Azure Key Vault Managed HSM external key management enters public preview
Azure Key Vault Managed HSM now offers external key management in public preview, allowing customers to keep their encryption keys on hardware outside of Azure datacenters. This feature addresses stringent regulatory and contractual requirements for organizations in sectors like government and finance that mandate cryptographic keys reside outside the cloud provider's environment. While Managed HSM already provides significant sovereignty, external key management shifts the root of trust to customer-owned hardware, requiring increased operational responsibility.
- →External key management for Azure Key Vault Managed HSM
- →Managed HSM provides existing sovereignty features
- →External key management enables choice of hardware and partner
- →External key management shifts operational responsibility
- →Public preview details and getting started
Features (1) ›
- External key management for Azure Key Vault Managed HSM
A new public preview feature allows organizations to manage their encryption keys on HSMs physically located outside of Azure datacenters. This addresses specific regulatory and contractual requirements for key sovereignty.
Enhancements (1) ›
- External key management enables choice of hardware and partner
The external key management feature supports an open specification, allowing customers to choose their hardware, implement their own solution, or rely on a partner. Connections are secured with mutual TLS.
Notes (3) ›
- Managed HSM provides existing sovereignty features
Managed HSM offers single-tenant FIPS 140-3 Level 3 validation, customer-specific security domains, multiperson control, and local RBAC for strong key sovereignty. Microsoft operators have no access to key material.
- External key management shifts operational responsibility
Adopting external key management means customers are responsible for the availability, provisioning, security, scaling, monitoring, and recovery of their external HSMs and integration proxies. Failures on the customer side impact cryptographic operations.
- Public preview details and getting started
External key management is available in all Azure public regions during preview and requires requesting access through your Microsoft account team. It is priced at standard Managed HSM rates, with customers covering their own hardware costs.
https://azure.microsoft.com/en-us/blog/external-key-management-for-azure-managed-hsm-is-now-in-public-preview/
Related releases
- Terraform Azure Provider v4.81.0 Adds New Resources and Enhancements Terraform AzureRM Provider Releases ·
- Azure Database for PostgreSQL: Cross-tenant Customer-Managed Keys in Preview Azure Updates ·
- Terraform Provider for Azure Adds New Resources and Enhancements Terraform AzureRM Provider Releases ·
- Azure Premium SSD v2 and Ultra Disks support cross-tenant CMK Azure Updates ·
- Azure Introduces Agentic Cloud Operations for Seamless Insight-to-Action Microsoft Azure Blog ·
- PostgreSQL extension for VS Code enhances Azure performance tuning Microsoft Azure Blog ·