The interesting thing is, that in Germany Microsoft and Deutsche Telekom used to have a set up, where you could buy O365 hosted by Telekom, without Microsoft (as a US company) having access to the data if they are asked for it, via the Cloud Act.

But as they had many integration problems, they stopped offering this service in 2018[1] (German).

I think looking at GDPR and Schrems2 requirements, this would have been a viable model.

[1]: https://www.heise.de/newsticker/meldung/Auslaufmodell-Micros...