Azure Key Vault Managed {Hardware} Safety Module (HSM) gives robust sovereignty over your encryption keys. Keys are generated and saved in a single-tenant, FIPS 140-3 Degree 3 HSM that solely you management: Microsoft has no entry to your key materials, and also you govern who can use every key. For many organizations, together with these with stringent regulatory necessities, this stage of management is enough.
Some organizations have an extra requirement: the {hardware} that holds their key should reside bodily exterior Azure datacenters. Exterior key administration for Azure Key Vault Managed HSM is now in public preview to deal with that requirement, delivering on a dedication made a 12 months in the past.
How Managed HSM delivers sovereignty right this moment
Earlier than exterior key administration, it’s value being exact in regards to the sovereignty Managed HSM already gives. Managed HSM is a single-tenant service: every occasion is a devoted cluster of FIPS 140-3 Degree 3 validated HSM partitions for every buyer—constructed on Marvell LiquidSecurity adapters. Keys are generated inside that {hardware} and by no means go away it in plaintext, making the keys inaccessible to Microsoft operators.
Management rests with you, not Microsoft:
- Buyer-specific safety area. Every HSM cluster is cryptographically remoted by a safety area that you just generate and personal. Microsoft can’t decrypt your key materials or get better your HSM cluster with out it. You’re in full management of the safety area because it’s safety and safeguarding is exterior of Microsoft.
- Multiperson management. The safety area is protected by a quorum of RSA key pairs that you just maintain offline. Restoration requires your quorum, so no single particular person—and no Microsoft operator—can act alone.
- Native role-based entry management (RBAC). An information-plane authorization mannequin, unbiased of Azure RBAC, governs who can carry out every cryptographic operation.
- Key attestation. You possibly can acquire cryptographic proof {that a} key was generated and is used inside the FIPS 140-3 Degree 3 {hardware} boundary.
Managed HSM is constructed on FIPS 140-3 Degree 3 HSMs and confidential computing know-how based mostly on Intel SGX, so request dealing with, entry management, and key materials are remoted in {hardware} enclaves and HSMs that no Microsoft operator—even one with administrative or bodily entry to the host—can learn. Managed HSM gives redundancy, isolation, and safety—giving organizations the sovereignty assurances they want with out compromising on key safety, operational overhead or availability.
What exterior key administration provides
Managed HSM already gives full buyer management over your keys, with enterprise-grade availability, safety, and operational simplicity. Exterior key administration provides one functionality: the choice to maintain your key materials on an HSM that you just personal and function, both on-premises or with a trusted third get together, fully exterior Microsoft infrastructure.
Exterior key administration is designed for situations the place regulation or contractual obligations mandate the cryptographic keys should reside exterior the cloud supplier’s surroundings. These necessities are generally present in extremely regulated sectors akin to authorities, monetary companies, and significant infrastructure, and in jurisdictions with strict data-sovereignty guidelines. Exterior key administration ensures the basis of belief and key materials stay on {hardware} you personal and function, exterior Microsoft infrastructure, and beneath your direct bodily management.
Nevertheless, this mannequin ought to solely be adopted intentionally and solely when required. For many workloads, Managed HSM keys stay the really helpful method, delivering increased native availability, decreased operational complexity, and a safety posture that meets or exceeds sovereignty necessities with out introducing further threat or overhead. Exterior key administration is about assembly particular regulatory constraints, not growing baseline safety. When these constraints don’t apply, Managed HSM gives a stronger, extra dependable, and extra operationally environment friendly answer.
The way it works
Exterior key administration extends Managed HSM by means of a devoted API endpoint that connects on to the HSM you management. It permits cryptographic operations in Azure to invoke exterior key materials with out altering how functions work together with the service. The exterior key by no means resides in or passes by means of Microsoft infrastructure; solely your {hardware} makes use of it. Since you management that {hardware}, you possibly can disconnect it at any time to halt all cryptographic operations.
- Integration is clear to functions. Functions proceed to make use of Managed HSM and the Azure Key Vault API with the customer-managed key envelope encryption sample unchanged. When an knowledge entry requires your exterior key to decrypt native knowledge encryption keys, Managed HSM forwards it to your {hardware} and returns the end result.
- You select the {hardware} and associate. As a result of the exterior key administration API is an open specification, you resolve how one can implement it. Your {hardware}, your associate, or your implementation.
- All connections are mutually authenticated and encrypted. Site visitors between Azure and your {hardware} is secured with mutual TLS, making certain a safe and trusted connection between Azure and your HSM.
HSM ecosystem
A rising ecosystem of HSM distributors help integration with the Managed HSM exterior key administration API, as many suppliers are actively enabling compatibility for his or her platforms.
Microsoft doesn’t construct or function the connecting integration proxy itself. As an alternative, you profit from an open mannequin: you should utilize a vendor supplied implementation, reply on a associate to function it, or construct your personal.
Tasks and tradeoffs
Exterior key administration intentionally shifts a portion of operational accountability to you. That is the direct consequence of extending the belief boundary past Azure: you achieve management over the basis of belief, and with it, possession of the methods that implement it.
- Availability of your {hardware}. The Managed HSM SLA applies as much as the purpose Managed HSM calls your exterior HSM proxy. Availability of your proxy and HSM is your accountability. Any disruption in your facet immediately impacts cryptographic operations and Azure service knowledge accessibility.
- Scope of operations. Exterior key administration focuses on the operations used to guard knowledge at relaxation. It doesn’t expose the total set of key operations out there with Managed HSM keys, reflecting a deliberate trade-off between management and performance.
- {Hardware} operations. Provisioning, securing, scaling, monitoring, and restoration of your proxy and HSM develop into your accountability, whether or not operated immediately or by means of a associate.
- Error transparency. Failures originating in your facet of the connection are surfaced in Managed HSM logs, however stay your accountability to diagnose and resolve.
That is the core trade-off: extra management means extra accountability.
Public preview scope
- Availability: all Azure public areas at preview launch.
- Entry: gated. Your Microsoft account crew permits exterior key administration in your Managed HSM—contact them to request it.
- Use case: defending knowledge at relaxation for Azure companies that help customer-managed keys with Managed HSM.
- Pricing: commonplace Managed HSM pricing, with no further Microsoft surcharge. You cowl the price of your personal {hardware} and any associate licensing.
Get began
Exterior key administration is the most recent step in giving prospects granular management over how and the place their keys are protected. Throughout public preview, your suggestions will immediately form the function on its path to basic availability — together with the operational steering, vendor integrations, and situations we prioritize subsequent.