Unlocking Control: External Key Management for Azure Managed HSM

Azure's External Key Management for Managed HSM exists to provide organizations with stringent regulatory requirements a way to maintain sovereignty over their encryption keys. By allowing you to keep your key material on an HSM that you own, either on-premises or with a trusted third party, it addresses the need for enhanced control while still leveraging Azure's capabilities.

This feature extends Managed HSM through a dedicated API endpoint that connects directly to your controlled HSM. When applications perform cryptographic operations, they can invoke external key material seamlessly, without altering how they interact with Azure services. Importantly, the external key never resides in or traverses Microsoft infrastructure; it is solely utilized by your hardware. This setup ensures that your security domain remains cryptographically isolated, governed by multiperson control through RSA key pairs that you manage offline.

In production, consider that while this model offers greater control, it also brings added responsibility. For most workloads, sticking with Managed HSM keys is recommended due to their higher availability and reduced operational complexity. Remember, external key management is tailored for specific regulatory constraints rather than enhancing baseline security. Access to this feature is gated; you need to contact your Microsoft account team to enable it on your Managed HSM.