Microsoft Azure

What Microsoft Azure does and how it appears on a website

Microsoft Azure is the public cloud platform operated by Microsoft Corporation, headquartered in Redmond, Washington. On a European website it typically appears as Azure App Service hosting the application, Azure Front Door distributing content globally, Azure Application Gateway balancing HTTP traffic, Azure SQL or Cosmos DB storing user data, Microsoft Entra ID handling authentication, and Application Insights capturing telemetry. Azure also powers higher level services such as Microsoft Clarity, Power BI Embedded, Azure OpenAI and Communication Services.

Microsoft offers the EU Data Boundary commitment, under which the storage and most processing of customer data and pseudonymous personal data for the core online services stays inside the European Union and European Free Trade Association. Some support, telemetry and identity operations may still touch US systems, and Microsoft Corporation remains subject to US extraterritorial laws.

Cookies and data collected by Azure

At the infrastructure layer, Azure mostly sets session affinity cookies. Azure App Service and Front Door use ARRAffinity and ARRAffinitySameSite to keep a visitor on the same instance. Application Gateway uses ApplicationGatewayAffinity and ApplicationGatewayAffinityCORS. Azure Front Door may also set the AzureAppProxyAccessCookie when authentication is enabled. These cookies are usually classified as strictly necessary for the operation of the website.

On top of this, Application Insights stores a unique user identifier (ai_user) and a session identifier (ai_session) in browser storage to measure usage. Microsoft Entra ID sets authentication cookies (ESTSAUTH, ESTSAUTHPERSISTENT) on the login domain. Higher level products such as Microsoft Clarity drop additional analytics cookies that require prior opt-in consent.

GDPR and ePrivacy implications

Microsoft acts as a processor under the Microsoft Products and Services Data Protection Addendum (DPA). The DPA incorporates the European Commission Standard Contractual Clauses, lists sub-processors, and binds Microsoft to ISO 27001, ISO 27018, ISO 27701, SOC 2 and EU Cloud Code of Conduct controls. The website operator stays the controller and remains responsible for every cookie set through an Azure component.

Under the ePrivacy Directive transposed nationally (TTDSG in Germany, LCEN in France, LSSI-CE in Spain), session affinity cookies are typically exempt from prior consent because they are strictly necessary, while Application Insights telemetry and Clarity cookies are not.

International data transfers and the EU Data Boundary

Microsoft Corporation is certified under the EU-US Data Privacy Framework, providing an adequacy basis for transfers to the United States. The Microsoft EU Data Boundary, fully rolled out in 2024, keeps customer data and pseudonymous personal data for Azure, Microsoft 365, Dynamics 365 and Power Platform in the EU and EFTA. Transfer impact assessments and supplementary measures such as customer managed keys with Azure Key Vault HSM are still recommended after Schrems II.

Consent and legal basis

For pure infrastructure (hosting, load balancing, content delivery, security), Article 6(1)(f) GDPR legitimate interest is the standard legal basis. For analytics and personalization features such as Application Insights or Microsoft Clarity, prior opt-in consent gathered through a Consent Management Platform is required before triggering the scripts.

Practical compliance steps

Sign the Microsoft DPA, opt into the EU Data Boundary scope, pin resources to EU regions, enable customer managed keys in Azure Key Vault, scope Microsoft Entra ID roles tightly, configure log retention, list Microsoft as a sub-processor in the privacy notice, document the transfer impact assessment, disable Application Insights anonymous IP collection or enable IP masking, and integrate every non strictly necessary cookie into the Consent Management Platform.