Generally Available: External key management for Azure Key Vault Managed HSM

External key management for Azure Key Vault Managed HSM is now generally available in all Azure public regions. For organizations with regulatory or sovereignty requirements to retain physical control of key-encryption keys, it lets Azure services that support customer-managed keys with Managed HSM use keys held in a customer-operated hardware security module (HSM) outside Microsoft infrastructure. Managed HSM delegates key wrap and unwrap operations through a customer-operated proxy; the external key material stays outside Microsoft infrastructure.

Access requires enablement through your Microsoft account team. Connectivity to the proxy over the public internet is available with the GA feature. Azure Private Link integration is in public preview. Customers or their HSM providers are responsible for the external HSM, proxy, and network availability; these components are outside the Managed HSM service-level agreement (SLA).

Learn more.