Microsoft’s latest Pentagon filing failed to reveal that engineers based in China help maintain sensitive Defense Department cloud systems, according to a Feb. 28 System Security Plan obtained by investigative outlet ProPublica. The 125-page document notes that non-screened personnel receive “escorted access,” but omits that these workers include foreign nationals—contradicting Microsoft’s public assurances that its arrangement was fully disclosed. The so-called “digital escort” model pairs overseas engineers with U.S. contractors who hold security clearances, a practice former Defense officials say raises espionage risks because Chinese law obliges companies and citizens to cooperate with state intelligence requests. Defense Secretary Pete Hegseth has completed an internal review triggered by earlier revelations, while Senate Intelligence Committee Chair Tom Cotton urged tighter contractor oversight, warning that current safeguards “fail to account for the growing Chinese threat.” Microsoft told ProPublica it has now stopped using China-based staff on Defense contracts and maintains that escorted sessions were “tightly monitored.” The company also hired accredited assessor Kratos to validate its security controls under the FedRAMP program, a pay-by-vendor structure critics call conflicted. Separately, market reports on Wednesday said Microsoft is scaling back Chinese firms’ advance access to cybersecurity-flaw data, underscoring the firm’s broader effort to limit national-security exposure.