Best European Alternatives to Microsoft Azure

Why people leave Microsoft Azure

Give Microsoft its due first, because the lazy version of this page is wrong.

The EU Data Boundary is the most complete commitment any hyperscaler has published: customer data and pseudonymised personal data stored and processed inside the EU and EFTA — which includes Norway, Iceland, Liechtenstein and Switzerland — with professional services data stored at rest there too.

On 30 April 2025 Microsoft went further and promised that if any government ordered it to suspend European cloud operations it would "promptly and vigorously contest such a measure using all legal avenues available", and made that commitment contractually binding with European national governments and the European Commission.

Then read the second half of Microsoft's own documentation, which is where people decide to leave. The boundary page states that the commitments "are subject to limited circumstances where Customer Data, personal data, and Professional Services Data will continue to be transferred outside the EU Data Boundary", and a companion page lists them.

Consulting engagement data is stored in United States datacentres. Support case titles may be stored outside. Escalated cases can carry the case description and reproduction steps out. Security data is transferred to any Azure region worldwide. Entra directory data including usernames and email addresses may be replicated out. Network routing may occasionally leave.

None of that is a scandal and all of it is disqualifying for some organisations. A resilience commitment is a promise about behaviour, not the removal of a power, and an exception list is an exception list however carefully it is drafted. If the requirement you have been handed says data must not leave the Union at all, Microsoft has already told you, in writing, that this arrangement does not meet it.

• The exceptions are specific, published and permanent enough to plan around Microsoft does not hide the transfers, which is to its credit and also makes the assessment easy. Professional services data from a consulting engagement sits in US datacentres. A support case title may be stored outside the boundary, and an escalated case may take the description and reproduction steps with it. Voicemails left for support agents may be stored outside, with work ongoing to change that. Each is minor on its own; together they mean the sentence "our data stays in Europe" is not one you can sign.
• Security operations are global by design Microsoft states that pseudonymised personal data and professional services data processed for security purposes is transferred to any Azure region worldwide, so that its security response operates around the clock across time zones. That is a defensible engineering decision and it is also the opposite of a boundary. For a threat hunting team it is obviously correct; for a data protection officer it is a transfer to document with no configuration switch attached.
• Previews and trials are outside it The documentation is explicit that only paid, generally available services are included, and that anything in preview or offered as a free trial is not. Azure moves quickly and the interesting services spend a long time in preview, which means the parts of the platform a team is most excited about are precisely the parts the boundary does not yet cover. Check the availability status of every service in your architecture, not just the region.
• Leaving Azure is not leaving Microsoft This is the difference between Azure and every other page in this series. Most Azure estates exist because the organisation already had Active Directory, Windows Server and Microsoft 365, and the cloud followed the identity. Move the virtual machines to Germany and Entra still holds your directory, the documentation still says directory data may be replicated outside the boundary, and the jurisdiction question is unchanged. Hosting and identity are two migrations, and doing the easy one first feels like progress without being it.

What you have to replace, not just match

Sort the estate by what it is attached to, because with Azure the attachments matter more than the workloads.

The detachable part is ordinary: Linux virtual machines, container workloads on AKS, blob storage, managed Postgres or MySQL, and anything built on open protocols. It moves to any provider on this page with a scheduling conversation and a test window.

The attached part is Entra ID, Windows Server licensing, Microsoft 365 integration, Intune-managed devices, and any application that authenticates against your tenant. That part does not move to an infrastructure provider at all, because the replacement is a different identity product and a different desktop strategy. Decide now whether you are doing a hosting migration or a Microsoft migration. Both are legitimate; confusing them is what makes these projects run twice as long as planned.

The alternatives compared

How each alternative compares to Microsoft Azure

What actually breaks when you switch

Identity is the migration inside the migration, and it is the one that decides the timeline. Every application that signs users in through Entra, every device enrolled in Intune, every conditional access policy and every group used for permissions is a dependency on the tenant rather than on Azure. Moving servers while the directory stays put is a valid first step, but call it a first step in the plan, otherwise the second one never gets funded.

Licensing is where the business case is usually lost. Windows Server and SQL Server workloads carry terms that differ by hosting arrangement, and the difference can be larger than the compute saving that motivated the project. Get the position in writing from the provider before the numbers go to a committee, because a comparison that quietly assumes Linux pricing for a Windows estate will be taken apart in the review.

