Generally Available: External key management for Azure Key Vault Managed HSM
Analysis / inference: Azure Key Vault Managed HSM now generally supports keeping key-encryption keys in customer-operated external HSMs via a proxy.
- Published
- 16 Oct 2026, 10:20 PM IST
- Updated
- 16 Oct 2026, 10:20 PM IST
- Source
- Azure updates · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Azure Key Vault Managed HSM external key management is generally available across public regions, enabling key wrap and unwrap delegates through a customer-operated proxy with optional public internet connectivity or Private Link in preview.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisExternal key management integration allows compliance-restricted environments to use customer-managed keys hosted outside Microsoft boundaries, modifying trust boundaries and dependency monitoring for encryption operations.
SOC teams must account for external HSM proxy dependencies and understand that component outages outside Microsoft infrastructure are excluded from the Managed HSM SLA.
Section 03 · Recommended actions
- Evaluate regulatory requirements for retaining physical control of key-encryption keys.
- Contact your Microsoft account team to request feature enablement if external key management is needed.
- Monitor external proxy and HSM health independently since they are excluded from the Managed HSM SLA.
- Confirm whether your tenant requires Microsoft account team enablement for external key management.
- Verify proxy and external HSM availability as they fall outside the Managed HSM SLA.
- Review Azure Private Link preview integration options for secure proxy connectivity.