Microsoft Copilot,
in country.

The off-the-shelf path. Set the tenant's preferredDataLocation to ZAF and Microsoft commits to storing mailbox content, OneDrive files, SharePoint sites, Teams chat, and Copilot prompt history at rest in the SA Geo. Disable Bing grounding, audit your plugins, and the Copilot button in Outlook is residency-defensible for most POPIA conversations. The LLM compute still runs in the Microsoft-managed global pool — that's the asterisk for SARB-strict workloads.

# Verify the tenant Geo
Connect-MgGraph -Scopes "Organization.Read.All"

Get-MgOrganization | Format-List DisplayName, `
    @{n="Geo";e={$_.AdditionalProperties.preferredDataLocation}}

# Expect: Geo : ZAF

The custom-agent path. Build a low-code agent in Copilot Studio, then point its generative answers and orchestration at an Azure OpenAI resource that you deployed in southafricanorth, in your subscription. That single configuration moves LLM inference into country — prompts, completions, tool-call traces, and conversation history all sit on infrastructure you control. The Power Platform environment must also be in the SA region; Dataverse follows the env.

# Provision Azure OpenAI in country
az cognitiveservices account create \
  --name aoai-imbila-sa \
  --resource-group rg-copilot-sa \
  --kind OpenAI --sku S0 \
  --location southafricanorth \
  --custom-domain aoai-imbila-sa

az cognitiveservices account deployment create \
  --resource-group rg-copilot-sa \
  --name aoai-imbila-sa \
  --deployment-name gpt-4o-za \
  --model-name gpt-4o \
  --model-version "2024-11-20" \
  --sku-name Standard --sku-capacity 50

The headless path. No Copilot UX layer at all — your own application calls Azure OpenAI directly. From a Cloudflare Worker in the JNB colo this is the lowest-latency option (~20 ms p50) and the simplest to audit. Use it when the workload doesn't need the Copilot UX (custom React app, customer-facing chatbot, document-processing pipeline) and you'd rather own the prompt loop end to end. → Full implementation patterns: streaming, throttle, OAuth, KV cache.

// src/aoai.ts — Worker → SA-North Azure OpenAI
const url = `${env.AZURE_OPENAI_ENDPOINT}/openai/deployments/${env.AZURE_OPENAI_DEPLOYMENT}/chat/completions?api-version=2025-01-01-preview`;

const res = await fetch(url, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'api-key': env.AZURE_OPENAI_KEY,
  },
  body: JSON.stringify({ messages, temperature: 0.3, max_tokens: 800 }),
});

// 429 = throttle. SA quota is tighter than US — handle it.
if (res.status === 429) throw new ThrottleError();