Need data to reside ion Brazil

Question

Need data to reside ion Brazil

Dennis Pedini 0

We need to have our data reside in Brazil.

Dear all, good morning.

We are informing the oil and natural gas operators responsible for transmitting BMP-Campo, BMP-UEP, and DAPE information that, due to the implementation of new security layers in our technology environment, access by foreign servers to the web service of the Espírito Santo State Department of Finance (SEFAZ-ES) has been restricted as of April 2026.

Therefore, in order to effectively transmit the files, it is necessary to use a national server, meaning hosting or infrastructure located in Brazil, to send the files to the web service.

We emphasize that operators who were unable to send the files for the 03/2026 reporting period by the deadline must submit them retroactively as soon as possible.

We remain available for any clarifications and support in regularizing the submission.

Sincerely,

Praveen Kumar Gudipudi 2,295 Reputation points Microsoft External Staff Moderator

2026-07-21T07:37:39.04+00:00

Hello Dennis Pedini,

Based on the information provided, the requirement appears to be that the transmission to the SEFAZ-ES web service must originate from infrastructure located in Brazil. The notice does not explicitly state that all application data must reside in Brazil; rather, it specifies that a Brazilian-hosted server must be used to submit the BMP-Campo, BMP-UEP, and DAPE files.

Since our solution is hosted on Microsoft Azure, we can address this requirement by deploying the integration component that submits the files to the Azure Brazil South region. This would ensure that outbound requests to the SEFAZ-ES web service originate from infrastructure located in Brazil while minimizing changes to the overall solution architecture.

If SEFAZ-ES intends this to be a broader data residency requirement (i.e., requiring all related data to be stored and processed in Brazil), we recommend obtaining written clarification from them before making any wider infrastructure changes.

Please let us know if you would like us to review the current architecture and propose the most appropriate Azure deployment approach to meet this requirement.
Praveen Kumar Gudipudi 2,295 Reputation points Microsoft External Staff Moderator

2026-08-02T16:15:21.3833333+00:00

Hello Dennis Pedini,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

2 answers

Your answer

Praveen Kumar Gudipudi 2,295 Reputation points Microsoft External Staff Moderator

2026-07-21T07:37:39.04+00:00

Hello Dennis Pedini,

Based on the information provided, the requirement appears to be that the transmission to the SEFAZ-ES web service must originate from infrastructure located in Brazil. The notice does not explicitly state that all application data must reside in Brazil; rather, it specifies that a Brazilian-hosted server must be used to submit the BMP-Campo, BMP-UEP, and DAPE files.

Since our solution is hosted on Microsoft Azure, we can address this requirement by deploying the integration component that submits the files to the Azure Brazil South region. This would ensure that outbound requests to the SEFAZ-ES web service originate from infrastructure located in Brazil while minimizing changes to the overall solution architecture.

If SEFAZ-ES intends this to be a broader data residency requirement (i.e., requiring all related data to be stored and processed in Brazil), we recommend obtaining written clarification from them before making any wider infrastructure changes.

Please let us know if you would like us to review the current architecture and propose the most appropriate Azure deployment approach to meet this requirement.
Praveen Kumar Gudipudi 2,295 Reputation points Microsoft External Staff Moderator

2026-08-02T16:15:21.3833333+00:00

Hello Dennis Pedini,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

kagiyama yutaka 5,410

I think Azure keeps data in the region u pick, and Azure Files stays in the region of its storage account. So when the storage account and the sending VM/Function are both in a Brazil region with LRS or ZRS, the data stays in Brazil and the outbound traffic comes from Brazil.

0 comments

Answer 2

Hi Dennis Pedini,

Welcome to Microsoft Q&A Platform

To keep your integration service and data entirely in Brazil (so SEFAZ-ES will accept your files), you’ll want to:

Deploy your compute in the Brazil South region

Any VM, App Service, Functions, AKS node pool, etc., you spin up in “Brazil South” will run from Brazilian datacenters and use Brazilian IPs.
If you need a static outbound IP for your web service calls, front your VNet with a NAT Gateway (or reserve a Public IP on your VM/App Service Environment) in Brazil South.

Use regional-only storage options

For Azure Storage accounts, pick LRS or ZRS replication so your blobs/files stay at rest within Brazil. Avoid GRS/RA-GRS because that geo-replicates to the paired region (which for Brazil South is outside Brazil).
If you need file shares (SMB/NFS), create them in the Brazil South storage account and mount them from your Brazil-deployed compute.

Keep any downstream databases or resources in the same region

Azure SQL Database active geo-replication can replicate outside Brazil, so don’t enable it unless it’s another Brazil South secondary.
Likewise, any cache, Key Vault, or supporting resource should live in Brazil South.

Confirm no hidden cross-region fallbacks

Some non-regional services (like Microsoft Entra ID) may store metadata outside your region—just be aware that identity tokens might traverse beyond Brazil, though your payloads (the files you’re sending) stay local.

Once everything is running in Brazil South with regional-only redundancy, your outbound calls to SEFAZ-ES will originate from a Brazilian IP and your data at rest will be confined to Brazil’s boundaries.

If the above steps did not help resolve your issue, please feel free to share the details in a private message so we can proceed with further troubleshooting over a Teams call. I am happy to connect with you on Teams to investigate and resolve the issue.

Reference:

Azure for secure worldwide public sector cloud adoption – Data residency

Data locations for Azure DevOps

Region availability for Oracle AI Database@Azure (shows Brazil South & Southeast regions)

Introduction to Azure Storage (replication options & regional considerations)

Pleaseand “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.