Azure Key Vault Managed HSM External Key Management Enters Public Preview, Offering Enhanced Data Sovereignty

Azure Key Vault Managed Hardware Security Module (HSM) has officially entered public preview with its new external key management capability. This significant development allows organizations to maintain even stronger sovereignty over their encryption keys by enabling them to reside physically outside of Microsoft’s Azure datacenters. The move addresses a critical requirement for a growing number of enterprises, particularly those in highly regulated sectors or operating under stringent data sovereignty laws, fulfilling a commitment Microsoft made approximately a year ago.

The introduction of external key management for Managed HSM represents a strategic expansion of Azure’s commitment to providing robust security and data control. Previously, Managed HSM offered a single-tenant, FIPS 140-3 Level 3 certified HSM solution where keys were generated and stored within dedicated hardware controlled exclusively by the customer. Microsoft explicitly stated it had no access to customer key material, and customers governed all access. While this level of control satisfied the vast majority of organizations, including those with demanding regulatory mandates, a subset of customers required their key material to exist entirely outside the cloud provider’s physical infrastructure.

"External key management for Azure Key Vault Managed HSM is now in public preview," announced a spokesperson for Microsoft Azure, highlighting the immediate availability of this advanced capability. "This directly addresses the needs of organizations with the most stringent requirements for data residency and control over their cryptographic keys." The announcement was anticipated by industry observers, following Microsoft’s June 2025 blog post detailing its comprehensive sovereign solutions designed to empower European organizations.

Understanding the Sovereignty Offered by Managed HSM

To appreciate the significance of external key management, it is crucial to understand the existing sovereignty assurances provided by Azure Key Vault Managed HSM. At its core, Managed HSM is a single-tenant service. This means that each customer instance is a dedicated cluster of FIPS 140-3 Level 3 validated HSM partitions. These partitions are built upon Marvell LiquidSecurity adapters, a leading hardware solution for cryptographic key protection.

A fundamental principle of Managed HSM is that keys are generated and remain exclusively within this dedicated hardware. They are never exposed in plaintext outside the HSM. This design inherently prevents Microsoft operators from accessing customer key material, regardless of their administrative privileges or physical access to the underlying infrastructure.

Control over these keys rests firmly with the customer. This control is multifaceted, encompassing:

• Key Generation: Keys are created within the secure confines of the HSM.
• Key Storage: Keys are stored on tamper-resistant hardware modules.
• Key Access Policies: Granular permissions dictate which users and services can access specific keys.
• Auditing and Monitoring: Comprehensive logs track all key usage and administrative actions.

The underlying technology for Managed HSM incorporates confidential computing, leveraging Intel SGX. This ensures that request handling, access control, and the key material itself are isolated within hardware enclaves and HSMs. This isolation is so robust that even a Microsoft operator with the highest level of administrative or physical access to the host systems cannot read the sensitive data. This layered approach of redundancy, isolation, and protection provides organizations with the sovereignty assurances they demand without compromising on key security, introducing undue operational overhead, or negatively impacting availability.

The Added Value of External Key Management

While Managed HSM already delivers comprehensive customer control, enterprise-grade availability, robust security, and operational simplicity, external key management introduces a distinct and powerful capability: the option to house cryptographic key material on an HSM that the customer owns and operates independently, entirely outside of Microsoft’s cloud infrastructure. This can be situated on-premises or with a trusted third-party hosting provider.

This new model is specifically designed for scenarios where regulatory mandates or contractual obligations explicitly require that cryptographic keys must reside outside the cloud provider’s physical and logical environment. Such requirements are frequently encountered in sectors like government, financial services, and critical infrastructure, which operate under strict oversight. Jurisdictions with rigorous data sovereignty laws also necessitate this level of separation. External key management guarantees that the root of trust and the core key material remain on hardware directly controlled by the customer, completely independent of Microsoft’s infrastructure and under their direct physical supervision.

However, Microsoft strongly advises that this external key management model should be adopted deliberately and only when such stringent requirements are non-negotiable. For the majority of workloads, keys managed natively within Managed HSM remain the recommended approach. This approach offers superior native availability, significantly reduced operational complexity, and a security posture that meets or exceeds sovereignty requirements without introducing additional risks or overhead. External key management is presented as a solution for meeting specific regulatory constraints, not as a means to elevate baseline security beyond what Managed HSM already provides. When these specific constraints are not present, the native Managed HSM solution offers a more robust, reliable, and operationally efficient outcome.

