What's New: Cloud for Sovereignty (2026 release wave 1)

Overview

The session explains how Business Central supports data sovereignty in the public cloud. It starts with Microsoft’s digital commitments for Europe, then goes through access controls, security and isolation, sovereignty controls and geographic data placement, and transparency and audit features.

Access is layered through security groups, Entra ID groups, entitlements and permission sets, with PIM for temporary elevated access and GDAP for partner access. Each environment has its own isolated SQL database and is encrypted at rest. On the Microsoft side, engineers get no default access to customer data. Access goes through just-in-time approval, and customers can add their own approval step with customer lockbox.

Key points

Business Central runs in the public cloud. Cloud for Sovereignty is about controlling and securing data there, and it is separate from sovereign private cloud and national partner clouds.
Microsoft’s five European digital commitments: expand datacenter capacity by 40% across 16 European countries; operational and legal resilience under EU law; the completed EU data boundary, with a promise to compensate customers if data is disclosed in violation of EU law; cybersecurity; and economic competitiveness, including switching to another cloud provider without a fee.
Cloud for Sovereignty has four functional areas: access controls, security controls, sovereignty controls and transparency controls.
Access is layered: environment security groups, Entra ID groups, license entitlements and permission sets. PIM gives temporary, reviewed elevated access to Entra roles or security groups.
Conditional access policies in Entra, with Dynamics 365 Business Central as the target resource, can restrict sign-in, for example by IP address or by requiring 2FA.
For partner access via GDAP, the Dynamics 365 Business Central administrator role is the recommended least privileged role.
Each Business Central environment runs as its own isolated SQL database, with no data commingling between environments.

Features

Feature	Status	At
Role-Based Access Control (RBAC)	status not stated	6:18
Privileged Identity Management (PIM)	status not stated	6:30
Granular Delegated Admin Permissions (GDAP)	status not stated	6:30
Isolated SQL Database per Environment	status not stated	10:32
Encryption at Rest	status not stated	10:48
Dynamics 365 Business Central Service Tag	status not stated	11:30
Environment Localization and Geographic Data Placement	status not stated	11:59
Azure Region Pairing and Backup	status not stated, demoed	13:24
Purview Audit and Monitoring	status not stated	15:06
Change Logs and Field Monitoring	status not stated	15:06
Just-In-Time (JIT) Access Controls	status not stated	16:08
Customer Lockbox	status not stated	17:01

Quotes

0:33 “Cloud for Sovereignty which is about controlling and securing your data in the public cloud”
1:54 “Last year in Europe, Microsoft uh shared a commitment that we want to increase our capacity on data centers with 40% across 16 uh”
3:57 “Microsoft has made a promise to compensate customers if their data is disclosed within a violation of EU law”
5:56 “the Cloud for Sovereignty makes up four separate functional areas that help customers protect their environments and their their data.”
9:52 “make sure you select Dynamics 365 Business Central as target resource for your access policy.”
11:20 “it also enables the customer to revoke Microsoft’s access to this key, uh which immediately makes their data in the Business Central database on”
16:08 “by default, no Microsoft employee has any access to a customer data”
17:01 “Should a customer wish to be part of this approval flow, we offer a feature called customer lockbox”

Disclaimers in the video

15:06 preview: This happens through preview, uh but also functionality built into Business Central environments like change logs and field monitoring

Presenters (as heard): Joost, Christina.