Azure -> European cloud

Migrating from Azure to a European cloud

Leaving Azure for a sovereign European cloud is usually a multi-provider move: compute and Kubernetes go to Scaleway, OVHcloud or STACKIT, but the two services that most often anchor an Azure estate (Cosmos DB and Azure AD B2C) have no EU-sovereign managed twin at all. The Azure-specific twist: Blob Storage is NOT S3-compatible, so SDK code is rewritten rather than repointed. This page names which Azure services move cleanly and which force a re-platform.

Which Azure services have a true EU equivalent?

Graded conservatively against the EU-sovereign option that exists in production today, across providers.

Azure services and their EU-sovereign equivalents, each with a migration verdict.
AzureEU-sovereignVerdict
Azure Blob StorageScaleway / OVHcloud Object Storage S3-compatible on the EU side, but NOT Azure Blob-compatible: every SDK call, SAS-token flow and container operation is rewritten against the S3 API.Partial
Azure Managed DisksScaleway / OVHcloud Block Storage Network block volumes with snapshots. Direct equivalent.Equivalent
Azure Virtual MachinesScaleway / OVHcloud / Hetzner instances General-purpose and GPU instances are a solved problem across EU providers.Equivalent
Azure AKSScaleway Kapsule / OVHcloud MKS / STACKIT SKE CNCF-conformant managed control planes; portable manifests move with little friction.Equivalent
Azure Database for PostgreSQLScaleway / OVHcloud Managed PostgreSQL Managed PostgreSQL is well served; Azure SQL Hyperscale has no equivalent.Partial
Azure Cache for RedisScaleway / OVHcloud Managed Redis Managed Redis/Valkey; in-memory caching is well covered.Equivalent
Azure Service BusScaleway Messaging / OVHcloud Kafka Queue and pub-sub exist, but Service Bus topics, sessions and dead-letter semantics do not map one-to-one.Partial
Azure FunctionsScaleway Serverless Functions HTTP and cron are fine; Azure Functions' deep native event-source catalogue is not matched.Partial
Azure Cosmos DBNo managed twin (self-host ScyllaDB) No EU-sovereign managed globally-distributed NoSQL. Self-host ScyllaDB or Cassandra.No managed twin
Azure AD B2C / Entra IDNo managed twin (self-host Keycloak) No managed customer-identity service; CIAM moves to self-hosted Keycloak or an EU IdP.No managed twin
Azure Synapse / FabricNo managed twin (self-host ClickHouse) No EU-sovereign serverless warehouse. ClickHouse is fast but a different operating model.No managed twin

Where do the Azure APIs actually diverge?

The commodity layer repoints after a Blob->S3 rewrite. These are the Azure-specific services with no sovereign twin.

  • Azure Blob Storage is NOT S3-compatible: the Azure Storage SDK, SAS tokens and container semantics are all rewritten against S3, not repointed. This is Azure-specific overhead.
  • Cosmos DB has no EU-sovereign managed twin: its globally-distributed, multi-model NoSQL retargets to ScyllaDB (self-hosted), a different operating model.
  • Azure AD B2C / Entra ID has no managed European equivalent. Customer identity moves to self-hosted Keycloak or an EU-based IdP, a project in its own right.
  • Synapse and Fabric retarget to self-hosted ClickHouse; the convenience of serverless analytics is lost.

Which of your Azure services move cleanly?

21 capabilities

  • Object storage

    Hyperscaler Amazon S3 Azure Blob Storage Google Cloud Storage
    EU-sovereign path Scaleway Object StorageOVHcloud Object Storage
    Verdict Mature

    S3-compatible API. A drop-in target for most SDKs, backups and static assets.

  • Block storage

    Hyperscaler Amazon EBS Azure Managed Disks Persistent Disk / Hyperdisk
    EU-sovereign path Scaleway Block StorageOVHcloud Block Storage
    Verdict Mature

    Network block volumes with snapshots. Standard building block, well covered.

  • Virtual machines

    Hyperscaler Amazon EC2 Azure Virtual Machines Google Compute Engine
    EU-sovereign path Scaleway InstancesOVHcloud Public CloudHetzner Cloud
    Verdict Mature

    General-purpose and dedicated instances are a solved problem in the EU.

  • Managed Kubernetes

    Hyperscaler Amazon EKS Azure AKS Google Kubernetes Engine (GKE)
    EU-sovereign path Scaleway KapsuleOVHcloud Managed Kubernetes
    Verdict Mature

    CNCF-conformant managed control planes. Portable workloads move with little friction.

