Skip to content
Submit a ticket
  • There are no suggestions because the search field is empty.

Understanding Data Residency in Microsoft 365: ADR, Multi-Geo, and the EU Data Boundary

A guide to Microsoft's data residency options for organizations with sovereignty, privacy, or compliance requirements.

Data residency — where an organization's data is physically stored at rest — has become a central concern for IT leaders, compliance teams, and procurement departments worldwide. Regulations like GDPR, industry-specific mandates, and national sovereignty laws increasingly require organizations to know and control the geographic location of their cloud data.

Microsoft 365 offers several mechanisms to address these requirements. This article explains the key options, who they're designed for, and how they work together.

How Microsoft 365 assigns data location

When a Microsoft 365 tenant is created, Microsoft assigns a Default Geography based on the organization's billing address. Core services — Exchange Online, SharePoint, OneDrive, and Teams — are provisioned in the data center region associated with that geography.

For tenants in EU or EFTA countries (which includes Norway and Switzerland), data is provisioned within the broader EU/EFTA region by default. This does not guarantee storage in a specific country — only within the region.

Microsoft Learn: Microsoft 365 data locations ↗

The EU Data Boundary (EUDB)

For organizations with tenants in the European Union or EFTA, Microsoft provides the EU Data Boundary at no additional cost. Under the standard product terms, Microsoft commits to storing customer data at rest within the EU/EFTA region.

This is sufficient for many European organizations. Organizations that need country-level guarantees (e.g., data must remain in Switzerland, France, or Germany specifically) can consider Advanced Data Residency.

Advanced Data Residency (ADR)

Advanced Data Residency is a paid add-on that gives organizations a contractual commitment from Microsoft to store customer data at rest in a specific local country or region. It covers a broader set of services than the default product terms.

Services covered by ADR

  • Exchange Online (mailbox content, calendar entries, attachments)
  • SharePoint and OneDrive (site content and files)
  • Microsoft Teams (chat messages, channel messages, meeting messages, images, and meeting recordings via Stream on SharePoint)
  • Microsoft 365 Copilot and Copilot Chat
  • Microsoft Defender for Office Plan 1 (including Exchange Online Protection)
  • Microsoft 365 web apps
  • Viva Connections
  • Microsoft Purview (Data Loss Prevention, Information Barriers, Information Protection, Audit Standard & Premium, and Data Lifecycle Management — as of February 2026)

Eligible countries and regions

The tenant's Default Geography must correspond to one of the following Local Region Geographies: Australia, Austria, Brazil, Canada, Chile, France, Germany, India, Indonesia, Israel, Italy, Japan, Malaysia, Mexico, New Zealand, Norway, Poland, Qatar, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, United Arab Emirates, and United Kingdom, Indonesia, Malaysia, Chile, and Austria.

Licensing requirements

To qualify for ADR, an organization must:

  1. Have a tenant Default Geography in one of the eligible local regions listed above.
  2. Hold licenses for at least one qualifying product (Microsoft 365 F1/F3/E3/E5, Office 365 F3/E1/E3/E5, SharePoint Online Plan 1/2, or OneDrive for Business Plan 1/2).
  3. Purchase the ADR add-on for 100% of paid licenses in the tenant — partial coverage is not supported.

ADR for Education is available only through Volume Licensing / EES (Enrollment for Education Solutions).

Microsoft Learn: Advanced Data Residency in Microsoft 365 ↗

Multi-Geo Capabilities

Multi-Geo is a separate offering designed for multinational organizations that need to store different users' data in different geographies simultaneously. A Global Admin can assign individual users' data to specific satellite geographies based on their location or regulatory requirements.

Multi-Geo currently supports Exchange Online, SharePoint, OneDrive, Teams, and Microsoft 365 Copilot at the user level.

ADR vs. Multi-Geo — which one?

  • ADR commits the entire tenant's data to a single local region. Best for organizations with a straightforward requirement to keep all data in one country.
  • Multi-Geo allows per-user or per-site data placement across multiple regions. Best for multinational organizations with users in several jurisdictions.

When both are active, Multi-Geo configuration takes precedence for users who have a Preferred Data Location assigned. Many compliance-focused organizations use ADR to anchor the tenant in a home region, then use Multi-Geo to pin specific users' data to other regions as needed.

Microsoft Learn: Data residency overview and definitions ↗

How to check where tenant data is stored today

A Global Admin can verify the current data location for each Microsoft 365 service at any time:

  1. Open the Microsoft 365 Admin Center.
  2. Navigate to Settings → Org settings → Organization profile → Data location.
  3. The Data Location Card shows the Current Geography (where data is stored now) and the Committed Geography (where Microsoft has committed to store it) for each service.

A mismatch between Current and Committed geography typically means a migration is in progress.

Microsoft Learn: The Data Location Card ↗

What happens after purchasing ADR?

