Estimated read: ~4 minutes
Confidential computing has become foundational to how regulated and sovereign organizations run their most sensitive workloads. Today, we're excited to announce that Confidential Virtual Machines on Azure Local are available in public preview — bringing hardware-based memory encryption and attestation to customer-owned, customer-managed edge infrastructure.
This is a milestone for organizations that can't move their most sensitive workloads to the public cloud, and it's especially important for our sovereign AI customers.
Why confidential computing on customer-managed infrastructure matters
Azure Local runs on infrastructure that customers own and operate, often inside their own datacenters, on-premises facilities, or sovereign boundaries. That control is exactly why customers choose it. But it also raises a hard question: how do you protect data-in-use when the workload runs on hardware that many people can physically or administratively touch?
Encryption at rest and in transit are table stakes. The gap has always been data while it is being processed - decrypted and sitting in memory. Confidential VMs on Azure Local close that gap. Using AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging), workload memory is hardware-encrypted and cryptographically isolated from the hypervisor, host OS, and management stack. The result: even the host administrators and on-prem datacenter personnel are removed from the trusted computing boundary.
For sovereign AI customers, this is transformative. It means proprietary models and sensitive inference data can run on infrastructure inside a sovereign border while remaining protected — even from the operators managing that infrastructure. Data sovereignty and operator isolation, together, on hardware you control.
What you get with Confidential Virtual Machines on Azure Local
The capabilities that Confidential VMs bring on Azure local are:
- Guest memory isolation: Hardware-encrypted memory (AMD SEV-SNP) ensures workload memory is cryptographically isolated from the host environment.
- Disk integrity protection: Customers choose how to secure their guest OS images. Microsoft has provided guidance on how to create an optimally hardened image that can be used to also enable guest OS disk integrity protection for Confidential VMs. We recommend enabling disk integrity protection to help prevent unauthorized changes to the guest OS, boot files, and operating environment.
- Hardware-rooted attestation: Platform firmware measurements are bound to workload integrity, so secrets and keys are released only after a workload proves it is genuine and untampered.
- Remote attestation with MAA for Secure Key Release: Confidential VMs generate hardware-rooted attestation reports validated by Microsoft Azure Attestation (MAA) to issue tokens for secure key release via Azure Key Vault (AKV).
The design favors sensitive workloads with a minimal Trusted Computing Base (TCB): the workload boots, is designed to show its integrity by fetching secrets via secure key release and processes data entirely in encrypted RAM. This keeps the security boundary tight and horizontal scaling simple — deploy as many identical instances as you need, each independently attesting at startup.
Real-world scenarios
- Intellectual property protection — Deploy proprietary algorithms or AI models on customer edge infrastructure with cryptographic assurance against extraction or reverse engineering. Models only unlock through attestation.
- Data sovereignty — Run critical systems (for example, visa processing or diplomatic workloads) in foreign or shared territories, with data-access keys kept under home-country control.
- Multi-party computation — Let multiple parties collaborate on sensitive data — fraud detection across banks, supply-chain validation — without exposing their proprietary records to one another.
- Compliance and breach-liability reduction — Attestation reports provide documentary, verifiable evidence that data was processed inside a tamper-resistant environment, limiting liability in the event of a breach.
How you build and deploy a Confidential Virtual Machines
The end-to-end flow is designed for a clean-room, image-driven model:
What's supported today
This first public preview focuses on getting the security foundation right:
- AMD Gen 4 EPYC processors with SEV-SNP Technology
- OEMs Supported: Validated on Lenovo machines (ThinkAgile MX455 V3 Edge PR) & HPE machines (ProLiant DL 145 Gen 11)
- Linux guests: Ubuntu 24.04 via the integrity-protected image script. Windows guest support is not yet available.
- Cloud connectivity required for attestation (MAA) and secure key release (AKV).
- Clean-room image preparation and ephemeral workloads.
Looking ahead, we plan to expand hardware support to Intel TDX, add managed image provisioning, and broaden guest OS and management capabilities.
Get started
Confidential Virtual Machines on Azure Local give you the confidential guarantees of Azure's confidential computing platform - on infrastructure you own and control. For sovereign, regulated, and edge-AI scenarios, that combination is a genuine unlock.
Explore the MS Learn documentation to deploy a CVM-ready cluster, build your first integrity-protected image, and run your workload with hardware-rooted attestation. We can't wait to see what you build. We’re also sharing the Confidential Virtual Machine for Azure Local - Interest and Readiness Survey and would appreciate your participation. Your feedback will help us build a better product together.
Microsoft