Microsoft 365 E5

1 Residency and jurisdiction Score 2 · Partial

Rubric condition applied: "Data is in the EU or EEA, but a third-country regime reaches it through the parent with no technical or structural barrier." The EU Data Boundary is a genuine, contract-level commitment: Microsoft stores and processes customer data for in-scope Microsoft 365 tenants in EU and EFTA datacentres, and the commitment is written into the Product Terms, not offered as marketing. The same documentation then records what the boundary does not cover: continuing transfers of pseudonymised personal data for global security operations, global service quality metrics, Microsoft Entra directory data replicated outside the boundary, and Professional Services Data for consulting services stored in United States datacentres. Above the transfers sits the harder fact. The US CLOUD Act reaches data in the possession, custody or control of a US provider wherever it sits, and Microsoft's own transparency report for the second half of 2025 records that Microsoft provided content data to US law enforcement for three non-US enterprise customers whose data was stored outside the US, one of them located in the EU or EFTA. Microsoft's own sworn testimony in Paris settled the question the rubric asks: no guarantee against transmission to US authorities without French authorisation. Level 2 is what the evidence supports, and the evidence is quoted in the ledger. One fact answers two questions. The CLOUD Act reach that holds this criterion at 2 is the same fact that holds criterion 5 at 1, and the method scores it once per question: where the data sits here, who controls the vendor there. The division of labour is stated in each criterion's definition, and a vendor counting the fact twice is referred to the method.

2 Encryption and key control Score 2 · Partial

Rubric condition applied: "Encryption at rest and in transit with vendor-held keys; no customer rotation and no access transparency." As sold, Microsoft 365 encrypts customer data at rest and in transit with keys Microsoft holds. The opt-ins are real: Customer Lockbox can require customer approval before Microsoft personnel access content, and Purview Customer Key gives larger customers control of key material. Neither is the default, and the review scores the default configuration stated in the review head. The criterion scores data access governance, not cryptographic strength, and it is no assurance scheme.

3 Exit terms Score 2 · Partial

Rubric condition applied: "Export available but partial, in proprietary or lossy formats, or with fees and retention that impose real cost." Microsoft's lifecycle documentation is clear and deserves credit: 30 days Expired, 90 days Disabled with admin access, deletion no later than 180 days, no exit fee. What does not exist is a native, complete tenant export in open formats. Administrators can extract mailboxes and sites through eDiscovery and content search; a full migration at organisational scale means third-party tooling or services, which is a real cost and is priced as one. The retention clock after termination is a deletion deadline, not a retention right: the customer has 90 days of admin-only access before data is destroyed. Level 3 fails on the export condition, not the retention condition.

4 Transparency record Score 2 · Partial

Rubric condition applied: "Material enforcement with full remediation on record." Method version 1.1 added this condition after the first review's feedback found the gap it fills: a remediated sanction previously had no correct level. Microsoft's transparency reporting is the strongest part of this record: the Law Enforcement Requests Report appears semi-annually, includes enterprise-specific figures, and records cross-border disclosures that most providers do not publish. Against that stands the CNIL sanction of December 2022: a 60 million euro fine on Microsoft Ireland for advertising cookies on bing.com placed without consent, with a refusal mechanism harder than acceptance. The remediation is on record: the "Decline All" button preceded the sanction, the compliance order brought no reported further penalty, and the action ran under French ePrivacy law rather than the GDPR, concerning a consumer search product rather than Microsoft 365. Level 2 rather than 3, because a 60 million euro sanction from a national data protection authority is material, and the rubric records remediation; it does not reward it with a clean sheet.

5 Ownership and ultimate control Score 1 · Weak

Rubric condition applied: "Third-country parent with a clear compulsion pathway and no ring-fencing." Microsoft Corporation is a US parent; the CLOUD Act compulsion pathway is documented in statute and in Microsoft's own disclosure practice; the French Senate testimony quoted in the ledger is the vendor's own answer on the reach of that pathway. Microsoft has built serious engineering around the edges of this fact, including the EU Data Boundary and EU-based support tooling, but it has not built, and does not claim, a structure that keeps EU customer content beyond the reach of US legal process. Level 1 is a finding about structure, not about effort. The division of labour with criterion 1 stands: this criterion scores who controls the vendor, wherever the data sits.

6 Citizen protection in the contract Score 3 · Demonstrated

Rubric condition applied: "AI training and sale barred by default, with narrow opt-in exceptions bounded in the contract." The Product Terms commit that Microsoft Generative AI Services do not use Customer Data to train any generative AI foundation model without the customer's documented instructions, and the Data Protection Addendum bars use of Customer Data for advertising. These are contract terms, not blog posts, and they are stronger than the market average. Level 4 fails on one condition: material change. The Product Terms are updated by Microsoft unilaterally on publication, and the customer's remedy is notice and termination, not consent.

