central administrator role is the recommended least privileged role.
- Each Business Central environment runs as its own isolated SQL database, with no data commingling between environments.

## Chapters

- [0:00](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=0s) Introduction and Agenda
- [1:00](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=60s) Microsoft's Five Digital Commitments for Europe
- [5:31](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=331s) Cloud for Sovereignty Overview and Access Controls
- [6:44](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=404s) Role-Based Access Control and Privileged Identity Management
- [10:32](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=632s) Security Controls and Data Isolation
- [11:47](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=707s) Sovereignty Controls and Geographic Data Placement
- [14:41](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=881s) Transparency Controls and Audit Features
- [17:47](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=1067s) Conclusion and Next Steps

## Features

| Feature | Status | At |
|---|---|---|
| Role-Based Access Control (RBAC) | status not stated | [6:18](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=378s) |
| Privileged Identity Management (PIM) | status not stated | [6:30](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=390s) |
| Granular Delegated Admin Permissions (GDAP) | status not stated | [6:30](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=390s) |
| Isolated SQL Database per Environment | status not stated | [10:32](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=632s) |
| Encryption at Rest | status not stated | [10:48](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=648s) |
| Dynamics 365 Business Central Service Tag | status not stated | [11:30](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=690s) |
| Environment Localization and Geographic Data Placement | status not stated | [11:59](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=719s) |
| Azure Region Pairing and Backup | status not stated, demoed | [13:24](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=804s) |
| Purview Audit and Monitoring | status not stated | [15:06](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=906s) |
| Change Logs and Field Monitoring | status not stated | [15:06](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=906s) |
| Just-In-Time (JIT) Access Controls | status not stated | [16:08](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=968s) |
| Customer Lockbox | status not stated | [17:01](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=1021s) |

## Quotes

- [0:33](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=33s) "Cloud for Sovereignty which is about controlling and securing your data in the public cloud"
- [1:54](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=114s) "Last year in Europe, Microsoft uh shared a commitment that we want to increase our capacity on data centers with 40% across 16 uh"
- [3:57](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=237s) "Microsoft has made a promise to compensate customers if their data is disclosed within a violation of EU law"
- [5:56](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=356s) "the Cloud for Sovereignty makes up four separate functional areas that help customers protect their environments and their their data."
- [9:52](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=592s) "make sure you select Dynamics 365 Business Central as target resource for your access policy."
- [11:20](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=680s) "it also enables the customer to revoke Microsoft's access to this key, uh which immediately makes their data in the Business Central database on"
- [16:08](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=968s) "by default, no Microsoft employee has any access to a customer data"
- [17:01](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=1021s) "Should a customer wish to be part of this approval flow, we offer a feature called customer lockbox"

## Disclaimers in the video

- [15:06](https://www.youtube.com/watch?v=n9HaH2dZUaU&t=906s) preview: This happens through preview, uh but also functionality built into Business Central environments like change logs and field monitoring

Presenters (as heard): Joost, Christina.