{"id":52575,"date":"2026-07-07T09:00:00","date_gmt":"2026-07-07T16:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/en-us\/blog\/?p=52575"},"modified":"2026-07-06T12:21:33","modified_gmt":"2026-07-06T19:21:33","slug":"external-key-management-for-azure-managed-hsm-is-now-in-public-preview","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/","title":{"rendered":"External key management for Azure Managed HSM is now in public preview"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/aka.ms\/mhsmekm\" target=\"_blank\" rel=\"noreferrer noopener\">Azure Key Vault Managed Hardware Security Module (HSM)<\/a> provides strong sovereignty over your encryption keys. Keys are generated and stored in a single-tenant, FIPS 140-3 Level 3 HSM that only you control: Microsoft has no access to your key material, and you govern who can use each key. For most organizations, including those with stringent regulatory requirements, this level of control is sufficient.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\n  Some organizations have a further requirement: the hardware that holds their key must reside physically outside Azure datacenters. <strong>External key management for Azure Key Vault Managed HSM is now in public preview<\/strong> to address that requirement, delivering on <a href=\"https:\/\/blogs.microsoft.com\/blog\/2025\/06\/16\/announcing-comprehensive-sovereign-solutions-empowering-european-organizations\/\">a commitment made a year ago<\/a>.\n<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-a89b3969 wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/aka.ms\/mhsmekm\" target=\"_blank\" rel=\"noopener noreferrer noreferrer noopener\"><strong style=\"font-family: inherit;font-size: 15.008px;font-style: inherit;letter-spacing: 0.30016px;text-transform: inherit\">Try <strong>External key management for Azure Key Vault Managed HSM<\/strong><\/strong><\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-managed-hsm-delivers-sovereignty-today\"><a id=\"post-52575-X6153d177f958023adb85f2376ce55c910fb68bf\"><\/a>How Managed HSM delivers sovereignty today<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\n  Before looking at external key management, it\u2019s worth being precise about the sovereignty <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/key-vault\/managed-hsm\/overview\">Managed HSM<\/a> already provides. Managed HSM is a single-tenant service: each instance is a dedicated cluster of FIPS 140-3 Level 3 validated HSM partitions for each customer\u2014built on Marvell LiquidSecurity adapters. Keys are generated inside that hardware and never leave it in plaintext, making the keys inaccessible to Microsoft operators.\n<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Control rests with you, not Microsoft:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\"><strong>Customer-specific security domain.<\/strong> Each HSM cluster is cryptographically isolated by a security domain that you generate and own. Microsoft can\u2019t decrypt your key material or recover your HSM cluster without it. You are in full control of the security domain as it\u2019s protection and safeguarding is outside of Microsoft.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Multiperson control.<\/strong> The security domain is protected by a quorum of RSA key pairs that you hold offline. Recovery requires your quorum, so no single person\u2014and no Microsoft operator\u2014can act alone.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Local role-based access control<\/strong> (<strong>RBAC).<\/strong> A data-plane authorization model, independent of <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/role-based-access-control\/overview\">Azure RBAC<\/a>, governs who can perform each cryptographic operation.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Key attestation.<\/strong> You can obtain cryptographic proof that a key was generated and is used within the FIPS 140-3 Level 3 hardware boundary.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\n  Managed HSM is built on FIPS 140-3 Level 3 HSMs and confidential computing technology based on Intel SGX, so request handling, access control, and key material are isolated in hardware enclaves and HSMs that no Microsoft operator\u2014even one with administrative or physical access to the host\u2014can read. Managed HSM provides redundancy, isolation, and protection\u2014giving organizations the sovereignty assurances they need without compromising on key security, operational overhead or availability. \n<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-external-key-management-adds\"><a id=\"post-52575-what-external-key-management-adds\"><\/a>What external key management adds<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\n  Managed HSM already provides full customer control over your keys, with enterprise-grade availability, security, and operational simplicity. External key management adds one capability: the option to keep your key material on an HSM that you own and operate, either on-premises or with a trusted third party, completely outside Microsoft infrastructure.\n<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\n  External key management is designed for scenarios where regulation or contractual obligations mandate the cryptographic keys must reside outside the cloud provider\u2019s environment. These requirements are sometimes found in highly regulated sectors such as government, financial services, and critical infrastructure, and in jurisdictions with strict data-sovereignty rules. External key management ensures the root of trust and key material remain on hardware you own and operate, outside Microsoft infrastructure, and under your direct physical control. \n<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\n  However, this model should only be adopted deliberately and only when required. For most workloads, Managed HSM keys remain the recommended approach, delivering higher native availability, reduced operational complexity, and a security posture that meets or exceeds sovereignty requirements without introducing additional risk or overhead. External key management is about meeting specific regulatory constraints, not increasing baseline security. When those constraints do not apply, Managed HSM provides a stronger, more reliable, and more operationally efficient solution.