Skip to content

Commit d0871a4

Browse files
v-shilsv-shils
authored
Merge pull request #310801 from EldertGrootenboer/acc
Add Service Bus confidential computing documentation and enhance IaC templates
2 parents 42fe1de + b5bc2a1 commit d0871a4

17 files changed

Lines changed: 1304 additions & 439 deletions

‎articles/service-bus-messaging/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,8 @@
178178
href: ./security-controls-policy.md
179179
- name: Network security
180180
href: network-security.md
181+
- name: Confidential computing
182+
href: confidential-computing.md
181183
- name: Network security perimeter
182184
href: network-security-perimeter.md
183185
- name: Integration with other services

‎articles/service-bus-messaging/confidential-computing.md‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
---
2+
title: Azure Service Bus with confidential computing
3+
description: Learn how to enable confidential computing on Azure Service Bus Premium namespaces to protect data in use with hardware-based trusted execution environments.
4+
ms.topic: conceptual
5+
ms.date: 01/22/2026
6+
ms.service: azure-service-bus
7+
author: EldertGrootenboer
8+
ms.author: egrootenboer
9+
# Customer intent: As a security administrator or developer, I want to enable confidential computing on Azure Service Bus to protect sensitive messaging data in use with hardware-based isolation.
10+
---
11+
12+
# Azure Service Bus confidential computing overview
13+
14+
Azure Service Bus Premium supports [confidential computing](../confidential-computing/overview.md) to protect your messaging data in use. Confidential computing uses hardware-based trusted execution environments (TEEs) to provide enhanced data protection, preventing unauthorized access to your messages while they're being processed.
15+
16+
When you enable confidential computing on a Service Bus Premium namespace, your data benefits from hardware-level isolation in addition to existing encryption at rest and in transit. This capability helps organizations that handle sensitive or regulated data meet strict security and compliance requirements.
17+
18+
## Benefits
19+
20+
Confidential computing for Azure Service Bus provides the following advantages:
21+
22+
- **No code changes required**: Enable confidential computing at the namespace level without modifying your applications or messaging patterns.
23+
- **Defense in depth**: Combines with existing Service Bus security features like [customer-managed keys](configure-customer-managed-key.md), [private endpoints](private-link-service.md), and [managed identities](service-bus-managed-service-identity.md).
24+
- **Messaging-specific protection**: Your queues, topics, and subscriptions benefit from hardware-level isolation during message processing.
25+
26+
## Regional availability
27+
28+
Confidential computing for Azure Service Bus is available in select regions.
29+
30+
| Region |
31+
|--------|
32+
| Korea Central |
33+
| UAE North |
34+
35+
## Limitations
36+
37+
The following limitations apply to confidential computing for Azure Service Bus:
38+
39+
- Confidential computing is available only on the **[Premium tier](service-bus-premium-messaging.md)**.
40+
- You must enable confidential computing during namespace creation. You can't enable it on existing namespaces.
41+
42+
## Enable confidential computing by using the Azure portal
43+
44+
1. Go to the [Azure portal](https://portal.azure.com) and open the Service Bus namespace creation page.
45+
46+
1. Select **Premium** for the pricing tier.
47+
48+
1. Select a [supported region](#regional-availability) as the location.
49+
50+
1. For **Confidential compute**, select **Enabled**.
51+
52+
:::image type="content" source="./media/confidential-computing/enable-confidential-computing-portal.png" alt-text="Screenshot showing the Create namespace page with the Confidential compute toggle enabled.":::
53+
54+
1. Fill in the remaining required fields for your namespace configuration.
55+
56+
1. Select **Review + create**, and then select **Create** to deploy the namespace with confidential computing enabled.
57+
58+
## Enable confidential computing by using a template
59+
60+
You can enable confidential computing programmatically by including the `platformCapabilities` property in your deployment template.
61+
62+
# [Bicep](#tab/bicep)
63+
64+
The following Bicep file creates a Service Bus Premium namespace with confidential computing enabled:
65+
66+
```bicep
67+
@description('Name of the Service Bus namespace')
68+
param namespaceName string
69+
70+
@description('Location for the namespace. Must be a region that supports confidential computing.')
71+
@allowed([
72+
'koreacentral'
73+
'uaenorth'
74+
])
75+
param location string = 'uaenorth'
76+
77+
resource serviceBusNamespace 'Microsoft.ServiceBus/namespaces@2025-05-01-preview' = {
78+
