For years the answer to “where does our source code actually live?” came with an uncomfortable footnote. On GitHub. In the cloud. Somewhere outside the building. For most teams that was fine. For any organisation dealing with sensitive code, critical services, or modern sovereignty requirements, that footnote was no longer a detail. It was the reason modern DevOps stayed mostly out of reach.

Microsoft just removed the footnote.

At Build, Microsoft announced the public preview of GitHub Enterprise Local, which brings the GitHub Enterprise developer platform into sovereign and private cloud environments running on Azure Local. Repos, build pipelines, and development artifacts stay entirely within your own operational boundary. No round trip to a public region. No external dependency you have to explain to a regulator.

What it actually is

GitHub Enterprise Local is GitHub Enterprise Server (GHES) delivered as a prebuilt virtual machine image that runs on Azure Local. It sits inside your own security and network perimeter. Source code, metadata, CI/CD workflows, all of it stays on infrastructure you own and control.

The important part is the second word. Local. This is not a managed GitHub tenant with a private link bolted on. It is the GitHub experience developers already know, hosted on hardware in your own datacentre.

It runs in two modes. Connected, where the Azure control plane still lives in a cloud region and your GHES instance runs on Azure Local underneath it. And disconnected, where the control plane itself runs as an appliance VM on your own hardware, with no external connectivity at all. The second mode is the one that matters for air-gapped environments, and it is the one regulated industries have been asking for.

It builds on Azure Local disconnected

This is not a standalone product. It is another block in Microsoft’s Sovereign Private Cloud vision, and it sits on top of Azure Local disconnected operations.

We wrote recently about sovereignty moving from a policy slide to a platform decision. GitHub Enterprise Local is exactly that shift in practice. Data residency was always table stakes. The harder requirement is operational control. Who can administer the environment, where the build artifacts live, whether the platform keeps working when the link to the public cloud is cut. A self-hosted developer platform that never phones home answers all three directly.

CI/CD comes along too. GitHub Actions run on self-hosted runners inside the perimeter. And AI assistance does not get left at the door either, because Foundry Local provides an on-premises inference layer. Your developers keep modern tooling without a single token leaving the boundary.

What the preview does not solve yet

The foundation it sits on, Azure Local disconnected operations, is itself young. Disconnected mode landed earlier this year and there are real edges. Some services that work fine in connected Azure Local still carry caveats in fully air-gapped mode. Capacity limits exist. And running Azure Local disconnected has, until recently, required a documented business case and sign-off from Microsoft rather than a download button.

None of that is a reason to wait. It is a reason to scope properly. The organisations that get value out of previews are the ones that run a contained pilot, validate the parts that matter to them, and feed the gaps back. Not the ones who assume the launch slide is the shipping product.

Before you provision anything

If you are in a regulated sector and this is on your radar, a few questions are worth resolving before anyone provisions anything.

Do you actually need a full air gap, or is a connected sovereign deployment enough for your compliance posture? The two modes carry very different operational overhead.

How will you handle updates? Disconnected environments swap automatic cloud patching for a deliberate, signed-package import process. That is a workflow your operations team owns, not something that happens quietly in the background.

What does your runner and build estate look like inside the perimeter? Self-hosted Actions runners need capacity, isolation, and a patching story of their own.

And where does identity live? Azure Local disconnected operations currently expects a locally reachable identity provider and directory service, while GHES has its own enterprise identity integration. Identity therefore needs to remain operational inside the isolated environment rather than becoming an accidental dependency on services outside it.

Where we land

For a long time, sovereignty and modern DevOps pulled in opposite directions. You could have a clean GitHub-based delivery pipeline, or you could keep everything inside the building, but not both without a lot of compromise.

GitHub Enterprise Local closes that gap on paper, and the direction of travel is clearly right. The trade-off between innovation speed and regulatory control is the exact thing it is built to remove.

Just remember it is a preview sitting on a young foundation. Worth piloting, worth scoping carefully, not yet worth betting your production delivery pipeline on without a plan.

If you want to work out whether sovereign DevOps on Azure Local fits your environment, and which mode actually matches your compliance requirements, that is the kind of thing we assess. Get in touch and we will walk through it.