# Data Residency and Geographic Audit Monitoring

**Last updated:** 2026-04
**Status:** GA
**Category:** Monitoring & Observability

---

## Introduksjon

Data residency og geographic audit monitoring sikrer at organisasjoner kan verifisere hvor dataene deres lagres og prosesseres, samt spore datahåndtering på tvers av geografiske grenser. Dette er kritisk for compliance med GDPR, AI Act, Schrems II, og andre regulatoriske krav som gjelder offentlig sektor i Norge.

Microsoft Cloud-tjenester tilbyr omfattende logging og monitoring for å verifisere at Customer Data, personal data, og Professional Services Data forblir innenfor definerte geografiske grenser. Audit logging fanger systemhendelser, datahåndtering, og tilgangskontroller med tidsstempler og geografisk kontekst.

EU Data Boundary er Microsofts commitment til å lagre og prosessere data innenfor EU/EFTA-regionen for kunder som velger denne konfigurasjonen. Effektiv monitoring av data residency krever kontinuerlig validering av hvor data faktisk befinner seg, ikke bare hvor den er konfigurert til å være.

## Kjernekomponenter

### Microsoft Purview Audit

| Funksjon | Standard | Premium |
|----------|----------|---------|
| **Audit Records** | Service configuration, audited activities, audit log query permissions | + High-value crucial events med lengre retention |
| **Retention** | 90 dager default | Konfigurerbare retention policies |
| **Geographic Storage** | Local Region Geography | Local Region Geography |
| **API Access** | Office 365 Management Activity API | Higher bandwidth access |
| **Compliance** | ISO 27001, SOC 1/2/3 | + FedRAMP, GDPR-optimalisert |

**Verified:** Microsoft Learn, 2026-02

### Azure Monitor og Log Analytics

```kusto
// Geographic distribution av resources
Resources
| where type =~ 'microsoft.documentdb/databaseaccounts'
| project id, name, writeLocations = (properties.writeLocations)
| mv-expand writeLocations
| project id, name, writeLocation = tostring(writeLocations.locationName)
| where writeLocation in ('Norway East', 'West Europe')
| summarize by id, name
```

**Nøkkelfelt for data residency tracking:**

| Felt | Beskrivelse | Bruk for compliance |
|------|-------------|---------------------|
| `location` | Azure region for resource | Verifisere regional deployment |
| `writeLocations` | Geographic write endpoints (Cosmos DB, etc.) | Multi-region data residency |
| `properties.dataLocation` | Customer data storage location | GDPR data residency |
| `customDimensions.aadTenantId` | Tenant identifier | Tenant-level geographic mapping |
| `customDimensions.countryCode` | Country code fra telemetry | Geographic context for events |

### EU Data Boundary Configuration

**Azure:**
- Regional services: Deploy i EU/EFTA regions (Norway East, West Europe, etc.)
- Non-regional services: Konfigurer via Azure Resource Manager til EU Data Boundary
- **OBS (2026-04):** Azure Resource Manager EU Data Boundary kan kun konfigureres for **nye tenants uten eksisterende subscriptions/ressurser**. Eksisterende ressurser kan ikke flyttes inn eller ut av tenant med EU Data Boundary. *(Verified MCP 2026-04)*
- **Application Change Analysis:** Lagres og prosesseres globalt — ikke tilgjengelig i EU Data Boundary. Bruk Azure Policy + Resource Graph som alternativ.
- Validation: Azure Policy kan enforces geographic constraints

**Dynamics 365 & Power Platform:**
- Geographic area (Geo) basert på billing address
- Provision tenant og environments i EU Data Boundary Geo
- Data residency følger environment-plassering
- **Copilot/generative AI (2026-04):** For EU-miljøer i EU Data Boundary brukes Azure OpenAI-endepunkt innenfor samme boundary. "Allow flex routing during periods of peak load"-checkbox tilgjengelig for EU-miljøer. Bing Search-data prosesseres i USA selv ved EU-residency. *(Verified MCP 2026-04)*

