Microsoft's cloud grows – Swiss data stays a contract issue
Azure grew 48 percent in the quarter. But what Swiss customers need to know about data locations, access and exceptions is not in the earnings report.
On 28 October 2026 Microsoft reported revenue of 92.3 billion dollars for the first quarter of its fiscal year 2027, 19 percent more than a year earlier. Azure grew 48 percent in the quarter that ended in September. According to Bloomberg, analysts had expected 44 percent. The figures show the economic momentum of the cloud business. They say nothing, however, about which data protection guarantees a Swiss company receives for its specific application.
That second question does not concern large corporations alone. Anyone who outsources customer data, personnel files or business communication must know which data ends up where. The term “Swiss cloud” can describe a physical location. It does not yet answer all questions about processing, operation and access.
Switzerland and Europe are not the same promise
Microsoft states that it has operated cloud regions near Zurich and Geneva since 2019. In its February 2026 presentation on Swiss digital sovereignty, the company also names the EU Data Boundary. That boundary covers the EU and EFTA, including Switzerland. Keeping data inside it therefore does not automatically mean storing and processing that data exclusively on Swiss soil.
Microsoft also points to access approvals, encryption options and customer-controlled keys. These are the provider's own statements about what it can offer, not independent proof that every one of them is included and switched on in every customer contract. For procurement, a precise commitment therefore matters more than the general word “sovereignty”: which types of data, which services and which operational processes are actually covered?
With Azure, configuration is part of the answer
Azure documentation distinguishes regional services from exceptions. With many regional offerings the customer can choose the deployment region; the geographic unit sets the framework for data residency. Replication within that unit can serve resilience. The choice of location and the backup copy must therefore be assessed together.
AI applications are particularly relevant here. For deployments of the Azure OpenAI Service labelled “Global”, inputs and outputs may, according to Microsoft's documentation, be processed anywhere in the world. For “DataZone” deployments a defined data zone applies instead of necessarily a single country. Storing data locally at rest and the place where it is actively processed are thus two different properties. Anyone enabling a service should record both separately and not infer every processing step from the storage location.
Connected services bring their own data paths
Digital identity is another checkpoint. Microsoft's documentation on Entra ID describes data localisation as depending on how the customer tenant is set up. It also names exceptions and optional features. In cross-tenant collaboration, user and device account data as well as configurations may for instance be processed at the location of a participating foreign tenant.
The practical consequence: controlling only the storage of an application is not enough. Sign-in, collaboration and add-on features also belong in the overview. An organisation should treat changes to such settings like changes to the data flow itself. An architecture that was documented once can lose its validity when new features are added later.
Responsibility stays with the customer
The Federal Data Protection and Information Commissioner (FDPIC) holds that outsourcing does not remove responsibility for lawful processing. Customers must safeguard order processing in the contract and examine separately any disclosure of data abroad. The FDPIC names, among other things, confidentiality, binding instructions, security and subcontractors. Deletion or return of data after the end of the contract is also part of the review.
Exiting is a concrete test. In its Swiss presentation Microsoft describes the export of data as possible. An export button alone does not answer whether a company can keep running its application at reasonable expense. In its own trial, a firm should therefore not only back up files but also record permissions and required configurations, and test restoration. This is not a claim that a deficiency exists, but a verifiable requirement on its own contingency planning.
For Swiss companies this yields a clear order of work: first determine the data and its protection needs, then record the intended services and data paths, and finally compare the commitments with the actual configuration. Open points belong before contract approval, not first in the investigation of an incident. Microsoft's growth can illustrate demand. Whether a particular outsourcing meets a company's own requirements, by contrast, is settled in the contract and in day-to-day operations – not on the stock exchange.
Sources
- Microsoft: Quarterly results FY2027 Q1, 28 October 2026
- Microsoft Switzerland: Digital sovereignty, 25 February 2026
- Microsoft Azure: Data residency and exceptions
- Microsoft Learn: Data storage and processing in Entra ID
- FDPIC: Cloud computing and customer responsibility
- Bloomberg: Microsoft's cloud revenue beats expectations, 28 October 2026
- Title image: NOIRLab/NSF/AURA/T. Slovinský, Wikimedia Commons
- Title photo licence: CC BY 4.0
- Article image: Alexander-design, Wikimedia Commons / Pixabay
- Article image licence: CC0 1.0
