You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Best Practices for Securing Microsoft Azure Cloud HSM
3
-
description: Learn the best practices for securing and managing Microsoft Azure Cloud HSM to help protect cryptographic keys and sensitive workloads.
2
+
title: Secure your Azure Cloud HSM deployment
3
+
description: Learn best practices for securing Azure Cloud HSM to help protect cryptographic keys and sensitive workloads.
4
4
author: msmbaldwin
5
5
ms.service: azure-cloud-hsm
6
-
ms.topic: best-practice
7
-
ms.date: 09/26/2025
6
+
ms.topic: conceptual
7
+
ms.date: 03/31/2026
8
8
ai-usage: ai-assisted
9
9
ms.custom: horz-security
10
10
ms.author: mbaldwin
@@ -14,99 +14,87 @@ ms.author: mbaldwin
14
14
15
15
# Secure your Azure Cloud HSM deployment
16
16
17
-
Microsoft Azure Cloud HSM provides a high-assurance hardware security module (HSM) solution for protecting cryptographic keys and securing sensitive workloads in the cloud. Implementing security best practices is essential to prevent unauthorized access, maintain operational integrity, and optimize performance.
17
+
Azure Cloud HSM provides a high-assurance hardware security module (HSM) solution for protecting cryptographic keys and securing sensitive workloads in the cloud. Implementing security best practices is essential to prevent unauthorized access, maintain operational integrity, and optimize performance.
18
18
19
-
This article provides guidance on how to best secure your Cloud HSM deployment.
19
+
This article provides security recommendations to help protect your Azure Cloud HSM deployment.
20
20
21
-
## Security and compliance
21
+
[!INCLUDE [Security horizontal Zero Trust statement](~/reusable-content/ce-skilling/azure/includes/security/zero-trust-security-horizontal.md)]
22
22
23
-
-**Protect root of trust**: We advise customers to limit access to the Partition Owner of the Application Partition (POTA) private key (`PO.key`). The Admin of the Application Partition (AOTA) and POTA private keys are equivalent to root access. They can reset passwords for cryptography officer (CO) users in a partition (AOTA for partition 0, POTA for user partitions).
23
+
## Service-specific security
24
24
25
-
`PO.key` is unnecessary for HSM access during runtime. It's required only for the initial signing of Partition Owner Authentication Certificate (POAC) and CO password resets. We recommend storing `PO.key` offline and performing the initial POAC signing on an offline machine, if possible.
25
+
Azure Cloud HSM is a single-tenant, FIPS 140-3 Level 3 validated service that grants customers complete administrative authority over their HSMs. Protecting the root of trust is critical to maintaining the security of your deployment.
26
26
27
-
> [!IMPORTANT]
28
-
> Customers are accountable for safeguarding their POTA private key. Losing the POTA private key results in the inability to recover CO passwords. We advise customers to securely store their POTA private key and maintain suitable backups.
27
+
-**Restrict access to the Partition Owner private key**: Limit access to the Partition Owner of the Application Partition (POTA) private key (`PO.key`). The Admin of the Application Partition (AOTA) and POTA private keys are equivalent to root access and can reset passwords for cryptography officer (CO) users in a partition (AOTA for partition 0, POTA for user partitions). `PO.key` is unnecessary for HSM access during runtime. It's required only for the initial signing of Partition Owner Authentication Certificate (POAC) and CO password resets. Store `PO.key` offline and perform the initial POAC signing on an offline machine, if possible. Customers are accountable for safeguarding their POTA private key — losing it results in the inability to recover CO passwords. Securely store the POTA private key and maintain suitable backups. See [User management in Azure Cloud HSM](user-management.md).
29
28
30
-
## Network security
29
+
## Network security
31
30
32
-
Ensuring strong network security is essential when you're using Azure Cloud HSM. Properly configuring your network can help prevent unauthorized access and reduce exposure to external threats. For more information, see [Network security for Azure Cloud HSM](network-security.md).
31
+
Properly configuring your network can help prevent unauthorized access and reduce exposure to external threats.
33
32
34
-
-**Use private endpoints**: Help secure your Azure Cloud HSM deployment by using private subnets and private endpoints to prevent exposure to the public internet. This action ensures that traffic remains within the Microsoft backbone network, which reduces the risk of unauthorized access.
33
+
-**Use private endpoints**: Help secure your Azure Cloud HSM deployment by using private subnets and private endpoints to prevent exposure to the public internet. This approach ensures that traffic remains within the Microsoft backbone network, which reduces the risk of unauthorized access. See [Network security for Azure Cloud HSM](network-security.md).