**Microsoft 365:**
- Automatisk EU Data Boundary for tenants med sign-up i EU/EFTA
- **Viktig:** Multi-Geo Capabilities ekskluderer fra EU Data Boundary

**Verified:** Microsoft Privacy & EU Data Boundary documentation, 2026-02

### Pseudonymization i System-Generated Logs

Microsoft pseudonymiserer personal data i system-generated logs før lagring i Cosmos/Kusto. Dette beskytter personvern samtidig som logs kan brukes for diagnostikk og sikkerhet.

**Teknikker:**
- Encryption av identifiers
- Masking av sensitive fields
- Tokenization
- Data blurring

**Access controls:**
- Just-In-Time (JIT) access for reidentification
- Audit av alle rehydration-operasjoner
- Same security controls som Customer Data

**Verified:** Microsoft Assurance documentation, 2026-02

## Arkitekturmønstre

### 1. Centralized Audit Collection Pattern

**Arkitektur:**
```
Data Sources (Azure, M365, Dynamics)
  → FIPS 140-2 TLS upload
  → NRT Security Monitoring + Cosmos/Kusto
  → Machine Learning Detection
  → Alerts/Dashboards
  → Microsoft Purview Audit Portal
```

**Fordeler:**
- Near real-time (NRT) detection av geographic policy violations
- Unified view på tvers av alle Microsoft Cloud services
- 90-dag retention i Cosmos, 180-dag i Kusto
- Machine learning-basert anomaly detection

**Ulemper:**
- Krever Premium Audit for lengre retention
- Pseudonymization kan komplisere forensics
- Reidentification krever JIT access approval

**Best for:** Organisasjoner med strenge compliance-krav og behov for tverrgående visibility.

---

### 2. Azure Policy + Resource Graph Pattern

**Arkitektur:**
```
Azure Resources
  → Azure Policy (geographic constraints)
  → Resource Graph queries
  → Compliance dashboards
  → Automated alerts
```

**KQL for compliance verification:**
```kusto
// Find resources deployed utenfor godkjente regioner
Resources
| where location !in ('norwayeast', 'westeurope', 'northeurope')
| where tags['DataClassification'] == 'Confidential'
| project id, name, type, location, resourceGroup
```

**Fordeler:**
- Proaktiv enforcement (blokkerer non-compliant deployments)
- Kontinuerlig compliance scanning
- Integration med Azure Security Center
- No-code configuration

**Ulemper:**
- Gjelder kun Azure resources (ikke M365/Dynamics)
- Krever nøye tag-strategi for klassifisering
- Kan blokkere legitime use cases hvis for restriktiv

**Best for:** Azure-sentrerte organisasjoner med strenge geographic deployment policies.

---

### 3. Microsoft Purview DLP + Audit Pattern

**Arkitektur:**
```
Data flows (emails, documents, API calls)
  → DLP policies (geographic rules)
  → Quarantine/Block ved violation
  → Purview Audit logging
  → Activity Explorer + unified audit logs
```

**Komponenter:**
| Komponent | Geographic capability |
|-----------|----------------------|
| **DLP Policies** | Block data exfiltration utenfor godkjente regioner |
| **Audit Logs** | Track geographic context for data access |
| **Activity Explorer** | Visualize data movement patterns |
| **Alerts Dashboard** | Real-time geographic violation alerts |

**Fordeler:**
- Preventive controls (ikke bare detection)
- Coverage for M365, Power Platform, Dynamics
- Unified audit logs med geographic context
- Integration med Microsoft Defender

**Ulemper:**
- Krever E5/G5 licensing (eller Purview standalone)
- Kompleks konfigurering for multi-geo scenarios
- False positives kan blokkere legitimate business flows

