Your M365 contract won't save you from the CLOUD Act, but a paper trail might

Here's an uncomfortable fact most engineering teams don't think about until a client or auditor forces the issue: your company's email, calendar, and files probably live under US jurisdiction regardless of which Azure or GCP region you picked in the admin console. Region settings control where bytes sit on disk. They don't control which country's courts can compel the provider to hand them over.

Most teams never actually test this. They assume it, worry about it in a Slack thread, then move on. The fix is simpler than people expect: write down the right questions, send them to your provider in writing, and keep the answers on file.

This isn't about catching Microsoft or Google in some conspiracy. Their engineering and security teams are solid.…