35
34
36
-
## User management
35
+
## Identity and access management
37
36
38
-
Effective user management is crucial for maintaining the security and integrity of Azure Cloud HSM. Implementing proper controls for user identities, credentials, and permissions can help prevent unauthorized access and ensure operational continuity. For more information, see [User management in Azure Cloud HSM](user-management.md).
37
+
Effective user management and authentication controls are crucial for maintaining the security and integrity of Azure Cloud HSM. Implementing proper controls for user identities, credentials, and permissions can help prevent unauthorized access and ensure operational continuity.
39
38
40
-
-**Use strong passwords**: Create unique, strong passwords for HSM users. Use at least 12 characters, including a mix of uppercase and lowercase letters, numbers, and special characters.
39
+
-**Use strong passwords**: Create unique, strong passwords for HSM users. Use at least 12 characters, including a mix of uppercase and lowercase letters, numbers, and special characters. See [User management in Azure Cloud HSM](user-management.md#use-strong-passwords).
41
40
42
-
-**Secure your HSM user credentials**: Protect your HSM user credentials carefully, because Microsoft can't recover them if they're lost.
41
+
-**Secure your HSM user credentials**: Protect your HSM user credentials carefully, because Microsoft can't recover them if they're lost. See [User management in Azure Cloud HSM](user-management.md#secure-your-hsm-user-credentials).
43
42
44
-
-**Implement secondary admins for lockout prevention**: Designate at least two administrators to prevent HSM lockout in case one password is lost.
43
+
-**Implement secondary admins for lockout prevention**: Designate at least two administrators to prevent HSM lockout in case one password is lost. See [User management in Azure Cloud HSM](user-management.md#implement-secondary-admins-for-lockout-prevention).
45
44
46
-
-**Establish multiple cryptography users (CUs) with restricted permissions**: Create multiple CUs with distinct responsibilities to prevent any single user from having full control.
45
+
-**Establish multiple cryptography users (CUs) with restricted permissions**: Create multiple CUs with distinct responsibilities to prevent any single user from having full control. See [User management in Azure Cloud HSM](user-management.md#establish-multiple-cryptography-users-with-restricted-permissions).
47
46
48
-
-**Limit the ability of CUs to export keys**: Restrict CUs from exporting key material by setting appropriate user attributes.
47
+
-**Limit the ability of CUs to export keys**: Restrict CUs from exporting key material by setting appropriate user attributes. See [User management in Azure Cloud HSM](user-management.md#limit-the-ability-of-cryptography-users-to-export-keys).
49
48
50
-
-**Limit CO control over CUs**: Use the `disableUserAccess` command to prevent CO users from managing specific CUs. However, CO users can bypass this command with older backups.
49
+
-**Limit CO control over CUs**: Use the `disableUserAccess` command to prevent CO users from managing specific CUs. CO users can bypass this command with older backups. See [User management in Azure Cloud HSM](user-management.md#limit-cryptography-officer-control-over-cryptography-users).
51
50
52
-
## Key management
51
+
-**Configure managed identities**: Establish user-assigned managed identities for backup and restore operations and for VMs that perform administrative actions. See [User management in Azure Cloud HSM](user-management.md#establish-a-user-managed-identity).
53
52
54
-
Effective key management is critical for optimizing the performance, security, and efficiency of Azure Cloud HSM. Proper handling of key storage limits, key wrapping security, key attributes, and caching strategies can improve protection and performance. For more information, see [Key management in Azure Cloud HSM](key-management.md).
53
+
-**Securely store HSM credentials**: Protect stored credentials and avoid exposing them when they're not in use. Configure your environment to retrieve and set credentials automatically. See [Authentication in Azure Cloud HSM](authentication.md).
55
54
56
-
-**Implement key rotation**: Regularly rotate keys to replace older ones and free up storage while maintaining security.
55
+
-**Use implicit login for JCE authentication**: Whenever possible, use implicit login for Java Cryptography Extension (JCE) authentication to allow automatic credential management and reauthentication. See [Authentication in Azure Cloud HSM](authentication.md#jce-authentication).
57
56
58
-
-**Use a key hierarchy**: Store fewer keys in the HSM by using master keys to encrypt other keys.
57
+
-**Avoid sharing sessions across threads**: For multithreaded applications, assign each thread its own session to prevent conflicts and security issues. See [Authentication in Azure Cloud HSM](authentication.md#multithreading-techniques).