**Best for:** Organisasjoner med sensitive data og regulatory requirements for data movement restrictions.

## Beslutningsveiledning

### Velg riktig audit strategi

| Scenario | Anbefalt tilnærming | Rationale |
|----------|---------------------|-----------|
| **Azure-only environment** | Azure Policy + Resource Graph | Native Azure controls, proaktiv enforcement |
| **Microsoft 365-sentrert** | Purview Audit Premium + DLP | Unified audit logs, content-aware policies |
| **Multi-cloud (Azure + M365 + Dynamics)** | Microsoft Purview (full suite) | Single pane of glass, tverrgående compliance |
| **Offentlig sektor (Norge)** | EU Data Boundary + Purview Audit Premium | GDPR-optimalisert, dokumenterbar compliance |
| **Sensitive AI workloads** | EU Data Boundary + Azure AI geographic constraints + Purview | Kombinert infrastructure + data governance |

### Vanlige feil å unngå

| Feil | Konsekvens | Hvordan unngå |
|------|------------|---------------|
| **Anta at default = compliant** | Data kan lagres utenfor ønsket region | Eksplisitt konfigurer EU Data Boundary for alle services |
| **Ignore non-regional services** | Bot Service, Communication Services, etc. kan lagre data globalt | Sjekk [non-regional service configuration guide](https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-configure-azure-nonregional-services) |
| **Glemme Professional Services Data** | Support cases, consulting engagements kan inneholde customer data | Konfigurer Azure Resource Manager til EU Data Boundary |
| **Multi-Geo misforståelse** | M365 Multi-Geo er **ikke** kompatibelt med EU Data Boundary | Velg enten Multi-Geo eller EU Data Boundary, ikke begge |
| **Manglende audit retention policy** | Audit logs slettes etter 90 dager (Standard) | Implementer Purview Audit Premium med custom retention policies |
| **Ikke test failover scenarios** | Disaster recovery kan flytte data til non-compliant regions | Verifiser at geo-redundant backups også respekterer data residency |

### Røde flagg i audit logs

**KQL queries for detection:**

```kusto
// Detect data export events til non-approved regions
AuditLogs
| where OperationName in ("FileDownloaded", "FileCopied", "Export")
| extend TargetRegion = tostring(parse_json(TargetResources)[0].location)
| where TargetRegion !in ("norwayeast", "westeurope", "northeurope")
| project TimeGenerated, UserPrincipalName, OperationName, TargetRegion, ResultDescription
```

```kusto
// Find unauthorized access fra IP addresses utenfor Norge/EU
SigninLogs
| where Location !has "Norway" and Location !has "Europe"
| where AppDisplayName has "Azure" or AppDisplayName has "SharePoint"
| project TimeGenerated, UserPrincipalName, AppDisplayName, Location, IPAddress, ResultType
```

## Integrasjon med Microsoft-stakken

### Azure AI Foundry

**Data residency tracking:**
- Azure OpenAI Service: Deploy i Norway East eller West Europe
- Model deployment region tracked via Azure Monitor
- Prompt/completion logs følger workspace region

**Audit capabilities:**
```kusto
// Track Azure OpenAI requests med geographic context
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.COGNITIVESERVICES"
| where Category == "RequestResponse"
| project TimeGenerated, location_s, model_s, prompt_tokens_d, completion_tokens_d
| summarize RequestCount=count() by location_s
```

### Copilot Studio

**Geographic data flows:**
- Agent conversations lagres i Power Platform environment region
- Connector data til eksterne systems (Salesforce, etc.) — **maker ansvar** for residency
- Connector data til Microsoft services (SharePoint, Dataverse) — automatisk residency

**Compliance verification:**
- Purview Audit (Premium) logger alle agent interactions
- `customDimensions.environmentName` + `countryCode` identifiserer geographic context

### Power Platform

**Purview SAS IP restriction logging:**

Felter for geographic audit:

| Felt | Beskrivelse |
|------|-------------|
| `enduser.ip_address` | Public IP av caller (geographic inference) |
| `ip_binding_mode` | Tenant admin IP binding configuration |
| `admin_provided_ip_ranges` | Allowed IP ranges (kan være region-specific) |
| `response.status_code` | 200 (success) eller 401 (geo-blocked) |

