The short answer: no. Microsoft does not operate an Azure datacenter region in Morocco. Moroccan organizations using Azure or Microsoft 365 are served from Microsoft’s regional datacenters outside the country — which means, under Law 09-08, their data is being transferred abroad, a regulated operation requiring the right CNDP formality regardless of how secure the destination is.
What Microsoft does offer
Microsoft’s sovereignty answer is a set of controls rather than a local region. The relevant pieces for Morocco: data residency selection, letting you choose which regions store and process your data; customer-controlled encryption, up to External Key Management where your keys never leave hardware you hold; operational transparency with logged, auditable access; and — most significant for regulated entities — Azure Local and Microsoft 365 Local, which run Microsoft cloud services on infrastructure physically inside your own Moroccan datacenter while keeping cloud-style management.
Why the in-country option matters here
Morocco’s national information-systems security directive, driven by the DGSSI, requires institutions of vital importance to host their sensitive data in Morocco. For those organizations, a sovereign in-country deployment is not a preference — it is the only compliant way to run Microsoft technology on sensitive workloads. For everyone else, the calculus is a classification exercise: keep what must stay local on local infrastructure, place the rest in well-governed regions with your own keys, and file the transfers you do make.
What no vendor can promise
Two honest limits. Microsoft, like every US provider, remains subject to US law and does not absolutely guarantee that foreign authorities will never request data — its commitment is to challenge and narrow such requests. And no Microsoft feature files your CNDP paperwork: the transfer formality under Articles 43–44 stays your obligation as the data controller. Sovereignty features reduce risk; they do not replace compliance.
Designing this architecture — classification, region strategy, key custody, filings — is exactly what our Data Security practice does. Start by measuring where you stand with the free security score. Capabilities evolve; verify current Microsoft offerings before deciding. Not legal advice.