You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -88,19 +88,19 @@ Platform as a Service (PaaS) customer's data typically resides in a storage serv
88
88
89
89
### Encryption at rest for IaaS customers
90
90
91
-
Infrastructure as a Service (IaaS) customers can have a variety of services and applications in use. IaaS services can enable encryption at rest in their Azure hosted virtual machines and VHDs using encryption at host.
91
+
Infrastructure as a Service (IaaS) customers can have a variety of services and applications in use. IaaS services can enable encryption at rest in their Azure hosted virtual machines using encryption at host.
92
92
93
93
#### Encrypted storage
94
94
95
95
Like PaaS, IaaS solutions can leverage other Azure services that store data encrypted at rest. In these cases, you can enable the Encryption at Rest support as provided by each consumed Azure service. The [Data encryption models](encryption-models.md) enumerates the major storage, services, and application platforms and the model of Encryption at Rest supported.
96
96
97
97
#### Encrypted compute
98
98
99
-
All Managed Disks, Snapshots, and Images are encrypted using Storage Service Encryption using a service-managed key. A more complete Encryption at Rest solution ensures that the data is never persisted in unencrypted form. While processing the data on a virtual machine, data can be persisted to the Windows page file or Linux swap file, a crash dump, or to an application log. To ensure this data is encrypted at rest, IaaS applications can use encryption at host on an Azure IaaS virtual machine.
99
+
All Managed Disks, Snapshots, and Images are encrypted using Storage Service Encryption using a service-managed key. A more complete Encryption at Rest solution ensures that the data is never persisted in unencrypted form. While processing the data on a virtual machine, data can be persisted to the Windows page file or Linux swap file, a crash dump, or to an application log. To ensure this data is encrypted at rest, IaaS applications can use encryption at host on Azure IaaS virtual machines.
100
100
101
101
#### Custom encryption at rest
102
102
103
-
It is recommended that whenever possible, IaaS applications leverage encryption at host and Encryption at Rest options provided by any consumed Azure services. In some cases, such as irregular encryption requirements or non-Azure based storage, a developer of an IaaS application may need to implement encryption at rest themselves. Developers of IaaS solutions can better integrate with Azure management and customer expectations by leveraging certain Azure components. Specifically, developers should use the Azure Key Vault service to provide secure key storage as well as provide their customers with key management options consistent with that of Azure platform services. Additionally, custom solutions should use Azure managed service identities to enable service accounts to access encryption keys. For developer information on Azure Key Vault and Managed Service Identities, see their respective SDKs.
103
+
It is recommended that whenever possible, IaaS applications leverage encryption at host and Encryption at Rest options provided by any consumed Azure services. Developers should use the Azure Key Vault service to provide secure key storage as well as provide their customers with consistent key management options with Azure platform services. Additionally, custom solutions should use Azure managed service identities to enable service accounts to access encryption keys. For developer information on Azure Key Vault and Managed Service Identities, see their respective SDKs.
104
104
105
105
## Azure resource providers encryption model support
Copy file name to clipboardExpand all lines: articles/security/fundamentals/encryption-overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: msmbaldwin
6
6
ms.service: security
7
7
ms.subservice: security-fundamentals
8
8
ms.topic: article
9
-
ms.date: 11/04/2025
9
+
ms.date: 01/08/2026
10
10
ms.author: mbaldwin
11
11
---
12
12
# Azure encryption overview
@@ -123,7 +123,7 @@ A site-to-site VPN gateway connection connects your on-premises network to an Az
123
123
124
124
## Key management with Key Vault
125
125
126
-
Without proper protection and management of keys, encryption is rendered useless. Azure Key Vault is the Microsoft-recommended solution for managing and controlling access to encryption keys used by cloud services.
126
+
Without proper protection and management of keys, encryption is rendered useless. Azure offers several key management solutions, including Azure Key Vault, Azure Key Vault Managed HSM, Azure Cloud HSM, and Azure Payment HSM.
127
127
128
128
Key Vault relieves organizations of the need to configure, patch, and maintain hardware security modules (HSMs) and key management software. With Key Vault, you maintain control—Microsoft never sees your keys, and applications don't have direct access to them. You can also import or generate keys in HSMs.
Copy file name to clipboardExpand all lines: articles/security/fundamentals/key-management-choose.md
+14-13Lines changed: 14 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,18 @@
1
1
---
2
2
title: How to choose the right key management solution
3
-
titleSuffix: How to choose between Azure Key Vault, Azure Key Vault Managed HSM, Azure Dedicated HSM, and Azure Payment HSM
3
+
titleSuffix: How to choose between Azure Key Vault, Azure Key Vault Managed HSM, Azure Cloud HSM, and Azure Payment HSM
4
4
description: This article provides a detailed explanation of how to choose the right Key Management solution in Azure.