  • Container registry

    Hyperscaler Amazon ECR Azure Container Registry Google Artifact Registry
    EU-sovereign path Scaleway Container RegistryOVHcloud Managed Private RegistryHarbor (self-hosted)
    Verdict Mature

    OCI registries are commodity. Self-hosted Harbor is a fully sovereign fallback.

  • Managed PostgreSQL

    Hyperscaler Amazon RDS / Aurora Azure Database for PostgreSQL Cloud SQL / AlloyDB for PostgreSQL
    EU-sovereign path Scaleway Managed DatabaseOVHcloud Managed DatabasesAiven for PostgreSQL
    Verdict Viable

    Standard PostgreSQL is well served. Aurora-specific features (e.g. global database, serverless v2 autoscaling) have no exact twin, so plan around them.

  • Managed cache (Redis/Valkey)

    Hyperscaler Amazon ElastiCache Azure Cache for Redis Memorystore for Redis
    EU-sovereign path Scaleway Managed Database for RedisAiven for Valkey/Redis
    Verdict Viable

    In-memory caching is well covered; Valkey is the emerging open successor to Redis.

  • Message queue / pub-sub

    Hyperscaler Amazon SQS / SNS Azure Service Bus Google Cloud Pub/Sub
    EU-sovereign path Scaleway Messaging & QueuingSelf-hosted NATS / RabbitMQ
    Verdict Viable

    Scaleway offers SQS/SNS-compatible endpoints; self-hosted NATS covers the rest.

  • Event streaming (Kafka)

    Hyperscaler Amazon MSK / Kinesis Azure Event Hubs Managed Service for Apache Kafka
    EU-sovereign path Aiven for Apache KafkaSelf-hosted Kafka / Redpanda
    Verdict Viable

    Aiven runs managed Kafka in EU regions. Kinesis's exact API is not replicated, so target Kafka.

  • Authoritative DNS

    Hyperscaler Amazon Route 53 Azure DNS Google Cloud DNS
    EU-sovereign path Scaleway Domains & DNSOVHcloud DNSBunny DNS
    Verdict Viable

    Managed authoritative DNS is well covered. Route 53's routing policies need a manual rebuild.

  • Transactional email

    Hyperscaler Amazon SES Azure Communication Services No first-party service (SendGrid via Marketplace)
    EU-sovereign path Scaleway Transactional EmailBrevo (FR)
    Verdict Viable

    Scaleway TEM and Brevo (French) cover sending, reputation and analytics from the EU.

  • Secrets & key management

    Hyperscaler AWS Secrets Manager / KMS Azure Key Vault Secret Manager / Cloud KMS
    EU-sovereign path Scaleway Secret ManagerHashiCorp Vault (self-hosted)
    Verdict Viable

    Managed secret storage exists; self-hosted Vault gives full control including HSM-backed keys.

  • Application platform (PaaS)

    Hyperscaler AWS App Runner / Elastic Beanstalk Azure App Service Google App Engine
    EU-sovereign path Clever Cloud (FR)Scalingo (FR)
    Verdict Viable

    Clever Cloud is a production-proven French PaaS (Nantes): git-push or container deploys, autoscaling and managed add-ons (PostgreSQL, Redis, and more). A sovereign home for web apps, though narrower than App Engine’s wider service ecosystem.

  • Serverless containers

    Hyperscaler AWS Fargate Azure Container Instances Google Cloud Run
    EU-sovereign path Scaleway Serverless Containers
    Verdict Viable

    Scale-to-zero container hosting exists and is production-ready for request-driven workloads.

  • Customer identity (CIAM)

    Hyperscaler Amazon Cognito Azure AD B2C Google Cloud Identity Platform
    EU-sovereign path Keycloak (self-hosted)ZitadelOry
    Verdict Viable

    No managed Cognito clone, but self-hosted Keycloak and EU-based Zitadel are mature and widely run.

  • Serverless functions (FaaS)

    Hyperscaler AWS Lambda Azure Functions Cloud Run functions (Cloud Functions)
    EU-sovereign path Scaleway Serverless FunctionsOVHcloud Functions
    Verdict Partial

    The runtimes exist, but Lambda's breadth of native event sources and mature cold-start tuning is not matched. Fine for HTTP and cron; harder for deep event-driven fan-out.

  • Global CDN & edge compute

    Hyperscaler Amazon CloudFront / Lambda@Edge Azure Front Door Cloud CDN / Media CDN
    EU-sovereign path Bunny.netGcoreOVHcloud CDN
    Verdict Partial

    EU-headquartered CDNs deliver content well globally. Edge-compute primitives (equiv. to Lambda@Edge/CloudFront Functions) are thinner and less mature.

