European alternatives to Microsoft Azure: EU data location and EU jurisdiction

If you need your data stored in the EU, Azure’s EU regions and Microsoft’s EU Data Boundary already cover most of that. If you also want a provider with no US company in its structure, they do not, because Microsoft remains a US company wherever the data sits. For that you move to a European-owned provider: STACKIT, IONOS, OVHcloud, Scaleway, T Cloud Public and enum cover Kubernetes, object storage, DNS and load balancing, and most of them also have managed databases and key management.

Facts about other providers come from their own pages, checked on 9 October 2026. enum is one of the providers compared, and we say where it is behind.

What does Microsoft’s EU Data Boundary change?

Microsoft describes the EU Data Boundary as “a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data for our Microsoft enterprise online services, including Azure, Dynamics 365, Power Platform, and Microsoft 365.” The last phase completed in February 2025 and added professional services data such as logs and support case notes.

For Azure, regional services you deploy in an EU or EFTA region are in scope. Non-regional services have to be configured one by one. Microsoft also documents transfers that continue out of the boundary, among them:

• Remote access by Microsoft staff outside the EU. Microsoft counts this as a transfer “although the data remains within Microsoft datacenter infrastructure in the EU Data Boundary”.
• Security operations: “Pseudonymized personal data and Professional Services Data processed for security purposes is transferred to any Azure region worldwide.”
• Entra ID: “Microsoft may replicate limited Microsoft Entra directory data from Microsoft Entra (including username and email address) outside the EU Data Boundary”.
• Preview services, which are excluded.

So the EU Data Boundary is a data location commitment with documented exceptions. That helps with data residency requirements.

Does the EU Data Boundary protect against the CLOUD Act?

No. The EU Data Boundary describes where data is stored and processed, not who can compel access to it; Microsoft’s own government requests page says US law enforcement “may compel service providers with minimum contacts with the U.S. to disclose data that is in their ‘possession, custody, or control’ regardless of where the data is located.”

Microsoft’s Sovereign Cloud adds controls on top. Managed HSM External Key Management, for example, keeps keys outside Microsoft infrastructure; Microsoft lists it as “in preview” and calls it “a last-resort option”. Partner-operated models such as Delos Cloud change the operator.

If you want no US parent and no US entity in your provider’s structure, that narrows the field to European-owned providers. European Production Orders under the e-Evidence Regulation reach every provider that offers services in the EU, European providers included.

This guide is general information, not legal advice. Have your counsel assess your specific situation.

How do common Azure services map to European providers?

The table does not cover Azure Files, Container Registry, Service Bus, Event Hubs or Azure Monitor. Check each against the provider you pick. enum has no file storage, container registry, messaging or monitoring product.

Which European providers cover which services?

Checked October 2026.

Price models as of October 2026; check each provider’s pricing page for current prices: STACKIT (with its price list), IONOS, OVHcloud, Scaleway, T Cloud Public, enum. Managed databases are billed per node or instance per hour at STACKIT, OVHcloud and Scaleway, and per core and GB of RAM per hour at IONOS. Load balancers are billed per hour at STACKIT, per forwarding rule per hour at IONOS, by size at OVHcloud, and per load balancer type at Scaleway. enum bills a flat monthly price per load balancer.

“Not found” means not found on the provider’s own pages.

STACKIT and T Cloud Public are the closest to Azure in breadth: both have managed SQL Server, KMS, a secrets manager and SSO with OIDC. STACKIT and T Cloud Public hold BSI C5 Type 2 attestations. OVHcloud states that it meets the C5:2020 catalogue and has a SOC 2 Type 2 report; its C5 page does not say whether the attestation is Type 1 or Type 2 or which services are in scope, so ask for the report. IONOS Cloud received a C5:2020 Type 1 attestation on 28 May 2026; Type 1 checks control design at one point in time, so a tender that asks for Type 2 does not accept it. Scaleway and enum hold no C5 attestation. Ask each provider whether the services you need are in scope. enum covers the core of a Kubernetes stack and nothing past it yet.

Group structures differ. T-Systems states that T Cloud Public has “no US parent or US subsidiary”; its parent Deutsche Telekom holds a majority of T-Mobile US. IONOS and OVHcloud have US entities serving US regions. STACKIT lists no US region; its parent, the Schwarz Group, runs Lidl stores in the US. Scaleway belongs to France’s iliad group. Our sovereignty comparison has the group structures.