\n<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-it-works\"><a id=\"post-52575-how-it-works\"><\/a>How it works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\n  External key management extends Managed HSM through a dedicated API endpoint that connects directly to the HSM you control. It allows cryptographic operations in Azure to invoke external key material without changing how applications interact with the service. The external key never resides in or passes through Microsoft infrastructure; only your hardware uses it. Because you control that hardware, you can disconnect it at any time to halt all cryptographic operations.\n<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\"><strong>Integration is transparent to applications.<\/strong> Applications continue to use Managed HSM and the Azure Key Vault API with the customer-managed key envelope encryption pattern unchanged. When an data access requires your external key to decrypt local data encryption keys, Managed HSM forwards it to your hardware and returns the result.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>You choose the hardware and partner.<\/strong> Because the external key management API is an open specification, you decide how to implement it. Your hardware, your partner, or your implementation.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>All connections are mutually authenticated and encrypted.<\/strong> Traffic between Azure and your hardware is secured with mutual TLS, ensuring a secure and trusted connection between <a href=\"https:\/\/azure.microsoft.com\/en-us\">Azure<\/a> and your HSM.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"hsm-ecosystem\"><a id=\"post-52575-hsm-ecosystem\"><\/a>HSM ecosystem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\n  A growing ecosystem of HSM vendors support integration with the Managed HSM external key management API, as many providers are actively enabling compatibility for their platforms.\n<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft doesn\u2019t build or operate the connecting integration proxy itself. Instead, you benefit from an open model: you can use a vendor provided implementation, reply on a partner to operate it, or build your own.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"responsibilities-and-tradeoffs\"><a id=\"post-52575-responsibilities-and-tradeoffs\"><\/a>Responsibilities and tradeoffs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\n  External key management deliberately shifts a portion of operational responsibility to you. This is the direct consequence of extending the trust boundary beyond Azure: you gain control over the root of trust, and with it, ownership of the systems that enforce it.\n<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\"><strong>Availability of your hardware.<\/strong> The Managed HSM SLA applies up to the point Managed HSM calls your external HSM proxy. Availability of your proxy and HSM is your responsibility. Any disruption on your side directly impacts cryptographic operations and Azure service data accessibility.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Scope of operations.<\/strong> External key management focuses on the operations used to protect data at rest. It does not expose the full set of key operations available with Managed HSM keys, reflecting a deliberate trade-off between control and functionality.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Hardware operations.<\/strong> Provisioning, securing, scaling, monitoring, and recovery of your proxy and HSM become your responsibility, whether operated directly or through a partner.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Error transparency.<\/strong> Failures originating on your side of the connection are surfaced in Managed HSM logs, but remain your responsibility to diagnose and resolve.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\n  This is the core trade-off: more control means more responsibility.\n<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"public-preview-scope\"><a id=\"post-52575-public-preview-scope\"><\/a>Public preview scope<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\"><strong>Availability:<\/strong> all Azure public regions at preview launch.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Access:<\/strong> gated. Your Microsoft account team enables external key management on your Managed HSM\u2014contact them to request it.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Use case:<\/strong> protecting data at rest for <a href=\"https:\/\/learn.microsoft.com\/azure\/security\/fundamentals\/encryption-customer-managed-keys-support\">Azure services that support customer-managed keys with Managed HSM<\/a>.<\/li>\n\n\n\n<li class=\"wp-block-list-item\"><strong>Pricing:<\/strong> standard <a href=\"https:\/\/azure.microsoft.com\/en-us\/pricing\/details\/key-vault\/\" target=\"_blank\" rel=\"noopener noreferrer\">Managed HSM pricing<\/a>, with no additional Microsoft surcharge. You cover the cost of your own hardware and any partner licensing.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"get-started\"><a id=\"post-52575-get-started\"><\/a>Get started<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\">Start with: <a href=\"https:\/\/aka.ms\/mhsmekmstart\" target=\"_blank\" rel=\"noreferrer noopener\">What is Managed HSM external key management?<\/a><\/li>\n\n\n\n<li class=\"wp-block-list-item\">Review the <a href=\"https:\/\/aka.ms\/mhsmekmsla\" target=\"_blank\" rel=\"noreferrer noopener\">SLA and shared-responsibility model<\/a><\/li>\n\n\n\n<li class=\"wp-block-list-item\">Try the <a href=\"https:\/\/learn.microsoft.com\/azure\/key-vault\/managed-hsm\/external-key-management-quickstart-cli\" target=\"_blank\" rel=\"noreferrer noopener\">Azure CLI quickstart<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\n  External key management is the latest step in giving customers granular control over how and where their keys are protected. During public preview, your feedback will directly shape the feature on its path to general availability \u2014 including the operational guidance, vendor integrations, and scenarios we prioritize next.