And treat the residual transfers as an inventory, not an argument. Before you switch anything off, write down which of Microsoft's documented exceptions your organisation was actually relying on — the global support routing, the security telemetry, the consulting engagement data — and check what your new provider does instead. Some of those exceptions exist because they buy something useful, and a provider that simply does not offer the service is not the same as one that offers it locally.

Is the EU Data Boundary enough for a European public body?

Sometimes, and the answer depends on a sentence in your own policy rather than on anything Microsoft publishes. If the requirement is that customer data is stored and processed in the EU or EFTA, the boundary delivers that and delivers it across more countries than any rival commitment.

If the requirement is that no personal data leaves the Union under any circumstance, the boundary does not meet it and Microsoft does not claim it does. The documentation names the continuing transfers: consulting engagement data in United States datacentres, support case titles, escalated case descriptions and reproduction steps, security data to any Azure region worldwide, limited Entra directory data, and occasional network routing outside the boundary.

The useful exercise is to read the transfers page next to your own requirement, line by line, and mark which lines you can accept. Most organisations can accept most of them. The ones who cannot usually discover it in a procurement questionnaire rather than in a design review, which is the expensive way round.

What does the Digital Resilience Commitment actually give me?

A contractual promise that if any government ordered Microsoft to suspend or cease cloud operations in Europe, the company would promptly and vigorously contest the measure using all available legal avenues, binding on Microsoft Corporation and its subsidiaries, and written into contracts with European national governments and the European Commission.

That is a real commitment and it is worth more than a blog post, because it can be enforced by the counterparty. It is also, read plainly, a commitment to litigate rather than a statement that the power does not exist. Microsoft cannot promise the outcome of a case it has not yet been ordered to fight.

So it belongs in a risk assessment as a mitigation, not as an answer. If your board's question is what happens in a geopolitical rupture, the honest summary is that Microsoft would fight it, that fighting takes time, and that a European supplier does not have the exposure in the first place.

Can I leave Azure and keep Microsoft 365?

Yes, and a lot of organisations should do exactly that as a first step. Moving compute and storage to a European provider while keeping the productivity suite is a coherent position: it reduces the amount of your business that sits with one supplier and it is achievable in a quarter rather than a year.

What it does not do is change your jurisdiction posture, because the tenant, the directory and the documents are the part of Microsoft that holds personal data about your staff. The transfers documentation applies to that tenant, and Entra directory data including usernames and email addresses may be replicated outside the boundary.

Treat it as two projects with different justifications. Hosting moves for cost, control and latency. Identity and productivity move for jurisdiction, and that second project is harder, slower and the one your users will notice.

What about Windows Server workloads?

This is the question that decides whether your migration is straightforward or awkward, and it should be asked in week one. An estate of Linux virtual machines moves to any provider on this page without a licensing conversation. An estate of Windows Server and SQL Server does not, because the licence terms and how they apply at a given hosting provider are their own subject.

Get the licensing position in writing from the provider you are considering before you plan anything else, and price it into the comparison rather than discovering it afterwards. It is the single most common reason an Azure migration business case falls apart at the review stage.

And use the question as a prompt. A workload that only runs on Windows because it always has is worth examining once; a workload that genuinely requires it is worth keeping where the licensing is simplest, which may well be Azure.

Which one to pick

If your requirement is that data is stored and processed in the EU or EFTA and you can accept a documented list of exceptions, stay. Microsoft has built more of this than anyone else, the boundary reaches further geographically than any competitor's, and the resilience commitment is contractually binding rather than promotional.

If your requirement has no room for those exceptions, OVHcloud is the answer on this page, because a SecNumCloud qualification names the territory, the staff and the law instead of naming the circumstances in which the rule does not apply.

If the estate is containers, databases and Linux virtual machines, Scaleway will hold it in one EU account and Hetzner will hold it for a fraction of the money. Which of the two you pick depends on whether you want managed services or a lower bill, and it is a genuinely close call.

And if Microsoft is not one of your suppliers but effectively your IT department, look at IONOS and plan for two projects rather than one. Moving the servers is the easy half; the directory, the devices and the documents are where the dependency actually lives, and no amount of infrastructure migration touches them.