What has no direct European equivalent?

• Entra ID as a company directory. None of the European cloud IAMs replaces Entra ID for staff sign-in, device management and Microsoft 365. Most teams keep their identity provider and federate it into the new cloud over SAML or OIDC. If Entra ID itself must leave, a self-hosted Keycloak or a European identity provider is a separate project.
• Azure SQL Database. Only STACKIT and T Cloud Public offer managed SQL Server. Elsewhere you run SQL Server on VMs, or migrate to PostgreSQL, which touches application code.
• Microsoft licences. Running your own SQL Server or Windows Server licences on another provider’s shared servers needs subscription licences or licences with active Software Assurance, under the Flexible Virtualization Benefit in Microsoft’s Product Terms. The benefit covers “Authorized Outsourcers”, which by definition excludes Microsoft’s Listed Providers: Alibaba, Amazon, Google and Microsoft. None of the six here is on that list. Without Software Assurance, the provider supplies the licence, usually as an hourly charge; T Cloud Public, for example, prices the SQL Server Enterprise licence on RDS per hour in its service description. Azure Hybrid Benefit is an Azure discount and ends when you leave. Check your licence position with your Microsoft reseller before you choose.
• Cosmos DB. We found no globally distributed multi-model database at any of the six. Teams usually split it: MongoDB-compatible or PostgreSQL for documents, Valkey or Redis for caching.
• Azure Functions. Scaleway (Serverless Functions) and T Cloud Public (FunctionGraph, Germany region only) have serverless functions. OVHcloud lists serverless as coming soon. We found none at STACKIT, IONOS or enum. A container on Kubernetes or a scheduled job covers most cases.

What does leaving Azure cost?

Azure charges for internet egress after the first 100 GB a month (bandwidth pricing). For a full exit, Microsoft credits the egress if you open a support request before you start. You then have 60 days from the start date you gave, unless your first request includes a longer migration timeline. Afterwards you must cancel all subscriptions on the account before you claim the credit. Egress from ExpressRoute, VPN, Azure Front Door and Azure CDN is excluded. Only customers with a UK billing address leaving UK datacenters can do this for single services.

For a parallel run, organizations with a billing address in the EEA, EFTA or UK can ask for at-cost egress. It covers internet egress routed through the “transit ISP network” routing preference, both ends must belong to the same organization, and each external endpoint needs a request with its ASN. The refund applies to future bills, not past ones.

The EU Data Act has rules on switching charges. A Microsoft Azure Consumption Commitment (MACC) or reservations can still cost money on exit, so check their end dates before you set a cut-over date.

On enum, incoming traffic is free and outgoing traffic costs €0.025 per GB.

How do you plan the move?

1. List every Azure resource and sort it: moves to a European equivalent, is rebuilt on Kubernetes, or stays with Microsoft for now (often Entra ID and Microsoft 365).
2. Choose the provider by the hardest row. If you run SQL Server, that leaves two, and your licence position decides the cost.
3. Check commitments and file the exit egress request with Azure Support before the bulk transfer starts.
4. Move stateless services and object storage first, run old and new in parallel, move databases with replication, and cut over DNS last.

FAQ

Is Azure in an EU region enough to keep data in the EU? For data location, often yes, and the EU Data Boundary documents where data goes and the exceptions. It does not change that Microsoft is a US company, so it does not answer a requirement for a provider with no US company in its structure.

Does the EU Data Boundary mean Microsoft cannot be forced to hand over EU data? No. Microsoft’s own government requests page says US law enforcement may compel disclosure of data in its control regardless of location.

Which European cloud is closest to Azure in features? Of the six compared here, STACKIT and T Cloud Public cover the most Azure building blocks, including managed SQL Server, KMS and SSO with OIDC. OVHcloud and Scaleway come next, without managed SQL Server.

Can I keep Entra ID and still move my workloads? Yes. Most European providers accept SAML login from Entra ID. Your infrastructure moves; staff sign-in stays with Microsoft. That leaves directory data, including usernames and email addresses, under Microsoft.

What does it cost to move data out of Azure? Internet egress after 100 GB a month, unless you claim Microsoft’s exit credit: a support request before the transfer, 60 days to move the data, and all subscriptions cancelled afterwards.