**Aktivere logging:**
Power Platform Admin Center → Environment settings → Purview audit logging (per environment)

**Verified:** Microsoft Learn, 2026-02

### Azure Confidential Ledger

**Data residency commitment:**
- Ledger entries og metadata lagres i deployed region
- Hardware-backed TEE (Trusted Execution Environment) sikrer confidentiality
- Integration med Azure Key Vault (har egen data residency policy)

**Backup considerations:**
- GRS (Geo-Redundant Storage) kan replicate til paired region
- Verifiser at paired region også er innenfor godkjent boundary (eks. Norway East ↔ Norway West)

## Offentlig sektor (Norge)

### GDPR Article 44-49: Data Transfers

**Microsoft EU Data Boundary alignment:**
- **Article 45:** EU Commission adequacy decision — EU/EFTA datacenters er "adequate"
- **Article 46:** Standard Contractual Clauses (SCCs) — inkludert i Microsoft DPA
- **Article 49:** Derogations — pseudonymized logs for service operations

**Dokumentasjonskrav (Forvaltningsloven § 11):**
- Audit logs må bevares som dokumentasjon for beslutninger
- Retention: Minimum regulatorisk krav (ofte 5-10 år for offentlig sektor)
- Purview Audit Premium tillater lengre retention policies

### AI Act (EU 2024/1689)

**Artikkel 12: Record-keeping for high-risk AI systems:**

AI-systemer i offentlig sektor (biometric identification, critical infrastructure, law enforcement) krever:
- Automatisk logging av alle AI-beslutninger
- Geographic context for data processing
- Retention "for a period that is appropriate in light of their intended purpose and applicable legal obligations"

**Microsoft implementation:**
- Azure AI Studio: Logging av model deployments og inference requests
- Azure Monitor: Custom logs for AI decision audit trail
- Microsoft Purview: Unified audit for AI workloads

**Baseline:** AI Act enforcement starter 2026-08-02. Microsoft tilpasser løpende.

### Schrems II og dataoverføringer

**Post-Schrems II (2020) requirements:**
1. **Transfer Impact Assessment (TIA):** Vurder om data kan aksesseres av non-EU myndigheter
2. **Supplementary Measures:** Beyond SCCs, tekniske tiltak som encryption, pseudonymization
3. **Documentation:** Audit trail for cross-border data transfers

**Microsoft approach:**
- **EU Data Boundary** eliminerer de fleste cross-border transfers
- **Pseudonymization** i system logs (supplementary measure)
- **Access controls:** Just-In-Time (JIT) for Microsoft personnel
- **Transparency:** Audit logs dokumenterer alle access events

**For norsk offentlig sektor:**
- Velg EU Data Boundary for alle Microsoft Cloud services
- Implementer Purview Audit Premium for dokumentasjon
- Gjennomfør TIA for eventuelle residual transfers (support, troubleshooting)

### Digdir Skytjenesterammetest

**Krav til sporbarhet (Availability, Integrity):**
- Logging av alle administrative handlinger
- Geografisk kontekst for datalagring og -prosessering
- Dokumenterbar compliance med data residency

**Microsoft capabilities:**
- Microsoft Purview Audit: Oppfyller logging-krav
- Azure Policy: Enforcer geographic constraints
- Service Trust Portal: Compliance dokumentasjon (ISO, SOC, FedRAMP)

## Kostnad og lisensiering

### Microsoft Purview Audit

| Tier | Lisenskrav | Kostnad (estimat) | Data residency features |
|------|-----------|-------------------|-------------------------|
| **Standard** | Inkludert i E3/E5, G3/G5 | Ingen ekstra kostnad | 90-dag retention, Local Region Geography storage |
| **Premium** | E5/G5 eller standalone add-on | ~$5/user/mnd (add-on) | Konfigurerbar retention (opptil 10 år), high-value events |
| **Standalone** | Purview Compliance | ~$5/user/mnd | Full DLP + Audit Premium capabilities |