name: namespaceName
79+
location: location
80+
sku: {
81+
name: 'Premium'
82+
tier: 'Premium'
83+
capacity: 1
84+
}
85+
properties: {
86+
platformCapabilities: {
87+
confidentialCompute: {
88+
mode: 'Enabled'
89+
}
90+
}
91+
}
92+
}
93+
```
94+
95+
# [ARM template](#tab/arm)
96+
97+
The following ARM template creates a Service Bus Premium namespace with confidential computing enabled:
98+
99+
```json
100+
{
101+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
102+
"contentVersion": "1.0.0.0",
103+
"parameters": {
104+
"namespaceName": {
105+
"type": "string",
106+
"metadata": {
107+
"description": "Name of the Service Bus namespace"
108+
}
109+
},
110+
"location": {
111+
"type": "string",
112+
"defaultValue": "uaenorth",
113+
"allowedValues": [
114+
"koreacentral",
115+
"uaenorth"
116+
],
117+
"metadata": {
118+
"description": "Location for the namespace. Must be a region that supports confidential computing."
119+
}
120+
}
121+
},
122+
"resources": [
123+
{
124+
"type": "Microsoft.ServiceBus/namespaces",
125+
"apiVersion": "2025-05-01-preview",
126+
"name": "[parameters('namespaceName')]",
127+
"location": "[parameters('location')]",
128+
"sku": {
129+
"name": "Premium",
130+
"tier": "Premium",
131+
"capacity": 1
132+
},
133+
"properties": {
134+
"platformCapabilities": {
135+
"confidentialCompute": {
136+
"mode": "Enabled"
137+
}
138+
}
139+
}
140+
}
141+
]
142+
}
143+
```
144+
145+
---
146+
147+
## Combine confidential computing with customer-managed keys
148+
149+
For maximum data protection, combine confidential computing with [customer-managed keys](configure-customer-managed-key.md) backed by [Azure Key Vault Managed HSM](/azure/key-vault/managed-hsm/overview). This combination ensures that:
150+
151+
- Your data is protected in use by confidential computing.
152+
- Your encryption keys are stored in validated hardware security modules.
153+
- You maintain full control over your encryption keys.
154+
155+
## Use Azure Policy to enforce confidential computing
156+
157+
Create an Azure Policy definition to enforce that all Premium Service Bus namespaces in your organization have both confidential computing and customer-managed keys enabled. This approach ensures consistent security configuration across your Azure environment.
158+
159+
The following policy definition denies or audits the creation of Premium Service Bus namespaces that don't meet these security requirements:
160+
161+
```json
162+
{
163+
"mode": "All",
164+
"parameters": {
165+
"effect": {
166+
"type": "String",
167+
"metadata": {
168+
"displayName": "Effect",
169+
"description": "Deny or Audit"
170+
},
171+
"allowedValues": [
172+
"Deny",
173+
"Audit"
174+
],
175+
"defaultValue": "Deny"
176+
}
177+
},
178+
"policyRule": {
179+
"if": {
180+
"allOf": [
181+
{
182+
"field": "type",
183+
"equals": "Microsoft.ServiceBus/namespaces"
184+
},
185+
{
186+
"field": "Microsoft.ServiceBus/namespaces/sku.tier",
187+
"equals": "Premium"
188+
},
189+
{
190+
"anyOf": [
191+
{
192+
"anyOf": [
193+
{
194+
"not": {
195+
"field": "Microsoft.ServiceBus/namespaces/encryption.keySource",
196+
"equals": "Microsoft.KeyVault"
197+
}
198+
},
199+
{
200+
"not": {
201+
"field": "Microsoft.ServiceBus/namespaces/encryption.keyVaultProperties[*].keyVaultUri",
202+
"contains": ".managedhsm.azure.net/"
203+
}
204+
},
205+
{
206+
"anyOf": [
207+
{
208+
"field": "identity.type",
209+
"equals": "None"
210+
},
211+
{
212+
"field": "identity.type",
213+
"exists": false
214+
}
215+
]
216+
}
217+
]
218+
},
219+
{
220+
"not": {
221+
"field": "Microsoft.ServiceBus/namespaces/platformCapabilities.confidentialCompute.mode",
222+
"equals": "Enabled"
223+
}
224+
}
225+
]
226+
}
227+
]
228+
},
229+
"then": {
230+
"effect": "[parameters('effect')]"
231+
}
232+
}
233+
}
234+
```
235+
236+
To use this policy, create a custom policy definition in Azure Policy and assign it to the appropriate scope, such as a management group, subscription, or resource group.
237+
238+
> [!NOTE]
239+
> When combining confidential computing with customer-managed keys, use a user-assigned managed identity. This requirement exists because the identity must be granted access to the Managed HSM before creating the namespace. A system-assigned identity only exists after the namespace is created.
240+
241+
## Related content
242+
243+
- [What is confidential computing?](../confidential-computing/overview.md)
244+
- [Azure confidential computing products](../confidential-computing/overview-azure-products.md)
245+
- [Confidential computing use cases](../confidential-computing/use-cases-scenarios.md)
246+
- [Configure customer-managed keys for Azure Service Bus](configure-customer-managed-key.md)
247+
- [Azure Service Bus Premium messaging tier](service-bus-premium-messaging.md)
248+
- [Azure Key Vault Managed HSM](/azure/key-vault/managed-hsm/overview)

0 commit comments

Comments
 (0)