Microsoft Azure: cloud infrastructure, financial workloads and operating controls

Azure is a broad infrastructure supplier. A financial institution can use it to host applications, process data and apply governance controls, with Microsoft and partner services supporting the deployment. The industry architecture connects cloud infrastructure, policy controls, data and business applications. Purchasing Azure does not supply a brokerage operating licence, execution relationship or ready-made trading business.[1]

ExpressRoute connects an organisation’s premises to Microsoft’s cloud through a connectivity provider. It uses BGP routing and redundant edge connections. Local, Standard and Premium options have different geographic reach: Local covers nearby designated regions, Standard a geopolitical area, and Premium wider global reach subject to national-cloud boundaries. A private circuit is an infrastructure connection; broker-server placement, venue access and execution latency still depend on the complete route and application.[5]

Azure’s public prices are inputs to a workload budget. Under the Microsoft Customer Agreement and Microsoft Partner Agreement, first-party Azure prices are based in US dollars and converted for supported local-currency billing; Enterprise Agreement prices can be in local currency. The retail-price API returns estimates and is not a substitute for the account’s invoice or negotiated price sheet. The purchasing channel also matters: customers can buy directly or through a Cloud Solution Provider.[12]

For scale, 10,000 GB of Zone 1 metered ExpressRoute outbound traffic at US$0.025/GB produces US$250 of that traffic charge. This calculation excludes the port, gateway, carrier, tax and currency components. Circuit billing starts when the service key is issued; stopping it requires the deletion request and the provider’s deprovisioning, so commercial exposure can start before an application goes live.[7]

Cost Management budgets are alerts, not spending limits: reaching a threshold does not stop resources. Cost data typically arrives eight to 24 hours later and budgets are evaluated daily. That delay matters for an unexpectedly large analytics query, continuous compute or an AI workload; a budget email cannot serve as the application’s real-time consumption control.[11]

Azure’s landing-zone guidance starts with the tenant and billing structure, identity, subscription organisation and connectivity. Security, management, governance and deployment automation follow from those decisions. For a broker, separating production, testing and shared services also makes access ownership and cost attribution easier to establish. These are deployment design decisions, not evidence that a particular application is already approved or resilient.[13]

Reservations can reduce predictable resource costs, but they are not a deployment procedure. Their discount is applied to usage that matches the reservation’s attributes and scope. Capacity planning, workload tests and a recovery design remain separate activities; purchasing a commitment before the live resource pattern is established can leave paid coverage poorly matched to actual consumption.[9]

Standard and Professional Direct provide 24/7 technical support. These are initial-response targets, not repair deadlines. The monthly plans renew automatically, and cancellation does not produce a prorated refund for the remaining month. Support must be budgeted alongside infrastructure rather than inferred from a VM’s hourly price.[15]

The October 2026 SLA assigns a 99.99% connectivity threshold to the eligible configuration of two or more VMs across two or more availability zones in one region. The credit tiers are 10% below 99.99%, 25% below 99%, and 100% below 95%, subject to its definitions and exclusions. This does not measure the availability of an entire trading application. Azure claims must reach Microsoft within 60 days of the incident with affected-resource, timing and error evidence. Credits are limited to eligible affected service fees; the SLA excludes compensation for trading losses, revenue loss and operational costs.[17]

Azure’s shared-responsibility guidance allocates physical infrastructure to Microsoft while leaving customer information, identity and access decisions with the customer. The balance of operating-system and network tasks changes between IaaS and managed services. These infrastructure controls do not transfer a financial firm’s responsibility for its own services, records or customer permissions to Microsoft.[14]

Azure role-based access control assigns a set of actions to a user, group, application or managed identity at a defined scope. A subscription-wide assignment can reach much farther than one limited to a resource. Permissions are additive: a narrow Reader assignment does not cancel a broader Contributor assignment received elsewhere, including through groups. Role definitions and assignments are replicated globally, so their location treatment differs from that of a regional application dataset.[26]

The May 2026 Data Protection Addendum states that the customer retains ownership of Customer Data. Its default online-service exit provision allows 90 days in a limited-function account to extract remaining data, followed by deletion within a further 90 days, subject to stated exceptions and authorised retention. Free trials, LinkedIn and previews require separate treatment. Its EU Data Act switching provisions cover customers billed in the EEA, excluding services for which they elected storage outside the EEA. They allow switching and export with 60 days’ termination notice; outstanding fees remain payable and extraction can take more than 30 days.[18]

For Foundry models sold by Azure, Microsoft says prompts, completions and training data are not supplied to the model provider or used to train foundation models without permission or instruction. This is narrower than a promise that no data is stored: optional stateful features persist content. Global deployments can process prompts across supported geographies, while DataZone confines processing to the specified zone, such as the US or EU. At-rest location alone therefore does not describe the full processing path.[19]

Azure belongs to Microsoft’s broader technology business. In its 29 July 2026 results release for the year ended 30 June, Microsoft said Azure annual revenue had exceeded US$100 billion. That company-reported measure establishes scale; it does not establish market share among FX brokers or the suitability of a particular architecture. Regional contracting and billing arrangements should be taken from the actual purchasing agreement.[21]

A documented capital-markets example is Microsoft’s July 2022 account of ABN AMRO running the Murex MX.3 trading, treasury and risk platform on Azure. The article describes application-version compatibility and implementation partners, illustrating that a major financial application can use cloud infrastructure while keeping its own software and integration requirements. This is a dated deployment example, not a newly verified account of ABN AMRO’s October 2026 estate.[22]

Operator

Microsoft Corporation group; contracting and billing entity depend on the agreement and market

Service scope

Cloud compute, private connectivity, streaming, analytics and AI infrastructure for financial applications.

Customer types

Financial institutions; Brokers and trading firms; Financial software providers; Enterprise technology teams

Delivery

Hosted; API; Hybrid

Pricing publication

Public and quoted pricing

Headquarters

Microsoft: Redmond, Washington, United States

Platforms

Azure Virtual Machines; Azure Event Hubs; Azure Data Explorer; Microsoft Foundry

Integrations

ExpressRoute; Apache Kafka protocol; AMQP 1.0; REST APIs

Pricing scope

Metered resource charges, optional commitments and support; negotiated agreements and carrier or partner costs can alter the total.

Implementation

Customer or partner designs the tenant, network, identities, workloads and recovery arrangements.

Support

Basic billing support and separately priced technical-support plans; response targets depend on severity and plan.

Permissions and regulatory scope

Technology infrastructure: the customer retains responsibility for its financial activities, application controls and regulated data.

Provider metadata checked 21 Oct 2026Source 21Source 12Source 23Source 1Source 5Source 13Source 15Source 14Source 4Source 3Source 7Source 2Source 19

Azure Monitor’s Activity log records management actions such as creating a VM or changing an access policy. Its default retention is 90 days, after which entries are deleted; diagnostic settings can export them for longer retention. Resource logs for actions inside a service, such as reading a secret or querying a database, require separate configuration and are not collected by default. A resource-administration log therefore does not establish a complete trading or customer-access audit trail.[25]

Microsoft’s cancellation help article describes data-retention periods of 30–90 days, while the current DPA sets out the more specific default and exceptions described above. These statements should not be collapsed into one universal recovery window. Export customer records, configuration and the application’s own data before terminating the relevant services; the applicable contract and service rules determine what remains retrievable.[20][18]