**Verified:** Microsoft 365 pricing (2026-01, USD estimater)

### Azure Monitor og Log Analytics

**Pricing model (Norway East):**
- **Ingestion:** ~$2.76 per GB
- **Retention:** Første 31 dager inkludert, deretter ~$0.12 per GB/måned
- **Data Archive:** ~$0.02 per GB/måned (for long-term compliance retention)

**Optimization tips:**
1. **Sampling:** Ikke sample compliance-logs (krever 100% coverage for audit)
2. **Retention tiers:**
   - 0-31 dager: Interactive (default)
   - 31 dager - 2 år: Basic (lavere kostnad, tregere queries)
   - 2+ år: Archive (billigst, kun for compliance retrieval)
3. **Table-level retention:** Konfigurer lengre retention kun for audit-relevante tables

**Geographic cost consideration:**
- Norway East og West Europe har identisk pricing
- Cross-region data transfer: ~$0.02 per GB (unngå hvis mulig for både kostnad og compliance)

### Azure Policy (geographic enforcement)

**Kostnad:** Gratis (inkludert i Azure subscription)

**Hidden costs:**
- **Compute overhead:** Policy evaluation kan legge til ~100-200ms per deployment
- **Engineering time:** Komplekse policies krever vedlikehold

**ROI argument:**
- Forebygging av én compliance violation sparer typisk 100x kostnaden av Policy implementation
- GDPR-bøter: opptil €20M eller 4% av global årlig omsetning

## For arkitekten (Cosmo)

### Spørsmål å stille kunden

1. **Regulatory scope:**
   - "Hvilke compliance-krav gjelder for deres data? GDPR, AI Act, Schrems II, andre?"
   - "Er dere definert som 'offentlig organ' under Forvaltningsloven?"
   - "Har dere gjennomført DPIA (Data Protection Impact Assessment) for AI-løsningen?"

2. **Data classification:**
   - "Hvilken klassifisering har dataene som skal prosesseres? (Åpne, Begrenset, Konfidensielt, Strengt Konfidensielt?)"
   - "Inneholder datasettet personopplysninger? Sensitive personopplysninger (helsedata, biometri)?"

3. **Geographic requirements:**
   - "Har dere eksplisitte krav til at data skal lagres i Norge, eller er EU/EFTA akseptabelt?"
   - "Hva er konsekvensen hvis data midlertidig prosesseres utenfor ønsket region (f.eks. under disaster recovery)?"

4. **Audit og retention:**
   - "Hvor lenge må audit logs bevares? (Regulatorisk krav? Organisasjonspolicy?)"
   - "Hvem skal ha tilgang til audit logs? (Security team? Compliance officers? Datatilsynet?)"

5. **Integration complexity:**
   - "Bruker dere allerede Microsoft 365, Azure, Dynamics, eller Power Platform? (Eller kombinasjon?)"
   - "Integrerer dere med eksterne/non-Microsoft systemer som kan påvirke data residency?"

6. **Incident response:**
   - "Hva er SLA for å detektere og respondere på geographic policy violations?"
   - "Har dere etablert prosess for Transfer Impact Assessment (TIA) ved tredjeparts-integrasjoner?"

7. **Maturity level:**
   - "Har dere eksisterende monitoring dashboards? (Azure Monitor, Power BI, andre?)"
   - "Er det etablert SIEM/SOAR for security monitoring? (Sentinel, Splunk, andre?)"