Does enum offer managed databases? No. You run PostgreSQL or another database on enum Kubernetes Engine with block storage, usually with an operator such as CloudNativePG, or choose a provider with managed databases. enum has no volume snapshots, so plan backups with the database’s own tools, for example to object storage.

Where enum fits

enum GmbH is a German company in Cologne with no US parent and no US company in its structure. Production runs in Frankfurt: managed Kubernetes with the HA control plane included, object storage at €0.02 per GB a month with no request fees, block storage, L4 load balancers and free DNS.

The limits are real:

• Kubernetes clusters are set up with you on request; self-service creation through the API and enumctl is planned for Q4 2026.
• One production region, Frankfurt, with one availability zone (fra-a). The control plane is spread across failure domains inside that site; there are no zone-redundant clusters.
• A 99.9% SLA for the Kubernetes API, object storage, block storage and load balancers. No SLA is published for worker nodes or DNS, and credit terms are not published; ask for the contract terms.
• No managed databases, no L7 load balancer, no self-service VMs and no volume snapshots.
• VPCs are in preview. There is no VPN gateway or private interconnect, so a parallel run with Azure goes over the public internet.
• No cluster autoscaling, no workload identity, and x86 nodes only (AMD EPYC, no ARM).
• Roles and fine-grained IAM, a customer audit log and the Terraform provider are planned for Q4 2026. The console is in preview.
• No KMS or customer-managed keys; key management is on the roadmap without a date.
• Included support covers working days; 24/7 response for critical incidents comes with Enterprise Support.
• No published sub-processor list. ISO 27001 is in progress (target Q4 2026) and BSI C5 is on the roadmap for 2027.

If your Azure footprint is mostly AKS, Blob Storage and DNS, see how a migration works. If you would rather have enum’s engineers run production for you, see DevOps as a Service.

Sources

• Microsoft, What is the EU Data Boundary: https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn
• Microsoft, Continuing data transfers for all EU Data Boundary services: https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-transfers-for-all-services
• Microsoft, completion of the EU Data Boundary, 26 February 2025: https://blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/
• Microsoft, government requests for customer data: https://www.microsoft.com/en-us/corporate-responsibility/reports/government-requests/customer-data
• Microsoft, Managed HSM External Key Management: https://learn.microsoft.com/en-us/azure/azure-sovereign-clouds/public/external-key-management
• Microsoft, AKS Windows container FAQ: https://learn.microsoft.com/en-us/azure/aks/windows-faq
• Microsoft, bandwidth pricing: https://azure.microsoft.com/en-us/pricing/details/bandwidth/
• Microsoft, data transfer fees when leaving Azure: https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/cancel-azure-subscription
• Microsoft, at-cost data transfer for parallel use: https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/data-transfer-fees
• Microsoft Product Terms, Flexible Virtualization Benefit: https://www.microsoft.com/licensing/terms/product/ForallSoftware/all ; glossary: https://www.microsoft.com/licensing/terms/product/Glossary/all ; Listed Providers: https://www.microsoft.com/licensing/docs/view/Listed-Providers
• Regulation (EU) 2023/2854 (Data Act): https://eur-lex.europa.eu/eli/reg/2023/2854/oj
• Regulation (EU) 2023/1543 (e-Evidence): https://eur-lex.europa.eu/eli/reg/2023/1543/oj
• STACKIT: PostgreSQL Flex, MariaDB, SQLServer Flex, DNS, Application Load Balancer, access and identity, identity provider, KMS, Secrets Manager, regions, certificates, facts
• Lidl US, about us (Schwarz Group, US stores): https://www.lidl.com/c/about-us/s10089074
• IONOS Cloud: databases, Cloud DNS, Application Load Balancer, IAM, IAM federation, Managed Kubernetes locations, LoadBalancer Services, certificates
• OVHcloud: Public Cloud, databases, Load Balancer, IAM, KMS, Secret Manager, regions, C5
• Scaleway: databases, Domains and DNS, DNSSEC, Load Balancer, IAM, identity federation, Key Manager, Secret Manager, Serverless Functions, security and compliance
• European Commission, sovereign cloud tender, 17 April 2026 (Scaleway, iliad group): https://commission.europa.eu/news-and-media/news/commission-advances-cloud-sovereignty-through-strategic-procurement-2026-04-17_en
• T Cloud Public: facts, service description, IAM identity providers, data centers, certifications