Azure Local (azure-local)
This page describes the Landing Zone catalogue azure-local as shipped with SWAO: the provider and its sovereignty model, the regions with their residency and certifications, how the catalogue is refreshed and how to use it as a target.
Provider and sovereignty model
Azure Local (formerly Azure Stack HCI) runs Azure services on hardware at the customer's own site and is managed through Azure Arc. The catalogue models its two deployment modes as regions, because they differ in available services and sovereignty facts: connected, where the management plane runs in Microsoft's cloud, and disconnected, for sites that operate without that connection.
Sovereignty model: workload data stays at the customer site, so the residency country is recorded as OPERATOR_SITE and the regions belong to no geography; name the region explicitly, for example azure-local:connected. The connected mode records US CLOUD Act and FISA Section 702 exposure, reflecting its connection to Microsoft's cloud; the disconnected mode records none. No certifications are recorded for Azure Local itself.
Summary
| Property | Value |
|---|---|
| Provider ID (for targets) | azure-local |
| Catalogue name | Azure Local service catalogue |
| Regions | 2 |
| Distinct services | 17 |
| Operator jurisdiction | Operator site, run by the customer (operator-site) |
| Extraterritorial exposure | connected: US CLOUD Act (us_cloud_act), FISA Section 702 (fisa_702); disconnected: none recorded |
| Certifications recorded | none recorded |
| Refresh mode | Curated by hand from the provider's public documentation; refreshed with SWAO releases, not by swao lz catalogue update |
| Confidence | medium |
| Last updated | 2026-08-11 |
| Schema version | 0.1 |
Default region for Europe | none (no region has a residency country in this geography) |
Default region for Germany | none (no region has a residency country in this geography) |
| Catalogue file in the public repository | lz-catalogues/azure-local.json |
Regions
All 2 regions of the catalogue:
| Region ID | Name | Residency country | Operator jurisdiction | Extraterritorial exposure | Certifications | Services | Geographies |
|---|---|---|---|---|---|---|---|
connected | Customer site (Arc-connected) | Customer site (OPERATOR_SITE) | Operator site, run by the customer (operator-site) | US CLOUD Act, FISA Section 702 | none recorded | 16 | - |
disconnected | Customer site (disconnected operations) | Customer site (OPERATOR_SITE) | Operator site, run by the customer (operator-site) | none | none recorded | 6 | - |
Certifications
The catalogue records no certifications for any region. A framework that requires a certification (for example BSI C5) therefore reports a certification gap for every region of this provider.
Using this catalogue
Name a region of this catalogue as a target of the Landing Zone Catalog Assessment, on the command line or in the app .swao.yml:
swao lz catalogue show azure-local
swao assess --type landing-zone-catalog --app <app-id> --lz-cat-targets "azure-local:connected"assessment:
landing_zone:
targets:
- azure-local:connectedTo correct or extend the facts for one engagement, copy the catalogue into the workspace with swao lz catalogue copy azure-local and edit wsp/inputs/catalogs/lz-catalogues/azure-local/index.json; the workspace copy then takes precedence. See Adapting LZ catalogues.
Catalogue facts are point-in-time and are not legal advice. Check the date and confidence above and review the provider's contracts before you rely on a verdict.