Microsoft has done the leg work for this already. They currently have a completely contained Azure environment in Germany. I think it was deployed to ensure compliance with german/EU health data protocols.
I have first hand experience of this, migrating between their global PaaS and the contained German one. The bulkheads are quite air-tight (much to my personal detriment).