7 Environmental impact Score 4 · Proven

Rubric condition applied: "Power usage effectiveness at or below 1.2, with a majority renewable supply under documented procurement and public disclosure in place." Microsoft's FY25 power usage effectiveness is 1.17 globally and 1.16 for Europe, Middle East and Africa, below the 1.2 line, with electricity matched to renewable supply through documented power purchase agreements and green power products, publicly disclosed. The scope note belongs here: Microsoft's absolute emissions rose 25 per cent in FY2025 on data centre expansion, and the company retired unbundled renewable certificates during the year. The criterion scores efficiency and procurement, not emissions trajectory, and the conditions for level 4 are met. A reader who weights the trajectory more heavily has the figures in front of them to argue for level 3, and the index commentary will carry the point.

8 European sustainability Score 2 · Partial · weakest link applied

Proxy A, money flow: 2. Rubric condition applied: "An EU entity exists but the majority of revenue leaves the EU and EEA." The evidence is argued from where the money is recognised and where it goes. Microsoft 365 customers in EU member states are billed by Microsoft Ireland Operations Limited, an Irish entity, and Microsoft's Irish structure books the region's business at scale: accounts filed for the year to 30 June 2025 show Microsoft Ireland Operations Limited, which markets, sells and distributes for Europe, the Middle East and Africa and Asia-Pacific, recording revenue of 93.1 billion dollars and paying more than 838 million dollars in Irish corporation tax, while Microsoft Ireland Research paid 5.4 billion dollars in Irish corporation tax on royalty revenue of 76 billion dollars. The 93.1 billion dollar figure covers EMEA and Asia-Pacific, not the EU alone, and the review uses it because the entity, its recognition and the upstream flow it evidences are the proxy's subject. The money is recognised in the EU and taxed there; then it leaves. The same filings record Microsoft's Irish holding structure paying 48 billion dollars in dividends to Microsoft Corporation for the year, with a further 16 billion dollars paid after the year end and a further 4 billion approved from Microsoft Ireland Operations Limited. The revenue lands in Ireland; the majority of what it becomes does not stay. Level 2. Proxy B, capability: 3. Accounts for the same year record 2,934 employees at Microsoft Ireland Operations Limited and 1,463 at Microsoft Ireland Research, including engineering functions, and the European Development Centre carries real engineering work. The EU Data Boundary itself is operated under Microsoft's global DevOps model, in which the services are built and maintained by expert teams from around the world, and core product updates are parent-dependent. Condition applied: "An EU engineering presence exists, but core updates depend on the parent organisation." Proxy C, continuity: 4. Audited FY2026 accounts show a viable business on any reading. Search method: Microsoft's product retirement and service deprecation notices for the Microsoft 365 category were checked as at the capture date; Skype for Business Online, the category's largest retirement, carried a supported migration path to Teams, and no withdrawal without a supported migration path was found. All three proxies are read as at the capture date. The weakest link is money flow, and the criterion scores 2.

The relationship is workable under stated conditions, and the conditions are the story. An EU organisation can hold Microsoft 365 today with its data resident in the EU, strong contractual bars on AI training and secondary use, industry-leading transparency reporting and a supplier that will exist and publish accounts for the foreseeable decade. Those are real strengths, and the review records them as such. The conditions sit in the structure, not the conduct: US ownership, a statutory compulsion pathway that Microsoft's own testimony and its own transparency report confirm in operation, keys held by the vendor unless the customer buys deeper in, and an exit that takes planning, tooling and money. None of those conditions is fixed by a better configuration. They are fixed, if they are fixed at all, by contract negotiation, by key custody, by rehearsed exit, and by the emergence of European alternatives strong enough to price the risk.

The tier is Conditional, not Dependent, because the method scores what the vendor controls and Microsoft controls more of the right things than most of the default stack does. A reader expecting a lower verdict should ask which criterion they would score differently and against which evidence. A reader expecting a higher verdict should ask the same question from the other side: which of the three strong scores, contract protection, transparency or environmental performance, they would discount, and on what evidence. That argument is the point.

Right of reply issued 28 September 2026 to Microsoft media and analyst relations, Microsoft Ireland Operations Limited and Microsoft Corporation EU government affairs, with the draft scores, this evidence ledger and the rubric applied. Microsoft's analyst relations firm, Waggener Edstrom, replied on 30 September 2026: "Microsoft will not be able to participate in this research process." The reply addressed none of the four points invited in the letter and offered no counter-evidence, so the scores stand unchanged. The sender did not confirm reproduction in full, so the exchange is summarised here and the operative sentence quoted; the full text is held on file.

None to date. Draft dated 25 September 2026; issued for right of reply 28 September 2026; published 12 October 2026.

AltLibre has no financial relationship with Microsoft. AltLibre has published prior research comparing Microsoft 365 with European alternatives, including a side-by-side comparison and a licensing cost model, all on the public record at altlibre.com. No advisory client is reviewed under this method while an engagement lasts.

This review is published under CC BY-SA 4.0 by AltLibre. Method: the Sovereignty Scorecard, version 1.1.

← The Sovereignty Scorecard