A German company is implementing a cloud-based Dynamics 365 system. The company needs to determine the best data storage solution for the following…

For a German company prioritizing EU data residency under Dynamics 365, certain services inherently involve potential data transfers that require legal review. Even when the primary data center is in the EU, global operational models can lead to data access from the United States.

1. Lifecycle Services (LCS): LCS is a global Azure-based service used to manage Dynamics 365 Finance and Operations environments. Its infrastructure and operational teams may be located in the US, potentially processing project metadata and diagnostic data outside the EU.

2. Technical support: Microsoft provides global, 24/7 technical support. A support engineer located in the US may need to access customer data residing in the EU to diagnose and resolve an issue.

3. Usage data: Microsoft collects telemetry and diagnostic data to maintain and improve service performance and reliability. This data is often processed in centralized systems, which may include facilities in the US.

D. Power BI dashboard: The residency of Power BI data is determined by the tenant's home region. If the tenant is configured for the EU, the datasets and reports will be stored in EU data centers.

E. Data center failover: Standard disaster recovery for Dynamics 365 ensures business continuity by failing over to a secondary data center within the same geographic region (e.g., from one EU data center to another).

1. Microsoft Trust Center, "Data Residency in Azure": "For a small number of services, a customer's use of the service may require the transfer of customer data outside the selected geo... For example... to provide customer support, troubleshoot the service, or apply security patches." This statement supports the need to review technical support (B) and usage data (C) for potential transfers.

Source: Microsoft Trust Center, Data Management section, "Data residency in Azure".

2. Microsoft, "The EU Data Boundary for the Microsoft Cloud—A Progress Report" (Dec 15, 2022): "We are also engineering solutions to allow our customers to diagnose their own issues without the need for Microsoft personnel to access customer data... In the rare cases where Microsoft does need to access customer data, we are building new capabilities to ensure that access is provided by an EU-based team." This acknowledges that currently, non-EU teams (including US-based) may access data for support (B). It also discusses pseudonymized telemetry (usage data, C) being transferred.

Source: Microsoft EU Policy Blog, "The EU Data Boundary for the Microsoft Cloud—A Progress Report".

3. Microsoft Products and Services Data Protection Addendum (DPA), Attachment 3 – Standard Contractual Clauses: The inclusion of SCCs as a data transfer mechanism in Microsoft's legal terms confirms that data transfers outside the primary region are a possibility for legitimate business operations, such as providing the services. This underpins the potential for transfers related to global services like LCS (A) and Support (B).

Source: Microsoft Licensing Documents, "Microsoft Products and Services Data Protection Addendum (DPA)".

4. Microsoft Learn, "Lifecycle Services (LCS) for Finance and Operations apps": Describes LCS as the cloud-based collaborative workspace that customers and their partners use to manage Finance and Operations apps projects. As a global management portal, its operational data may not be strictly bound to the customer's production data geo.

Source: Microsoft Learn, Dynamics 365 Documentation, "Lifecycle Services (LCS) for Finance and Operations apps".