Azure Managed HSM adds external key management preview

Microsoft has opened public preview for external key management in Azure Managed HSM, enabling customers to store encryption keys on hardware they own and operate outside Microsoft datacenters. The feature addresses regulatory or contractual requirements that mandate cryptographic keys reside outside cloud provider environments, particularly in government, financial services, and critical infrastructure sectors with strict data sovereignty rules.

The preview extends Azure Managed HSM’s existing single-tenant, FIPS 140-3 Level 3 validated hardware security modules (HSMs) by adding an API endpoint that connects directly to customer-controlled HSMs. Cryptographic operations in Azure invoke external key material without exposing it to Microsoft infrastructure, maintaining the existing application interface while shifting the root of trust to customer-owned hardware.

How it works

External key management integrates with Azure Managed HSM through a dedicated API that forwards cryptographic requests to customer-operated HSMs. Applications continue using the Azure Key Vault API with customer-managed key envelope encryption patterns unchanged. When data access requires decryption of local data encryption keys, Managed HSM routes the request to the external HSM and returns the result, ensuring the external key never enters Microsoft infrastructure.

The connection between Azure and customer HSMs uses mutual TLS for authentication and encryption. Customers choose their HSM vendor or partner, as the external key management API follows an open specification supported by a growing ecosystem of hardware providers. Microsoft does not operate the integration proxy, leaving implementation to customers or their chosen partners.

Trade-offs and responsibilities

External key management shifts operational responsibility to customers, reflecting the trade-off between control and complexity. While customers gain physical control over the root of trust, they assume responsibility for the availability, provisioning, scaling, monitoring, and recovery of their HSMs and integration proxies. Disruptions on the customer side directly impact cryptographic operations and Azure service data accessibility, with Microsoft’s SLA applying only up to the point of calling the external HSM proxy.

The feature focuses on protecting data at rest and does not expose the full range of key operations available with native Managed HSM keys. Failures originating from customer-operated hardware appear in Managed HSM logs but remain the customer’s responsibility to diagnose and resolve.

Availability and next steps

The public preview is available in all Azure public regions, with access gated through Microsoft account teams. Pricing follows standard Managed HSM rates, with customers bearing the cost of their own hardware and any partner licensing. Microsoft has not announced a general availability timeline but indicated that customer feedback during the preview will shape operational guidance, vendor integrations, and future scenario priorities.