Why Microsoft Should Really Disclose Azure Numbers

No. We do not design tools to enable voluntary surveillance of our customers. If we ever provide third parties with access to data about our customers, we expect those third parties to handle that data appropriately, meaning that they should not assist governments in voluntary, widespread surveillance of customers. Instead, these third parties should ensure that they only disclose personal data about customers in compliance with applicable law or in response to valid legal orders.

Third-party publishers and developers of games and apps have their own distinct and independent relationship with users and their collection and usage of personal data is subject to their specific privacy policies. You should carefully review their policies to determine how they use the data. For example, publishers may choose to disclose or display game data (such as on leaderboards) through their own services. You may find their policies linked from game or app detail pages in the Microsoft Store.

Azure's growth rates still look robust, but Microsoft's refusal to divulge any additional numbers for the cloud platform is frustrating. Let's discuss three reasons Microsoft should finally pull back that curtain.

Bounds Check Bypass Store (BCBS) was disclosed on July 10, 2018, and assigned CVE-2018-3693. We consider BCBS to belong to the same class of vulnerabilities as Bounds Check Bypass (Variant 1). We aren't currently aware of any instances of BCBS in our software. However, we are continuing to research this vulnerability class and will work with industry partners to release mitigations as required. We encourage researchers to submit any relevant findings to the Microsoft Speculative Execution Side Channel bounty program, including any exploitable instances of BCBS. Software developers should review the developer guidance that's been updated for BCBS at C++ Developer Guidance for Speculative Execution Side Channels

Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users. As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders.

The GPTW analytical survey platform named Emprising is hosted by the cloud provider Microsoft Azure. GPTW contracts with Azure to maintain the highest level of Data Security and Data Privacy global compliance at all times. This legal protection is passed along to all GPTW clients though the warranties in the Products and Services Agreement for the entire term of our engagement as detailed below. The Azure audit reports and other resource documentation as well as the Azure Compliance Manager Tool used by GPTW to comply with the GDPR and other privacy laws are found at the following URLs: and other compliance offerings: -us/trustcenter/compliance/complianceofferings. A general article about Azure compliance is here: -about-gdpr-compliance-in-microsoft-cloud/ and a blog here: -us/blog/protecting-privacy-in-microsoft-azure-gdpr-azure-policy-updates/ There are some country specific compliance resources as well. For example, compliance in Germany is addressed at the following URL: 1e1e36bf2d