By David,
The honest sentence first, as always: Atlas Ink runs on commercial Azure today. Azure Government and GCC High are not yet validated - that work is on the roadmap, and until it ships the product deliberately fails closed rather than run in a sovereign cloud it hasn't proven. If a vendor tells you their signature product "supports Azure Government," your first question should be what, specifically, is hosted where - and this article is partly a guide to asking it.
Why sovereign tenants can't just buy the commercial market
Azure Government and GCC High exist to keep regulated workloads - CUI, ITAR-adjacent data, state and local sensitive systems - inside an environment with US-persons operations and government-specific compliance envelopes. The commercial signature market, meanwhile, is built on two patterns that both break the moment your tenant is sovereign:
- In-transit stamping routes outbound mail through the vendor's service - which runs in commercial cloud. For a sovereign tenant that's not a compliance nuance; it's mail leaving the environment to be processed.
- Directory sync copies user attributes into the vendor's commercial-cloud database to render templates - an export of exactly the data your boundary documentation says stays put.
Some vendors offer government-oriented editions, and those deserve genuine evaluation - against precise questions: which cloud hosts the processing, where does directory data rest, what does the mail path look like end to end, and is the government edition the same product or a trailing fork? The GCC High deep-dive carries a fuller version of that evaluation sheet.
The architecture that fits - and why we built for it
Work the constraint backwards and the sovereign-compatible shape is forced: signatures applied at the mailbox (no mail transits anything new), directory read in place, read-only (nothing rests outside), and the platform itself deployed into the customer's own subscription (no vendor environment to locate in any cloud). Notice what that shape is: it's the same customer-owned, push-never-intercept architecture that Atlas Ink runs everywhere by default. (Its one opt-in exception, server-side stamping through a mail-flow rule in the customer's own Exchange Online, is commercial-cloud only and isn't offered in GCC or GCC High.) Sovereign fit isn't a government edition we'd bolt on - it's the design the commercial product already has.
That's precisely why the remaining work is validation rather than re-architecture: proving the deployment, Graph, Exchange, and billing/metering paths endpoint by endpoint in the government environments, rather than assuming commercial behavior carries over. The sovereign endpoint routing exists in code today and is not yet validated - so the product refuses to run there, which is the failure mode you'd want from anything near a regulated boundary.
Three plain statements about where this stands
- Today: commercial Azure and commercial Microsoft 365 only. Deployed into your own Azure subscription, metered at $1 per active user, per month, always - all of it commercial-cloud machinery.
- Roadmap: Azure Government / GCC High validation. Planned, real, and not dated in public. If your program needs signatures inside a sovereign tenant this quarter, evaluate the incumbents' government editions against the questions above rather than waiting on us - honest advice beats a pipeline.
- Pricing there will match commercial. Because billing runs through Stripe, government-cloud deployments will be metered the same way commercial is - $1 per active user, per month - when validation ships.
If that roadmap matches yours, register interest on the Atlas Ink page and we'll keep you posted as validation progresses.
What sovereign-adjacent agencies can do today
A large share of "Azure Government" interest actually comes from organizations in commercial GCC or evaluating a future move. If that's you, everything about managed signatures applies now: deploy in your own subscription, hydrate signatures from Entra ID, scope tenant → group → user, enforce drift daily, keep the mail path exactly as Microsoft ships it - and if unremovable marking language is required on every message, run it as an Exchange transport-rule disclaimer alongside the pushed layer. The government buyer's guide and the government industry page cover the wider picture, procurement included.
And whichever vendor you evaluate for the sovereign future, keep the fail-mode question on the sheet: what does your product do when pointed at a cloud it hasn't validated? "It refuses to run" is the answer of an engineering culture you can put near CUI. It's the answer we chose before this article needed writing.