The Mechanics of External Key Management

External key management functions by extending the capabilities of Managed HSM through a dedicated API endpoint. This endpoint establishes a direct connection to the customer-controlled HSM. This architecture permits cryptographic operations initiated within Azure to leverage external key material without necessitating any changes to how applications interact with the Azure Key Vault service. Critically, the external key material never resides within or passes through Microsoft’s infrastructure; it is exclusively utilized by the customer’s own hardware. Because the customer retains full control over this hardware, they possess the ability to disconnect it at any point, thereby halting all cryptographic operations reliant on those keys.

The workflow is designed to be seamless for applications. When an Azure service requires a cryptographic operation (e.g., encryption, decryption, signing), it sends a request to Managed HSM. Managed HSM, in turn, securely forwards this request to the customer’s external HSM via the dedicated API. The external HSM performs the cryptographic operation using the customer’s key material and returns the result to Managed HSM, which then relays it back to the requesting Azure service. This ensures that sensitive key material remains isolated and under the customer’s direct physical control throughout the entire process.

An Evolving HSM Ecosystem

Microsoft is fostering a growing ecosystem of Hardware Security Module (HSM) vendors that are actively enabling integration with the Managed HSM external key management API. Many providers are working diligently to ensure their platforms are compatible with this new capability, recognizing the significant demand from organizations seeking greater control over their cryptographic keys.

It is important to note that Microsoft itself does not build or operate the connecting integration proxy. Instead, customers benefit from an open and flexible model. They have the choice to:

• Utilize a vendor-provided implementation: Many HSM vendors offer pre-built integration solutions.
• Engage a partner to operate it: Specialized partners can manage the integration proxy on behalf of the customer.
• Build their own: For organizations with specific technical expertise and requirements, building a custom integration proxy is also an option.

This open approach empowers customers to select the integration method that best aligns with their technical capabilities, operational resources, and security policies.

Responsibilities and Tradeoffs

The introduction of external key management deliberately shifts a portion of operational responsibility to the customer. This is a direct and inherent consequence of extending the trust boundary beyond the Azure cloud environment. By gaining direct control over the root of trust, customers also assume ownership of the systems that enforce that trust.

This represents the core tradeoff: increased control is intrinsically linked to increased responsibility. The customer assumes responsibility for:

• HSM Hardware Management: Procurement, installation, configuration, and ongoing maintenance of the physical HSMs.
• Network Connectivity: Ensuring secure and reliable network connections between Azure and the external HSM.
• Software and Firmware Updates: Managing updates for the HSM operating system and any associated proxy software.
• Physical Security: Protecting the physical HSMs from unauthorized access or tampering.
• Disaster Recovery and Business Continuity: Implementing strategies to ensure HSM availability in case of outages or failures.
• Security Monitoring and Incident Response: Actively monitoring the external HSM environment for security threats and responding to incidents.

This shift in responsibility requires organizations to possess robust internal IT security capabilities and a clear understanding of the operational demands associated with managing critical cryptographic infrastructure.

Public Preview Scope and Future Development

The public preview of external key management for Azure Key Vault Managed HSM is designed to gather crucial feedback from early adopters. During this phase, Microsoft aims to:

• Validate the functionality: Ensure the feature performs as expected under real-world conditions.
• Identify and address bugs: Resolve any technical issues that arise.
• Gather user feedback: Understand customer experiences and identify areas for improvement.
• Refine operational guidance: Develop comprehensive documentation and best practices for customers.
• Prioritize vendor integrations: Work with key partners to expand the ecosystem of supported HSMs.

The feedback received during the public preview will directly shape the feature’s evolution as it progresses towards general availability. This includes the development of detailed operational guidance, the expansion of vendor integrations, and the prioritization of specific use cases and scenarios that the service will support.

Getting Started with External Key Management

Organizations interested in exploring external key management for Azure Key Vault Managed HSM are encouraged to begin by reviewing the detailed documentation and technical guides available on the Microsoft Azure documentation portal. These resources provide in-depth information on the architecture, setup procedures, and best practices.

The initial steps typically involve:

• Provisioning an Azure Key Vault Managed HSM: Setting up a standard Managed HSM instance within Azure.
• Deploying and configuring an external HSM: Acquiring and setting up the customer-owned HSM infrastructure.
• Establishing secure network connectivity: Configuring firewalls and network routes to enable communication between Azure and the external HSM.
• Configuring the Managed HSM integration: Enabling the external key management feature within the Managed HSM instance and pointing it to the external HSM endpoint.
• Testing cryptographic operations: Performing various key operations to ensure the integration is functioning correctly and securely.

External key management represents a significant advancement in providing customers with granular control over how and where their cryptographic keys are protected. As the feature matures through public preview and moves towards general availability, it is poised to become an indispensable tool for organizations navigating complex regulatory landscapes and demanding the highest levels of data sovereignty and control. The ongoing dialogue between Microsoft and its customers during this preview phase will be instrumental in ensuring the feature meets the evolving needs of the global cybersecurity community.