\n<\/p>\n\n\n\n<div class=\"is-style-inline wp-block-bloginabox-theme-promotional\">\n\t\n<div class=\"promotional promotional--has-media promotional--media-right\">\n\t<div class=\"promotional__wrapper\">\n\t\t<div class=\"promotional__content-wrapper\">\n\t\t\t<div class=\"promotional__content\">\n\t\t\t\t\n\n<h2 class=\"wp-block-heading\" id=\"take-control-of-your-encryption-keys\">Take control of your encryption keys<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Explore external key management for Managed HSM and keep your key material outside Azure while maintaining secure, scalable operations.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a data-bi-an=\"Global CTA\" data-bi-ct=\"cta link\" data-bi-id=\"cta-block\" class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/learn.microsoft.com\/azure\/key-vault\/managed-hsm\/external-key-management-overview\" target=\"_blank\" rel=\"noopener noreferrer\">Get started<\/a><\/div>\n<\/div>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<div class=\"promotional__media-wrapper\">\n\t\t\t\t<div class=\"promotional__media\">\n\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"2560\" height=\"1440\" src=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-scaled.jpg\" class=\"attachment-full size-full\" alt=\"3D Illustration\" loading=\"lazy\" srcset=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-scaled.jpg 2560w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-300x169.jpg 300w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-1024x576.jpg 1024w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-768x432.jpg 768w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-1536x864.jpg 1536w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-2048x1152.jpg 2048w, https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/Azure-AIPlatform-Light-3-809x455.jpg 809w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/>\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Azure Key Vault Managed Hardware Security Module (HSM) provides strong sovereignty over your encryption keys. Keys are generated and stored in a single-tenant, FIPS 140-3 Level 3 HSM that only you control: Microsoft has no access to your key material, and you govern who can use each key.<\/p>\n","protected":false},"author":58,"featured_media":52577,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","_alt_title":"","ms-ems-related-posts":[],"footnotes":"","azure_community_cta_settings":[]},"categories":[1482],"tags":[3402,3403,3399,3401,3400],"audience":[3054,3053,3056],"content-type":[1481],"product":[1672],"tech-community":[],"coauthors":[1728],"class_list":["post-52575","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-management-and-governance","tag-azure","tag-azure-key-vault-api","tag-azure-key-vault-managed-hsm","tag-azure-rbac","tag-managed-hsm","audience-business-decision-makers","audience-it-decision-makers","audience-it-implementors","content-type-thought-leadership","product-azure-managed-applications","review-flag-3-1680286581-173","review-flag-gener-1680286584-335","review-flag-never-1680286580-606","review-flag-partn-1680286579-901","review-flag-publi-1680286584-566"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>External key management for Azure Managed HSM<\/title>\n<meta name=\"description\" content=\"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"External key management for Azure Managed HSM\" \/>\n<meta property=\"og:description\" content=\"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Azure Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/microsoftazure\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-07T16:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Salim Chawro\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@azure\" \/>\n<meta name=\"twitter:site\" content=\"@azure\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Salim Chawro\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/\"},\"author\":[{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/author\\\/salim-chawro\\\/\",\"@type\":\"Person\",\"@name\":\"Salim Chawro\"}],\"headline\":\"External key management for Azure Managed HSM is now in public preview\",\"datePublished\":\"2026-07-07T16:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/\"},\"wordCount\":1201,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/External-Key-Management-1.jpg\",\"keywords\":[\"Azure\",\"Azure Key Vault API\",\"Azure Key Vault Managed HSM\",\"Azure RBAC\",\"Managed HSM\"],\"articleSection\":[\"Management and governance\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/\",\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/\",\"name\":\"External key management for Azure Managed HSM\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/External-Key-Management-1.jpg\",\"datePublished\":\"2026-07-07T16:00:00+00:00\",\"description\":\"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#primaryimage\",\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/External-Key-Management-1.jpg\",\"contentUrl\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/External-Key-Management-1.jpg\",\"width\":1920,\"height\":1080,\"caption\":\"a technology professional working at a computer, overlaid with abstract geometric shapes\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog home\",\"item\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Management and governance\",\"item\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/category\\\/management-and-governance\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"External key management for Azure Managed HSM is now in public preview\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/\",\"name\":\"Microsoft Azure Blog\",\"description\":\"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.