5
5
services: security
6
6
author: chenkaren
7
7
ms.service: security
8
8
ms.topic: article
9
-
ms.date: 07/14/2025
9
+
ms.date: 01/08/2026
10
10
ms.author: chenkaren
11
11
---
12
12
13
13
# How to choose the right Azure key management solution
14
14
15
-
Azure offers several solutions for cryptographic key storage and management in the cloud: Azure Key Vault (standard and premium offerings), Azure Key Vault Managed HSM, Azure Dedicated HSM, and Azure Payment HSM. It might be overwhelming for customers to decide which key management solution is right for them. This article helps customers navigate this decision-making process by presenting the range of solutions based on three considerations: scenarios, requirements, and industry.
15
+
Azure offers several solutions for cryptographic key storage and management in the cloud: Azure Key Vault (standard and premium offerings), Azure Key Vault Managed HSM, Azure Cloud HSM, and Azure Payment HSM. This article helps you choose the right solution based on your scenarios, requirements, and industry.
16
16
17
17
For an overview of key management concepts and detailed descriptions of each solution, see [Key management in Azure](key-management.md).
18
18
@@ -41,25 +41,25 @@ The flowchart result is a starting point to identify the solution that best matc
41
41
42
42
## Compare other customer requirements
43
43
44
-
Azure provides multiple key management solutions to allow customers to choose a product based on both high-level requirements and management responsibilities. There is a spectrum of management responsibilities ranging from Azure Key Vaultand Azure Managed HSM having less customer responsibility, followed by Azure Cloud HSM and Azure Payment HSM having the most customer responsibility.
44
+
Azure provides multiple key management solutions to allow customers to choose a product based on both high-level requirements and management responsibilities. There is a spectrum of management responsibilities ranging from Azure Key Vault, Azure Managed HSM, and Azure Cloud HSM having less customer responsibility (Microsoft handles patching and maintenance), to Azure Payment HSM having the most customer responsibility.
45
45
46
46
This trade-off of management responsibility between the customer and Microsoft and other requirements is detailed in the table below.
47
47
48
48
Provisioning and hosting are managed by Microsoft across all solutions. Key generation and management, roles and permissions granting, and monitoring and auditing are the responsibility of the customer across all solutions.
49
49
50
50
Use the table to compare all the solutions side by side. Begin from top to bottom, answering each question found on the left-most column to help you choose the solution that meets all your needs, including management overhead and costs.
| What level of **compliance** do you need? | FIPS 140-2 level 1 | FIPS 140-2 level 2| FIPS 140-2 level 3, PCI DSS, PCI 3DS | FIPS 140-2 level 3, HIPAA, PCI DSS, PCI 3DS, eIDAS| FIPS 140-2 level 3, PCI HSM v3, PCI PTS HSM v3, PCI DSS, PCI 3DS, PCI PIN |
54
+
| What level of **compliance** do you need? | FIPS 140-2 level 1 | FIPS 140-3 level 3| FIPS 140-3 level 3, PCI DSS, PCI 3DS | FIPS 140-3 level 3 | FIPS 140-2 level 3, PCI HSM v3, PCI PTS HSM v3, PCI DSS, PCI 3DS, PCI PIN |
55
55
| Do you need **key sovereignty**? | No | No | Yes | Yes | Yes |
56
56
| What kind of **tenancy** are you looking for? | Multitenant | Multitenant | Single Tenant | Single Tenant | Single Tenant |
57
-
| What are your **use cases**? | Encryption at Rest, CMK, custom | Encryption at Rest, CMK, custom | Encryption at Rest, TLS Offload, CMK, custom |PKCS11, TLS Offload, code/document signing, custom| Payment PIN processes, custom |
57
+
| What are your **use cases**? | Encryption at Rest, CMK, custom | Encryption at Rest, CMK, custom | Encryption at Rest, TLS Offload, CMK, custom |Lift and shift, PKCS#11, TLS Offload, TDE, code signing | Payment PIN processes, custom |
58
58
| Do you want **HSM hardware protection**? | No | Yes | Yes | Yes | Yes |
59
59
| What is your **budget**? | $ | $$ | $$$ | $$$ | $$$$ |
60
60
| Who takes responsibility for **patching and maintenance**? | Microsoft | Microsoft | Microsoft | Microsoft | Customer |
61
-
| Who takes responsibility for **service health and hardware failover**? | Microsoft | Microsoft | Shared |Shared| Customer |
62
-
| What kind of **objects** are you using? | Asym Keys, Secrets, Certs | Asym Keys, Secrets, Certs | Asym/Sym Keys | Asym/Sym Keys, Certs| Local Master Key |
61
+
| Who takes responsibility for **service health and hardware failover**? | Microsoft | Microsoft | Shared |Microsoft| Customer |
62
+
| What kind of **objects** are you using? | Asym Keys, Secrets, Certs | Asym Keys, Secrets, Certs | Asym/Sym Keys | Asym/Sym Keys | Local Master Key |
63
63
|**Root of trust control**| Microsoft | Microsoft | Customer | Customer | Customer |
64
64
65
65
## Common key management solution uses by industry segments
@@ -68,20 +68,21 @@ Here is a list of the key management solutions we commonly see being utilized ba
68
68
69
69
|**Industry**|**Suggested Azure solution**|**Considerations for suggested solutions**|
70
70
| --- | --- | --- |
71
-
| I am an enterprise or an organization with strict security and compliance requirements (ex: banking, government, highly regulated industries). | Azure Key Vault Managed HSM, Azure Dedicated HSM | Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 compliance, and it is a PCI compliant solution for ecommerce. It supports encryption for PCI DSS 4.0. It provides HSM backed keys and gives customers key sovereignty and single tenancy. Azure Dedicated HSM provides FIPS 140-2 Level 3 compliance, customer ownership of HSM clusters, and support for PKCS#11 and other standard APIs for cryptographic operations. |
72
-
| I am a direct-to-consumer ecommerce merchant who needs to store, process, and transmit my customers' credit cards to my external payment processor/gateway and looking for a PCI compliant solution. | Azure Key Vault Managed HSM | Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 compliance, and it is a PCI compliant solution for ecommerce. It supports encryption for PCI DSS 4.0. It provides HSM backed keys and gives customers key sovereignty and single tenancy. |
71
+
| I am an enterprise or an organization with strict security and compliance requirements (ex: banking, government, highly regulated industries). | Azure Key Vault Managed HSM| Azure Key Vault Managed HSM provides FIPS 140-3 Level 3 compliance, and it is a PCI compliant solution for ecommerce. It supports encryption for PCI DSS 4.0. It provides HSM backed keys and gives customers key sovereignty and single tenancy. |
72
+
| I am a direct-to-consumer ecommerce merchant who needs to store, process, and transmit my customers' credit cards to my external payment processor/gateway and looking for a PCI compliant solution. | Azure Key Vault Managed HSM | Azure Key Vault Managed HSM provides FIPS 140-3 Level 3 compliance, and it is a PCI compliant solution for ecommerce. It supports encryption for PCI DSS 4.0. It provides HSM backed keys and gives customers key sovereignty and single tenancy. |
73
73
| I am a service provider for financial services, an issuer, a card acquirer, a card network, a payment gateway/PSP, or 3DS solution provider looking for a single tenant service that can meet PCI and multiple major compliance frameworks. | Azure Payment HSM | Azure Payment HSM provides FIPS 140-2 Level 3, PCI HSM v3, PCI DSS, PCI 3DS, and PCI PIN compliance. It provides key sovereignty and single tenancy, common internal compliance requirements around payment processing. Azure Payment HSM provides full payment transaction and PIN processing support. |
74
74
| I am an early-stage startup customer looking to prototype a cloud-native application. | Azure Key Vault Standard | Azure Key Vault Standard provides software-backed keys at an economy price. |
75
75
| I am a startup customer looking to produce a cloud-native application. | Azure Key Vault Premium, Azure Key Vault Managed HSM | Both Azure Key Vault Premium and Azure Key Vault Managed HSM provide HSM-backed keys* and are the best solutions for building cloud native applications. |
76
-
| I am an IaaS customer wanting to move my application to use Azure VM/HSMs. | Azure Dedicated HSM | Azure Dedicated HSM supports SQL IaaS customers. It is the only solution that supports PKCS11 and custom noncloud native applications. |
76
+
| I am an IaaS customer wanting to move my application to use Azure VM/HSMs. | Azure Cloud HSM | Azure Key Vault Managed HSM supports IaaS scenarios and provides FIPS 140-3 Level 3 compliance with key sovereignty. Azure Cloud HSM is ideal for lift-and-shift scenarios requiring PKCS#11 support, such as migrating from on-premises HSMs, Azure Dedicated HSM, or AWS CloudHSM. |
77
77
78
78
For detailed information about each Azure key management solution, including technical specifications and use cases, see [Key management in Azure](key-management.md).
0 commit comments