Bulgarian Opposition Leader Raises National Security Concerns Over Microsoft Contract

Opposition Warns on Microsoft Contract for State Administration

Bozhidar Bozhanov, Deputy Floor Leader of the largest opposition group in the Bulgarian Parliament, Continue the Change - Democratic Bulgaria, has issued a warning regarding a proposed new contract with Microsoft for the state administration. Bozhanov, who also co-chairs Yes, Bulgaria, stated on January 17, 2026, that the agreement presents significant long-term risks to Bulgaria's national security and digital sovereignty. The warning follows a recent decision by the Council of Ministers authorizing the e-Government Minister to initiate a public procurement procedure for Microsoft products.

Concerns Over Cloud Integration and Data Control

Bozhanov's primary concerns center on the potential for the entire state administration to be managed within Microsoft's cloud infrastructure. He highlighted that Microsoft typically requires all user accounts to be placed in its cloud-based Active Directory (Azure AD/Entra). This, he argues, could lead to a situation where the Bulgarian state administration's digital operations are extensively reliant on a third-party's cloud environment.

Another critical point raised by Bozhanov pertains to data control. He noted that Microsoft has historically not offered governments full control over data encryption keys, which theoretically could allow Microsoft access to sensitive data. Bozhanov had previously voiced these concerns in 2022 during his tenure as electronic government minister, emphasizing that delegating such extensive control to an external company poses substantial risks to national security and sovereignty.

The Broader Context of Digital Sovereignty

The debate surrounding the Microsoft contract is set against a broader European discussion on digital sovereignty, which refers to a nation's autonomy over its crucial information and communication technology (ICT) infrastructure and its citizens' control over their data. Europe, including Bulgaria, exhibits a significant reliance on major American tech companies like Microsoft for public sector software. This reliance raises questions about the applicability of foreign legal frameworks, such as the U.S. CLOUD Act, which Microsoft has acknowledged can compel access to data held by American cloud providers, regardless of its physical location, potentially undermining European data sovereignty.

Microsoft's Efforts and Ongoing Dialogue

While raising these concerns, Bozhanov acknowledged that Microsoft has made strides in addressing digital sovereignty issues. He noted the introduction of additional encryption options for governments and, in 2025, support for hybrid environments utilizing state-owned infrastructure, which he described as a positive development. Microsoft has also announced initiatives to expand its digital sovereignty capabilities for Europe, including the EU Data Boundary, in-country processing for Microsoft 365 Copilot, and the establishment of a European board of directors to oversee datacenter operations under European law.

Despite these advancements, the Bulgarian opposition's warning underscores the ongoing challenge for nations to balance the benefits of advanced technological solutions with the imperative of maintaining national control and security over critical digital infrastructure and data.