\",\"publisher\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#organization\",\"name\":\"Microsoft Azure Blog\",\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/microsoft_logo.webp\",\"contentUrl\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/microsoft_logo.webp\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Azure Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/microsoftazure\",\"https:\\\/\\\/x.com\\\/azure\",\"https:\\\/\\\/www.instagram.com\\\/microsoftdeveloper\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/16188386\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/windowsazure\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/#\\\/schema\\\/person\\\/c505c4707a8b0733197cd32e481f1fae\",\"name\":\"Estela Virko\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=ge79ba33f176c2122a103010d5e208f8b\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=g\",\"caption\":\"Estela Virko\"},\"url\":\"https:\\\/\\\/azure.microsoft.com\\\/en-us\\\/blog\\\/author\\\/estelavirko\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"External key management for Azure Managed HSM","description":"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/","og_locale":"en_US","og_type":"article","og_title":"External key management for Azure Managed HSM","og_description":"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.","og_url":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/","og_site_name":"Microsoft Azure Blog","article_publisher":"https:\/\/www.facebook.com\/microsoftazure","article_published_time":"2026-07-07T16:00:00+00:00","og_image":[{"width":1920,"height":1080,"url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","type":"image\/jpeg"}],"author":"Salim Chawro","twitter_card":"summary_large_image","twitter_image":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","twitter_creator":"@azure","twitter_site":"@azure","twitter_misc":{"Written by":"Salim Chawro","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#article","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/"},"author":[{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/salim-chawro\/","@type":"Person","@name":"Salim Chawro"}],"headline":"External key management for Azure Managed HSM is now in public preview","datePublished":"2026-07-07T16:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/"},"wordCount":1201,"commentCount":0,"publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#primaryimage"},"thumbnailUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","keywords":["Azure","Azure Key Vault API","Azure Key Vault Managed HSM","Azure RBAC","Managed HSM"],"articleSection":["Management and governance"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/","name":"External key management for Azure Managed HSM","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#primaryimage"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#primaryimage"},"thumbnailUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","datePublished":"2026-07-07T16:00:00+00:00","description":"Explore external key management for Azure Managed HSM\u2014keeping encryption keys outside Azure when required by data sovereignty\u00a0while maintaining secure cloud operations.","breadcrumb":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#primaryimage","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","contentUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2026\/07\/External-Key-Management-1.jpg","width":1920,"height":1080,"caption":"a technology professional working at a computer, overlaid with abstract geometric shapes"},{"@type":"BreadcrumbList","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/external-key-management-for-azure-managed-hsm-is-now-in-public-preview\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog home","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/"},{"@type":"ListItem","position":2,"name":"Management and governance","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/category\/management-and-governance\/"},{"@type":"ListItem","position":3,"name":"External key management for Azure Managed HSM is now in public preview"}]},{"@type":"WebSite","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","name":"Microsoft Azure Blog","description":"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.","publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/azure.microsoft.com\/en-us\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization","name":"Microsoft Azure Blog","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","contentUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","width":512,"height":512,"caption":"Microsoft Azure Blog"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/microsoftazure","https:\/\/x.com\/azure","https:\/\/www.instagram.com\/microsoftdeveloper\/","https:\/\/www.linkedin.com\/company\/16188386","https:\/\/www.youtube.com\/user\/windowsazure"]},{"@type":"Person","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/person\/c505c4707a8b0733197cd32e481f1fae","name":"Estela Virko","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=ge79ba33f176c2122a103010d5e208f8b","url":"https:\/\/secure.gravatar.com\/avatar\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e0c80aef45905808b531834966f343f124eab0a088eaf8c5091c92e213cf58e5?s=96&d=mm&r=g","caption":"Estela Virko"},"url":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/estelavirko\/"}]}},"bloginabox_animated_featured_image":null,"bloginabox_display_generated_audio":true,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Azure Blog","distributor_original_site_url":"https:\/\/azure.microsoft.com\/en-us\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/52575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/comments?post=52575"}],"version-history":[{"count":12,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/52575\/revisions"}],"predecessor-version":[{"id":52623,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/52575\/revisions\/52623"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/media\/52577"}],"wp:attachment":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/media?parent=52575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/categories?post=52575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tags?post=52575"},{"taxonomy":"audience","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/audience?post=52575"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/content-type?post=52575"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/product?post=52575"},{"taxonomy":"tech-community","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tech-community?post=52575"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/coauthors?post=52575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}