59
58
60
-
-**Share and reuse keys when feasible**: Reduce storage requirements by sharing or reusing keys across multiple sessions when appropriate.
59
+
-**Implement client-side retries**: Add retry logic for HSM operations to handle potential maintenance events or HSM replacements. See [Authentication in Azure Cloud HSM](authentication.md#retries-for-integration-of-hsm-operations).
61
60
62
-
-**Securely delete unused keys**: Remove keys that you longer need, to prevent unnecessary storage consumption.
61
+
-**Manage HSM client sessions carefully**: Be aware that `azurecloudhsm_client` shares sessions across applications on the same host. Proper session management avoids conflicts. See [Authentication in Azure Cloud HSM](authentication.md#cloud-hsm-client-session-handling).
63
62
64
-
-**Set keys as non-extractable when possible**: Use `EXTRACTABLE=0` to ensure that keys can't be exported outside the HSM.
63
+
## Data protection
65
64
66
-
-**Enable trusted key wrapping**: Use `WRAP_WITH_TRUSTED=1` to restrict key wrapping to trusted keys. This action prevents unauthorized key exports.
65
+
Proper handling of key storage limits, key wrapping security, key attributes, and caching strategies can improve protection and performance.
67
66
68
-
-**Use key attributes to restrict permissions**: Assign only necessary attributes when you're generating keys, to limit unintended operations.
67
+
-**Implement key rotation**: Regularly rotate keys to replace older ones and free up storage while maintaining security. See [Key management in Azure Cloud HSM](key-management.md#manage-the-key-storage-limit).
69
68
70
-
## Authentication
69
+
-**Use a key hierarchy**: Store fewer keys in the HSM by using master keys to encrypt other keys. See [Key management in Azure Cloud HSM](key-management.md#manage-the-key-storage-limit).
71
70
72
-
Authentication is a crucial aspect of securely accessing and operating within Azure Cloud HSM. Proper authentication methods help protect credentials and ensure secure access control. For more information, see [Authentication in Azure Cloud HSM](authentication.md).
71
+
-**Share and reuse keys when feasible**: Reduce storage requirements by sharing or reusing keys across multiple sessions when appropriate. See [Key management in Azure Cloud HSM](key-management.md#manage-the-key-storage-limit).
73
72
74
-
-**Securely store HSM credentials**: Protect stored credentials and avoid exposing them when they're not in use. Configure your environment to retrieve and set credentials automatically.
73
+
-**Securely delete unused keys**: Remove keys that you no longer need, to prevent unnecessary storage consumption. See [Key management in Azure Cloud HSM](key-management.md#manage-the-key-storage-limit).
75
74
76
-
-**Use implicit login for Java Cryptography Extension (JCE) authentication**: Whenever possible, use implicit login for JCE authentication to allow automatic credential management and reauthentication.
75
+
-**Set keys as nonextractable when possible**: Use `EXTRACTABLE=0` to ensure that keys can't be exported outside the HSM. See [Key management in Azure Cloud HSM](key-management.md#manage-key-wrapping).
77
76
78
-
-**Avoid sharing sessions across threads**: For multithreaded applications, assign each thread its own session to prevent conflicts and security issues.
77
+
-**Enable trusted key wrapping**: Use `WRAP_WITH_TRUSTED=1` to restrict key wrapping to trusted keys. This action prevents unauthorized key exports. See [Key management in Azure Cloud HSM](key-management.md#manage-key-wrapping).
79
78
80
-
-**Implement client-side retries**: Add retry logic for HSM operations to handle potential maintenance events or HSM replacements.
79
+
-**Use key attributes to restrict permissions**: Assign only necessary attributes when you're generating keys, to limit unintended operations. See [Key management in Azure Cloud HSM](key-management.md#employ-key-attributes-to-manage-key-permissions).
81
80
82
-
-**Manage HSM client sessions carefully**: Be aware that `azurecloudhsm_client` shares sessions across applications on the same host. Proper session management avoids conflicts.
81
+
-**Cache key objects for performance**: Use key-finding commands only once during application startup and store the returned key object in application memory to reduce latency. See [Key management in Azure Cloud HSM](key-management.md#optimize-latency-by-caching-key-objects).
