Edit

What is Azure Key Vault Managed HSM?

Important

We have updated our HSM fleet to a FIPS 140-3 level 3 validated firmware for both Azure Key Vault Managed HSM and Azure Key Vault Premium. See full details at Updating Managed HSM Firmware for Enhanced Security and Compliance.

Azure Key Vault Managed HSM (Hardware Security Module) is a fully managed, highly available, single-tenant, standards-compliant cloud service that enables you to safeguard cryptographic keys for your cloud applications, using FIPS 140-3 Level 3 validated HSMs. It is one of several key management solutions in Azure.

For pricing information, see Managed HSM Pools section on Azure Key Vault pricing page. For supported key types, see About keys in Managed HSM.

The term "Managed HSM instance" is synonymous with "Managed HSM pool". To avoid confusion, we use "Managed HSM instance" throughout these articles.

Note

Zero Trust is a security strategy comprising three principles: "Verify explicitly", "Use least privilege access", and "Assume breach". Data protection, including key management, supports the "use least privilege access" principle. For more information, see What is Zero Trust?

Why use Managed HSM?

Fully managed, highly available, single-tenant HSM as a service

  • Fully managed: The service handles HSM provisioning, configuration, patching, and maintenance.
  • Highly available: Each HSM cluster consists of multiple HSM partitions. If the hardware fails, member partitions for your HSM cluster are automatically migrated to healthy nodes. For more information, see Managed HSM Service Level Agreement
  • Single-tenant: Each Managed HSM instance is dedicated to a single customer and consists of a cluster of multiple HSM partitions. Each HSM cluster uses a separate customer-specific security domain that cryptographically isolates each customer's HSM cluster.

Access control, enhanced data protection & compliance

  • Centralized key management: Manage critical, high-value keys across your organization in one place. With granular per key permissions, control access to each key on the 'least privileged access' principle.
  • Isolated access control: Managed HSM local RBAC access control model allows designated HSM cluster administrators to have complete control over the HSMs that even management group, subscription, or resource group administrators cannot override.
  • Private endpoints: Use private endpoints to securely and privately connect to Managed HSM from your application running in a virtual network.
  • FIPS 140-3 Level 3 validated HSMs: Protect your data and meet compliance requirements with FIPS (Federal Information Protection Standard) 140-3 Level 3 validated HSMs. Managed HSMs use Marvell LiquidSecurity HSM adapters.
  • Monitor and audit: Fully integrated with Azure Monitor. Get complete logs of all activity via Azure Monitor. Use Azure Log Analytics for analytics and alerts.
  • Data residency: Managed HSM doesn't store/process customer data outside the region the customer deploys the HSM instance in.
  • Secure Key Release (SKR): Release an exportable HSM-protected key only to a workload that presents a valid Microsoft Azure Attestation token satisfying the key's release policy. Works with confidential computing and with Trusted Launch VMs. See secure key release policy grammar and the Trusted Launch SKR pattern.

Integrated with Azure and Microsoft PaaS/SaaS services

Uses same API and management interfaces as Key Vault

  • Easily migrate your existing applications that use a vault (a multitenant) to use Managed HSMs.
  • Use same application development and deployment patterns for all your applications irrespective of key management solution in use: Multitenant vaults or single-tenant Managed HSMs.

Import keys from your on-premises HSMs

  • Generate HSM-protected keys in your on-premises HSM and import them securely into Managed HSM.

Build artifact transparency through Microsoft's Signing Transparency

Managed HSM is integrated with Microsoft's Signing Transparency (MST), allowing customers to independently inspect and validate its build artifacts. MST enforces that only authenticated and trusted Managed HSM identities can register production build artifacts in an immutable, tamper-evident ledger. This delivers cryptographically verifiable, SCITT-aligned and IETF/COSE-compliant receipts that provide clear visibility into Managed HSM's deployments—strengthening trust, auditability, and regulatory compliance.

For more information about MST, see About Microsoft's Signing Transparency Ledger. To validate build artifacts, see Verify signatures in the ledger.

External key management

Managed HSM external key management connects compatible Azure services' customer-managed-key (CMK) encryption at rest to an HSM you operate outside Microsoft infrastructure. The Azure service uses its existing Managed HSM key interface while your key encryption key (KEK) stays in your external HSM. External key management is generally available.

Managed HSM keys provide complete customer sovereignty and the best high-availability experience. External key management is a last-resort option when legal or contractual requirements mandate external key custody. Review the supported scenarios and deployment limits, including the exclusion of Managed HSM geo-replication with external keys.

The Managed HSM SLA continues to cover the Managed HSM service, but not end-to-end external key availability. Failures in customer-operated external components can interrupt dependent Azure workloads and don't count against the Azure workload SLAs. For details, see What is Managed HSM external key management? and SLA and shared responsibility for Managed HSM external key management.

Next steps

  • Last updated on