  • Metrics, logs & traces

    Hyperscaler Amazon CloudWatch / X-Ray Azure Monitor Cloud Monitoring / Logging / Trace
    EU-sovereign path Self-hosted Grafana / Prometheus / Loki / Tempo
    Verdict Partial

    The open-source LGTM stack matches the managed incumbents feature for feature, but you run it yourself. A fully managed, EU-sovereign one-stop observability suite is thin on the ground.

  • Managed ML platform

    Hyperscaler Amazon SageMaker Azure Machine Learning Vertex AI
    EU-sovereign path OVHcloud AI Endpoints / AI TrainingScaleway GPU Instances + Managed Inference
    Verdict Gap

    GPU compute, training and inference endpoints exist, but nothing matches SageMaker's end-to-end breadth (pipelines, feature store, model registry, tuning) as one managed platform. You assemble it.

  • Cloud data warehouse

    Hyperscaler Amazon Redshift Azure Synapse Google BigQuery
    EU-sovereign path ClickHouse (self-hosted)Aiven for ClickHouse
    Verdict Gap

    There is no EU-sovereign, fully managed columnar warehouse with the convenience of Redshift or BigQuery. ClickHouse (self-hosted or via Aiven) is excellent and fast, but it is a different operating model, not a drop-in.

  • Serverless wide-column NoSQL

    Hyperscaler Amazon DynamoDB Azure Cosmos DB Cloud Bigtable / Firestore
    EU-sovereign path ScyllaDB (self-hosted)Self-hosted CassandraFerretDB / MongoDB-compatible
    Verdict Gap

    DynamoDB's serverless billing and single-digit-ms scale have no EU-sovereign managed equivalent. ScyllaDB/Cassandra deliver the performance, but you run the cluster and lose the pay-per-request model.

Verdicts are conservative and reflect managed, EU-jurisdiction offerings as of 2026. Provider feature sets move quickly, so we re-check on every engagement.

How many engineer-days does this take?

50-120 engineer-days

Higher than a like-for-like AWS->EU move, because two Azure-specific rewrites (Blob->S3 and the identity layer) are almost always on the critical path.

  • A mid-sized Azure estate: AKS, Blob storage, Azure Database for PostgreSQL, Key Vault and an AD B2C identity tier.
  • The low end assumes AKS-, PostgreSQL- and disk-shaped workloads that map to EU managed services.
  • The high end assumes a heavy Blob-SDK footprint to rewrite plus an Azure AD B2C tier to rebuild on Keycloak.
  • Excludes application rewrites, egress from Azure and the integration overhead of a multi-provider target.

Where would this actually run?

A sovereign target is usually spread across EU providers' regions. Pick the mix that matches your data-residency and latency needs.

  • FranceScaleway Paris; OVHcloud Gravelines and Strasbourg.
  • GermanyOVHcloud Frankfurt; STACKIT (Heilbronn); Hetzner Falkenstein/Nuremberg.
  • NetherlandsScaleway Amsterdam.
  • PolandScaleway and OVHcloud Warsaw.
  • FinlandHetzner Helsinki.

What are the honest limitations?

  • Blob->S3 is a rewrite, not a repoint Unlike AWS S3 exits, leaving Azure means rewriting every Blob SDK call against the S3 API. This is Azure-specific migration tax.
  • Cosmos DB and Azure AD B2C have no sovereign twin The two services most likely to anchor an Azure estate are exactly the hardest to leave: Cosmos becomes self-hosted ScyllaDB, and identity becomes Keycloak.
  • A multi-provider target You typically trade Azure's single control plane for several (compute on one provider, identity self-hosted, analytics on another) and own the integration.

What else does a CTO ask before committing?

What is the hardest part of leaving Azure specifically?
Blob->S3 and identity. Blob Storage is NOT S3-compatible, so SDK code is rewritten. Azure AD B2C has no managed EU twin, so identity is rebuilt on Keycloak. Scope those two first.
Do we have to pick a single European provider?
Rarely. The pragmatic target is multi-provider: compute and Kubernetes on Scaleway or OVHcloud, a self-hosted ClickHouse for analytics, and a Keycloak instance for identity.
Is STACKIT the natural Azure exit for German mandates?
Yes. STACKIT (Schwarz Group) is German-operated with BSI C5 attestation and no US parent. See the dedicated Azure-to-STACKIT page for the concrete mapping.