“Where is my data?” has become a board-level question in Morocco, and the honest starting point is this: Microsoft does not operate an Azure region on Moroccan territory. Moroccan customers are served from Microsoft’s regional datacenters — which means every serious cloud project here is also a data-residency and transfer-compliance project under Law 09-08.
What Microsoft offers on sovereignty
Microsoft’s answer is the Microsoft Sovereign Cloud portfolio — sovereignty as a set of controls rather than a separate cloud. The pieces most relevant to Moroccan organizations: data residency selection (choosing which regions store and process your data), customer-controlled encryption including External Key Management, where you hold the keys on your own hardware security modules, operational transparency with tamper-evident access logging, and — most significant for regulated Moroccan entities — Azure Local and Microsoft 365 Local, which run Azure and core productivity services on infrastructure inside your own datacenter, in-country, while keeping the cloud management model.
That last option matters because of a specifically Moroccan constraint: institutions of vital importance are required, under the national information-systems security directive and its 2016 implementing decree, to host their sensitive data in Morocco. For those organizations, a sovereign private deployment on Moroccan soil is not a preference — it is the compliance path that lets them use Microsoft technology at all for sensitive workloads.
What no vendor can give you
Two cautions belong in any honest article on this subject. First, sovereignty controls do not erase legal reality: Microsoft, like every US provider, remains subject to US law, and it has publicly acknowledged it cannot absolutely guarantee foreign authorities will never request data — it commits instead to challenging and narrowing such requests. Second, no Microsoft feature files your CNDP paperwork for you: hosting abroad remains a regulated transfer under Law 09-08 regardless of how well-protected the destination is. Sovereignty features reduce risk; they do not replace compliance.
The practical play for Moroccan organizations: classify your data first, keep what must stay in-country on local or sovereign-private infrastructure, place the rest in adequately governed regions with customer-held keys, and file the transfers you do make. That architecture work is exactly what our data security and security teams do.
Capabilities and commitments evolve — verify current Microsoft offerings and regulatory positions before making architectural decisions. This is not legal advice.