Azure Key Vault Managed {Hardware} Safety Module (HSM) gives sturdy sovereignty over your encryption keys. Keys are generated and saved in a single-tenant, FIPS 140-3 Stage 3 HSM that solely you management: Microsoft has no entry to your key materials, and also you govern who can use every key. For many organizations, together with these with stringent regulatory necessities, this degree of management is ample.
Some organizations have an extra requirement: the {hardware} that holds their key should reside bodily outdoors Azure datacenters. Exterior key administration for Azure Key Vault Managed HSM is now in public preview to handle that requirement, delivering on a dedication made a 12 months in the past.
How Managed HSM delivers sovereignty right this moment
Earlier than taking a look at exterior key administration, it’s value being exact concerning the sovereignty Managed HSM already gives. Managed HSM is a single-tenant service: every occasion is a devoted cluster of FIPS 140-3 Stage 3 validated HSM partitions for every buyer—constructed on Marvell LiquidSecurity adapters. Keys are generated inside that {hardware} and by no means depart it in plaintext, making the keys inaccessible to Microsoft operators.
Management rests with you, not Microsoft:
Buyer-specific safety area. Every HSM cluster is cryptographically remoted by a safety area that you simply generate and personal. Microsoft can’t decrypt your key materials or get better your HSM cluster with out it. You might be in full management of the safety area because it’s safety and safeguarding is outdoors of Microsoft.
Multiperson management. The safety area is protected by a quorum of RSA key pairs that you simply maintain offline. Restoration requires your quorum, so no single individual—and no Microsoft operator—can act alone.
Native role-based entry management (RBAC). An information-plane authorization mannequin, impartial of Azure RBAC, governs who can carry out every cryptographic operation.
Key attestation. You’ll be able to receive cryptographic proof {that a} key was generated and is used throughout the FIPS 140-3 Stage 3 {hardware} boundary.
Managed HSM is constructed on FIPS 140-3 Stage 3 HSMs and confidential computing know-how primarily based on Intel SGX, so request dealing with, entry management, and key materials are remoted in {hardware} enclaves and HSMs that no Microsoft operator—even one with administrative or bodily entry to the host—can learn. Managed HSM gives redundancy, isolation, and safety—giving organizations the sovereignty assurances they want with out compromising on key safety, operational overhead or availability.
What exterior key administration provides
Managed HSM already gives full buyer management over your keys, with enterprise-grade availability, safety, and operational simplicity. Exterior key administration provides one functionality: the choice to maintain your key materials on an HSM that you simply personal and function, both on-premises or with a trusted third celebration, utterly outdoors Microsoft infrastructure.
Exterior key administration is designed for eventualities the place regulation or contractual obligations mandate the cryptographic keys should reside outdoors the cloud supplier’s setting. These necessities are generally present in extremely regulated sectors equivalent to authorities, monetary companies, and significant infrastructure, and in jurisdictions with strict data-sovereignty guidelines. Exterior key administration ensures the basis of belief and key materials stay on {hardware} you personal and function, outdoors Microsoft infrastructure, and below your direct bodily management.
Nonetheless, this mannequin ought to solely be adopted intentionally and solely when required. For many workloads, Managed HSM keys stay the really useful method, delivering greater native availability, decreased operational complexity, and a safety posture that meets or exceeds sovereignty necessities with out introducing further danger or overhead. Exterior key administration is about assembly particular regulatory constraints, not rising baseline safety. When these constraints don’t apply, Managed HSM gives a stronger, extra dependable, and extra operationally environment friendly answer.
The way it works
Exterior key administration extends Managed HSM by a devoted API endpoint that connects on to the HSM you management. It permits cryptographic operations in Azure to invoke exterior key materials with out altering how functions work together with the service. The exterior key by no means resides in or passes by Microsoft infrastructure; solely your {hardware} makes use of it. Since you management that {hardware}, you may disconnect it at any time to halt all cryptographic operations.
Integration is clear to functions. Functions proceed to make use of Managed HSM and the Azure Key Vault API with the customer-managed key envelope encryption sample unchanged. When an knowledge entry requires your exterior key to decrypt native knowledge encryption keys, Managed HSM forwards it to your {hardware} and returns the consequence.
You select the {hardware} and companion. As a result of the exterior key administration API is an open specification, you determine the way to implement it. Your {hardware}, your companion, or your implementation.
All connections are mutually authenticated and encrypted. Site visitors between Azure and your {hardware} is secured with mutual TLS, guaranteeing a safe and trusted connection between Azure and your HSM.
HSM ecosystem
A rising ecosystem of HSM distributors assist integration with the Managed HSM exterior key administration API, as many suppliers are actively enabling compatibility for his or her platforms.
Microsoft doesn’t construct or function the connecting integration proxy itself. As a substitute, you profit from an open mannequin: you should use a vendor offered implementation, reply on a companion to function it, or construct your personal.
Duties and tradeoffs
Exterior key administration intentionally shifts a portion of operational duty to you. That is the direct consequence of extending the belief boundary past Azure: you acquire management over the basis of belief, and with it, possession of the methods that implement it.
Availability of your {hardware}. The Managed HSM SLA applies as much as the purpose Managed HSM calls your exterior HSM proxy. Availability of your proxy and HSM is your duty. Any disruption in your aspect immediately impacts cryptographic operations and Azure service knowledge accessibility.
Scope of operations. Exterior key administration focuses on the operations used to guard knowledge at relaxation. It doesn’t expose the total set of key operations out there with Managed HSM keys, reflecting a deliberate trade-off between management and performance.
{Hardware} operations. Provisioning, securing, scaling, monitoring, and restoration of your proxy and HSM change into your duty, whether or not operated immediately or by a companion.
Error transparency. Failures originating in your aspect of the connection are surfaced in Managed HSM logs, however stay your duty to diagnose and resolve.
That is the core trade-off: extra management means extra duty.
Public preview scope
Availability: all Azure public areas at preview launch.
Entry: gated. Your Microsoft account group permits exterior key administration in your Managed HSM—contact them to request it.
Use case: defending knowledge at relaxation for Azure companies that assist customer-managed keys with Managed HSM.
Pricing: customary Managed HSM pricing, with no further Microsoft surcharge. You cowl the price of your personal {hardware} and any companion licensing.
Get began
Exterior key administration is the most recent step in giving clients granular management over how and the place their keys are protected. Throughout public preview, your suggestions will immediately form the function on its path to normal availability — together with the operational steerage, vendor integrations, and eventualities we prioritize subsequent.