### Fallgruver å unngå

| Fallgruve | Hvorfor det skjer | Hvordan unngå |
|-----------|-------------------|---------------|
| **"Azure region = data residency"** | Antakelse at deploy i Norway East er nok | Verifiser også non-regional services, backup locations, og failover regions |
| **Glemme Azure AI Service geographic nuances** | Azure OpenAI kan flytte data til US/EU for abuse monitoring | Les [data movement documentation](https://learn.microsoft.com/en-us/power-platform/admin/geographical-availability-copilot) nøye |
| **Purview Audit uten oppfølging** | Aktivere logging uten dashboards/alerts | Implementer proaktiv monitoring (Azure Monitor Workbooks, Sentinel) |
| **Over-retention av logs** | "Keep everything forever" for å være sikker | GDPR Article 5(1)(e) krever storage minimization — slett når ikke lenger nødvendig |
| **Blokkere legitimate flows** | For restriktive DLP policies | Start med "Audit mode", analyser patterns, deretter enforce |
| **Ignore residual transfers** | Anta EU Data Boundary eliminerer **alle** transfers | Microsoft support/troubleshooting kan kreve midlertidig access — dokumenter i TIA |

### Anbefalinger per modenhetsnivå

**Nivå 1: Ad-hoc (ingen systematisk data residency monitoring)**
1. Start med Azure Policy for geographic constraints (quick win, gratis)
2. Aktiver Purview Audit Standard (hvis M365/Dynamics i bruk)
3. Lag enkel KQL dashboard for geographic resource distribution

**Nivå 2: Defined (basic policies, men reaktiv monitoring)**
1. Implementer EU Data Boundary for alle Microsoft Cloud services
2. Oppgrader til Purview Audit Premium for lengre retention
3. Konfigurer alerts for geographic policy violations (Azure Monitor Action Groups)
4. Gjennomfør Transfer Impact Assessment (TIA) workshop

**Nivå 3: Managed (proaktiv monitoring, automatiserte controls)**
1. Implementer Microsoft Purview DLP med geographic rules
2. Integrer audit logs med SIEM (Sentinel) for correlation
3. Automatiser compliance rapportering (Power BI dashboards fra Log Analytics)
4. Etabler quarterly audit reviews med Compliance officer

**Nivå 4: Optimized (kontinuerlig forbedring, full transparency)**
1. Machine learning-basert anomaly detection (Azure Monitor ML alerts)
2. Automated remediation (Logic Apps → block non-compliant deployments)
3. Integration med Datatilsynet rapportering (hvis relevant)
4. Annual third-party audit av data residency controls (ISO 27001, etc.)

### Architecture Decision: Single-region vs. Multi-region

**Når velge single-region (f.eks. kun Norway East):**
- ✅ Strengeste data residency krav (offentlig sektor, sensitive data)
- ✅ Enklere compliance dokumentasjon
- ✅ Ingen risk for cross-region data leaks
- ❌ Single point of failure (lavere availability)
- ❌ Høyere latency for brukere utenfor regionen

**Når velge multi-region (Norway East + West Europe):**
- ✅ Høyere availability (disaster recovery)
- ✅ Bedre global performance (CDN, geo-distributed users)
- ✅ Azure paired regions (automatic failover)
- ❌ Kompleksere compliance (må verifisere begge regioner)
- ❌ Risk for misconfiguration → data leakage

**Cosmo's anbefaling:**
For norsk offentlig sektor med AI workloads: **Start single-region (Norway East), evaluer multi-region når availability SLA krev det**. Implementer Azure Site Recovery for disaster recovery til Norway West (som også er innenfor EU Data Boundary).

## Kilder og verifisering

### Microsoft Learn (Verified via MCP, 2026-02)

1. [What is the EU Data Boundary?](https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn)
   - **Confidence:** Verified
   - **Sist oppdatert av Microsoft:** 26. februar 2025
   - **Relevans:** Definisjon av EU Data Boundary, configuration guidance, datacenter locations. Inkluderer nå Microsoft Fabric, Power BI Embedded, Translator (europeisk endepunkt). Azure Resource Manager EUDB kun for nye tenants. *(Verified MCP 2026-04)*