83
82
84
-
## Monitoring and logging
83
+
## Logging and monitoring
85
84
86
-
-**Monitor audit and operations logs**: We recommend that you configure operation event logging. Operation event logging is vital for HSM security. It provides an immutable record of access and operations for accountability, traceability, and regulatory compliance. It helps detect unauthorized access, investigate incidents, and identify anomalies, to help ensure the integrity and confidentiality of cryptographic operations.
85
+
-**Configure operation event logging**: Operation event logging is vital for HSM security. It provides an immutable record of access and operations for accountability, traceability, and regulatory compliance. It helps detect unauthorized access, investigate incidents, and identify anomalies, to help ensure the integrity and confidentiality of cryptographic operations. To maintain security and privacy, logs exclude sensitive data (such as key IDs, key names, and user details). They capture HSM operations, timestamps, and metadata, but they can't determine success or failure because the HSM operation occurs within the inner TLS channel. See [Tutorial: Operation event logging in Azure Cloud HSM](tutorial-operation-event-logging.md).
87
86
88
-
To maintain security and privacy, logs exclude sensitive data (such as key IDs, key names, and user details). They capture HSM operations, time stamps, and metadata, but they can't determine success or failure. They can only log the fact that the operation was executed. This limitation exists because the HSM operation occurs within the inner TLS channel, which is not exposed outside that boundary.
87
+
## Backup and recovery
89
88
90
-
## Business continuity and disaster recovery
89
+
Azure Cloud HSM provides high availability through clustered HSMs that synchronize keys and policies while automatically migrating workloads during failures.
91
90
92
-
-**Implement robust backup and disaster recovery**: Azure Cloud HSM provides high availability through clustered HSMs that synchronize keys and policies while automatically migrating workloads during failures. The service supports comprehensive backup and restore operations that preserve all keys, attributes, and role assignments. Backups are secured by HSM-derived keys that Microsoft can't access.
91
+
-**Implement robust backup and disaster recovery**: The service supports comprehensive backup and restore operations that preserve all keys, attributes, and role assignments. Backups are secured by HSM-derived keys that Microsoft can't access. Azure Cloud HSM doesn't support restoring to already activated HSMs. For business continuity, use managed identities for authentication, store backups in private Azure Blob Storage, implement minimal role-based access control (RBAC) permissions, and disable shared key access. Additional recovery options include using `extractMaskedObject` to extract keys as encrypted blobs, storing them securely, and importing them with `insertMaskedObject` as needed. Deploy in two regions for failover capability. See [Back up and restore Azure Cloud HSM resources](backup-restore.md).
93
92
94
-
For business continuity and disaster recovery (BCDR):
93
+
-**Verify user and key synchronization across all nodes**: Azure Cloud HSM operates as a cluster of three nodes. During service events such as self-healing or upgrades, users or keys might not be replicated to all nodes. If you experience intermittent authentication or operation failures, verify that all users and keys exist on every node. See [Synchronize users and keys across Azure Cloud HSM nodes](synchronize-users-keys.md).
95
94
96
-
- Use managed identities for authentication.
97
-
- Store backups in private Azure Blob Storage.
98
-
- Implement minimal role-based access control (RBAC) permissions.
99
-
- Disable shared key access.
100
-
101
-
> [!NOTE]
102
-
> Azure Cloud HSM doesn't support restoring to already activated HSMs.
103
-
104
-
For detailed implementation instructions and additional recovery options, see [Backup and restore in Azure Cloud HSM](backup-restore.md). Additional recovery options include using `extractMaskedObject` to extract keys as encrypted blobs, storing them securely, and importing them with `insertMaskedObject` as needed. A BCDR best practice is to deploy in two regions for failover capability.
105
-
106
-
-**Verify user and key synchronization across all nodes**: Azure Cloud HSM operates as a cluster of three nodes. During service events such as self-healing or upgrades, users or keys might not be replicated to all nodes. If you experience intermittent authentication or operation failures, verify that all users and keys exist on every node. For verification and remediation steps, see [Synchronize users and keys across Azure Cloud HSM nodes](synchronize-users-keys.md).
107
-
108
-
## Related content
95
+
## Next steps
109
96
110
97
-[Security best practices for IaaS workloads in Azure](/azure/security/fundamentals/iaas)
111
-
-[Enable just-in-time access to virtual machines](/azure/defender-for-cloud/just-in-time-access-usage)
98
+
-[Enable just-in-time access to virtual machines](/azure/defender-for-cloud/just-in-time-access-overview)
112
99
-[Adopt a Zero Trust approach](/azure/security/fundamentals/network-best-practices#adopt-a-zero-trust-approach)
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments