A recent investigation into Microsoft's provision of cloud services to an Israeli military surveillance agency has highlighted how it's a challenging time to work for the company's cloud department.

While all of the major US hyperscalers have reportedly been providing cloud services to the Israeli military, the ethical line seems to be getting increasingly less blurry.

It is generally demanded of cloud providers that customers should have privacy regarding their data and - to an extent - how they are using the services. This is something touted by the hyperscalers themselves, offering varying levels of security and isolation within their cloud offerings to meet this as necessary. It is what enables private and highly regulated organizations, including the military, to turn to cloud providers.

But within this raises the question of what to do if the technology is not being used for good, but for evil. Should companies intervene?

Microsoft was previously the primary cloud provider for Israel, but in 2021, Israel's Project Nimbus contract was awarded to Google and Amazon Web Services (AWS) for $1.2 billion.

All three US hyperscalers have reportedly provided computing and storage to Israel's government, but Microsoft is currently in the hot seat in light of the latest reports that the company's cloud platform is being used by Israel's Unit 8200 - its military surveillance agency - to store vast amounts of intelligence data on Palestinians in the West Bank and Gaza on Microsoft Azure, gathered from citizens' phone calls.

Providing cloud computing technology to Israel has become increasingly ethically murky in the midst of the ongoing war. This conflict escalated on October 7, 2023, with an attack by Hamas on Israel, which saw 1,195 Israeli civilians killed and 251 people taken hostage.

The following conflict - which Gaza’s Health Ministry this week reported has led to the deaths of more than 61,000 Palestinians, half of whom are thought to be women and children - has resulted in respected organizations, including Amnesty International and the United States Special Committee, declaring that Israel's military actions in Gaza are consistent with the characteristics of genocide.

Conversations about the situation have become heavily politically complicated, but the unprecedented number of deaths of civilians is a well-reported fact.

In May 2025, Microsoft released a statement stating that it had conducted an internal review looking at its work with Israel's military and engaged with an external firm for additional fact-finding. "Based on these reviews, including interviewing dozens of employees and assessing documents, we have found no evidence to date that Microsoft’s Azure and AI technologies have been used to target or harm people in the conflict in Gaza."

Microsoft acknowledged that it provides the Israel Ministry of Defense with "software, professional services, Azure cloud services, and Azure AI services, including language translation," as well as working with the Israeli government to protect its "national cyberspace against external threats."

Despite this, a recent investigation, citing sources at Israel's Unit 8200 and Microsoft itself, as well as documents, found that the platform had facilitated Unit 8200 and the Israeli military in the preparation of deadly airstrikes - including the identification of bombing targets - and "shaped" military operations in Gaza and the West Bank.

Additionally, Microsoft engineers reportedly developed enhanced layers of security for the servers to be used by Unit 8200.

Regarding the reports, a spokesperson from Microsoft said: "Our engagement with Unit 8200 has been based on enhancing cybersecurity and protecting against potential cyber threats. At no point during this engagement has Microsoft been aware of, or involved in, any surveillance of civilians using Microsoft’s services, including through the external review we commissioned.”

A second statement added: "As we’ve demonstrated, Microsoft takes these allegations seriously, as shown by our previous independent investigation. As we receive new information, we’re committed to making sure we have a chance to validate any new data and take any needed action.”

Protests have since been held at a Microsoft data center in the Netherlands - one of the countries where this data is allegedly hosted - but it is not the first time such criticism has been leveled at the company.

In February 2025, five Microsoft employees were removed from a meeting with CEO Satya Nadella for protesting against the company's contracts with the Israeli military. The company previously fired two employees in October 2024 for holding a vigil for Palestinian refugees at the company's headquarters.

On July 24, Microsoft shared a letter from Investor Advocates for Social Justice in its SEC filings that detailed the July 1 letter from at least 60 Microsoft shareholders, collectively representing more than $80 million in MSFT shares, which called on Microsoft to "publish a report assessing the effectiveness of its human rights due diligence processes. Specifically, it requests that Microsoft evaluate whether its AI and cloud technologies are being misused by customers, such as military entities, to commit human rights abuses or violations of international humanitarian law."

This was, according to the filing, directly "on the heels of a recent Microsoft blog post, in which Microsoft attempted to absolve itself of any complicity in international crimes in Gaza, while admitting it does not have visibility into how customers use our software on their own servers or other devices.

"This admission is deeply concerning for shareholders, as it underscores a lack of oversight and due diligence that could expose Microsoft to serious material risks. Without a robust human rights due diligence process, the company is failing to meet investor expectations for responsible business conduct, which may negatively impact long-term shareholder value," the filing added.

It is worth noting that, while Microsoft's AI standard does not explicitly say the company will not engage in military, weapons, or surveillance systems, it does state that it is committed to a "responsible approach to AI" while respecting human rights.

Microsoft is now set to conduct another internal investigation into the latest allegations, raising the question of how much visibility cloud providers should have over workloads, if it means the possible prevention of platforms from being used for harm.

This, I think, is the sticking point. While the recent investigation certainly suggests that some within the company were aware of how Unit 8200 was allegedly using Microsoft Azure, Microsoft has maintained that it does not have visibility into this.

The reality is that privacy is a key tenet of the cloud-customer relationship, and this is unlikely to change. As long as cloud providers aim to attract customers from highly secure sectors, such as governments and military departments, they will never be able to negotiate that level of access. It would give private companies an unprecedented level of power and control.

Given the lack of insight into their operations, we are stuck waiting to see what the outcome of the internal investigation is.

Should Microsoft find that its technology has indeed been used to directly target and harm Palestinians, how should it proceed? And, more to the point, if the outcome finds that Microsoft employees had access and insight into this, what are the ramifications of this for data privacy?

Sadly, I expect that any repercussions from this will be limited, beyond a bit of bad PR.

Humanitarian agency UNICEF is currently conducting a charity drive to provide critical medical aid to children in the region. Donate today.