2. [Configuring Azure non-regional services for the EU Data Boundary](https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-configure-azure-nonregional-services)
   - **Confidence:** Verified
   - **Relevans:** Bot Service, Communication Services, Azure Stack Edge/Hub, Azure Local (tidl. Azure Stack HCI), Azure Migrate, Azure VM Image Builder, Cloud Shell, Microsoft Fabric, Power BI Embedded, Translator (EU-endepunkt), Microsoft Entra ID. Application Change Analysis lagres fortsatt globalt. *(Verified MCP 2026-04)*

3. [Audit logging and monitoring overview](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging)
   - **Confidence:** Verified
   - **Relevans:** Audit data flow, NRT detection, pseudonymization, log retention

4. [Security and geographic data residency in Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/geo-data-residency-security)
   - **Confidence:** Verified
   - **Relevans:** Data residency for conversational AI, connector responsibilities

5. [Advanced Data Residency Commitments - Microsoft Purview](https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-commitments?view=o365-worldwide#microsoft-purview)
   - **Confidence:** Verified
   - **Relevans:** Audit (Standard/Premium), DLP, Records Management data residency

6. [Azure, Dynamics 365, Microsoft 365, and Power Platform compliance offerings](https://learn.microsoft.com/en-us/azure/compliance/offerings/)
   - **Confidence:** Verified
   - **Relevans:** ISO 27001/27017/27018, SOC 1/2/3, FedRAMP certifications

7. [European Union Data Boundary (EUDB) support in Azure Communication Services](https://learn.microsoft.com/en-us/azure/communication-services/concepts/european-union-data-boundary)
   - **Confidence:** Verified
   - **Relevans:** EUDB compliance for voice, video, chat, SMS, email capabilities

8. [Move data across regions for Copilots, AI agents, and generative AI features](https://learn.microsoft.com/en-us/power-platform/admin/geographical-availability-copilot)
   - **Confidence:** Verified
   - **Relevans:** Azure OpenAI endpoint regions for EU (EU Data Boundary), Bing Search alltid USA, ny "Allow flex routing during periods of peak load" for EU, Microsoft 365 services checkbox nå separat. Tittel oppdatert til å inkludere "AI agents". *(Verified MCP 2026-04)*

### Azure Resource Graph Samples

9. [Azure Monitor Resource Graph samples](https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/samples-by-category#azure-monitor)
   - **Confidence:** Verified (code samples)
   - **Relevans:** KQL queries for geographic resource distribution

10. [Azure Cosmos DB Resource Graph samples](https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/advanced#list-azure-cosmos-db-with-specific-write-locations)
    - **Confidence:** Verified (code samples)
    - **Relevans:** Query write locations for multi-region databases

### Service Trust Portal (referenced, not directly accessible via MCP)

11. [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
    - **Confidence:** Baseline (requires authenticated access)
    - **Relevans:** ISO certificates, SOC reports, FedRAMP documentation

### Additional context (Baseline - model knowledge)

12. **GDPR Articles 44-49:** Data transfers outside EU/EEA
    - **Confidence:** Baseline
    - **Relevans:** Legal framework for data residency requirements

13. **AI Act (EU 2024/1689) Article 12:** Record-keeping for high-risk AI systems
    - **Confidence:** Baseline
    - **Relevans:** Logging requirements for AI systems in public sector

14. **Schrems II (CJEU C-311/18):** Invalidation of Privacy Shield, requirements for Transfer Impact Assessments
    - **Confidence:** Baseline
    - **Relevans:** Additional measures beyond SCCs for data transfers

---

**Dokumentkonfidenssammendrag:**
- **Verified sections (85%):** Microsoft EU Data Boundary, Purview Audit, Azure Monitor, Copilot Studio, Communication Services, compliance certifications
- **Baseline sections (15%):** AI Act specifics (enforcement starts 2026-08), Schrems II case law interpretation, Norwegian public sector specific guidance

**Sist oppdatert:** 2026-04
**Neste review:** 2026-08 (etter AI Act enforcement start)