If the tenant's data is not already in the eligible local region, Microsoft performs a migration:

  1. After applying ADR licenses, a Global Admin visits the Data Location Card in the Admin Center.
  2. The admin opts in to initiate the migration.
  3. Microsoft migrates in-scope customer data on a per-service basis. This is a back-end operation with minimal impact on end users.
  4. Progress and completion notices appear in the Message Center and on the Data Location Card.

No action is required from end users during the migration.

Data residency vs. data sovereignty: what's the difference?

Data residency determines where your data is stored at rest. Data sovereignty is a broader question: who can access your data, who controls the encryption keys, and which country's laws govern it. A tenant can meet every residency requirement and still face sovereignty questions, because residency alone does not change who operates the service or which legal frameworks apply to it.

In practice, sovereignty discussions in Microsoft 365 revolve around three controls beyond location:

  • Encryption key control. With Customer Key, your organization provides and controls the root keys used to encrypt Microsoft 365 data, rather than relying solely on Microsoft-managed keys.
  • Operator access. Customer Lockbox requires your explicit approval before a Microsoft engineer can access your content during a support operation.
  • Legal jurisdiction. Because Microsoft is a US-headquartered company, some European organizations assess exposure to extraterritorial legislation such as the US CLOUD Act as part of their sovereignty review, independent of where the data physically sits.

If your compliance requirement is purely "data must stay in country X," ADR or Multi-Geo answers it. If the requirement extends to control and jurisdiction, Microsoft's answer is the Sovereign Cloud portfolio.

Microsoft Sovereign Cloud: when residency isn't enough

Microsoft Sovereign Cloud, introduced in June 2025 and now generally available, adds sovereignty controls on top of the residency options covered above. It comes in three deployment models.

Sovereign Public Cloud

Runs in Microsoft's existing European datacenters within the EU Data Boundary, covering Azure, Microsoft 365, Power Platform, and Microsoft Security. It adds controls aimed squarely at the sovereignty questions residency cannot answer:

  • Data Guardian. Microsoft personnel located in Europe oversee and approve any remote access to systems handling European customer data.
  • External Key Management. Encryption keys can be held in hardware security modules operated by the customer or a European partner, outside Microsoft's control.
  • Tamper-evident access logs. Customer-visible, verifiable records of operational access to your environment.

For most European organizations with sovereignty requirements, this is the relevant option: the same Microsoft 365 services, with added control and transparency.

Sovereign Private Cloud

For organizations that need workloads outside Microsoft's public cloud entirely, such as defense, critical infrastructure, and national security scenarios, running in a customer or partner datacenter with support for disconnected operation.

National Partner Clouds

Localized cloud instances operated with or by approved national partners, with service scope varying by country.

Microsoft Learn: What is Microsoft Sovereign Cloud? ↗

How the options stack

Think of the mechanisms in this article as layers: the EU Data Boundary provides regional residency at no extra cost, ADR adds a country-level commitment, Multi-Geo adds per-user placement, and Sovereign Cloud adds control over access, keys, and operations.

How this relates to Decisions

Decisions runs entirely within the Microsoft 365 tenant. Meeting data — agendas, minutes, decisions, and action items — is stored in SharePoint and Exchange Online within the tenant.

This means that whatever data residency configuration applies to the tenant's SharePoint and Exchange data also applies to data created and managed through Decisions. If a tenant is committed to storing data in Switzerland, Germany, or any other ADR-eligible region, Decisions meeting data follows the same commitment. The same principle applies to sovereignty configurations: for tenants running in Microsoft's Sovereign Public Cloud, meeting data created through Decisions is stored in the tenant's SharePoint and Exchange Online and inherits those sovereignty controls.

For more details, see our Privacy & Data Processing FAQ.

FAQ

What is the difference between data residency and data sovereignty in Microsoft 365?
Data residency is about where data is stored at rest. Data sovereignty covers who can access the data, who controls the encryption keys, and which country's laws apply to it. EUDB, ADR, and Multi-Geo address residency; Microsoft Sovereign Cloud addresses sovereignty.

Does the EU Data Boundary make Microsoft 365 sovereign?
No. The EU Data Boundary keeps customer data within the EU/EFTA region, which answers residency requirements. It does not by itself change encryption key control, operator access, or legal jurisdiction. Organizations with those requirements should evaluate Microsoft Sovereign Cloud controls such as Data Guardian and External Key Management.

What is Microsoft Sovereign Cloud and who needs it?
Microsoft Sovereign Cloud is a portfolio of sovereignty offerings: Sovereign Public Cloud (Microsoft's European datacenters with added access, key, and logging controls), Sovereign Private Cloud (for customer-run datacenters), and National Partner Clouds. It is designed for organizations, often in government and regulated sectors, whose requirements go beyond data location.

Where is Decisions meeting data stored if we adopt Sovereign Public Cloud?
In your own Microsoft 365 tenant, in SharePoint and Exchange Online, exactly as in any other tenant configuration. Because Decisions stores meeting content in your tenant, agendas, minutes, and decision logs inherit whatever residency and sovereignty configuration your tenant runs.

Further reading