Announcing the general availability of Azure Integrated Hardware Security Module

Today we are excited to release general availability for Azure Integrated HSM for AMD v7 Virtual Machines. Azure Integrated HSM is a hardware security module (HSM) cache and crypto offload designed to enhance the security and performance of cryptographic operations in virtual machines.  For customers who heavily rely on cryptography and have performance-intensive workloads, Azure Integrated HSM provides a secure hardware-backed way to store cryptographic keys for fast and secure usage. This feature is available in select AMD D and E series v7 sizes for Trusted Launch VMs.

Azure Integrated HSM is designed to meet the Federal Information Processing Standards (FIPS) 140-3 Level 3 security requirements for cryptographic modules. Azure Integrated HSM eliminates network roundtrips for key operations and avoids the need to release keys into the workload environment. Instead of relying on remote access, the Azure Integrated HSM is securely bound to the local workload and provides oracle-style key usage to authorized services within the local environment.

We are now introducing support for Secure Key Release (SKR) with Azure Integrated HSM. Customers can take their keys in Azure Key Vault or Managed HSM and securely release them into Azure Integrated HSM after the platform is verified as trusted. The key material remains protected within the FIPS 140‑3 validated hardware boundary and is not exposed to guest VM memory.  With this model customers no longer need to make remote calls to Azure Key Vault or Managed HSM for every cryptographic operation. This way keys are securely released and cached directly on the Azure Integrated HSM device for fast, local use while in a FIPS‑validated boundary.

Why should I use Azure Integrated HSM?

Customer Profile 1: I am a customer running a latency‑sensitive, cryptographic operation heavy workload

A customer running crypto‑intensive workloads uses Secure Key Release (SKR) to keep their primary keys stored in Azure Key Vault or Managed HSM, but releases a copy into Azure Integrated HSM at runtime. Once securely released, cryptographic operations are performed directly on the Azure Integrated HSM device thus eliminating repeated network calls to the Azure Key Vault and improving latency for high‑throughput signing and encryption workloads.

Example customers:

• Financial services signing and encryption
  • Payment processing, trading, and secure messaging systems perform frequent cryptographic signing and encryption with strict latency and security requirements.
• High‑frequency TLS termination / certificate operations
  • Store private keys on the node and perform TLS signing operations directly in hardware, eliminating per request network calls to Azure Key Vault or Managed HSM this reducing tail latency.

Customer Profile 2: I am a customer that wants to store my key in my own private HSM but want to “Bring‑Your‑Own‑Key (BYOK)” to my Azure VM

A customer with strict key‑ownership requirements generates or holds their key outside Azure and uses Azure Integrated HSM to obtain an attested public wrapping key. They can wrap the key, then securely import it into the Azure Integrated HSM device where it is unwrapped and used only inside device’s FIPS 140-3 level 3 validated hardware boundary, ensuring the key is not exposed in the clear and remains under customer control throughout the process.‑

Example customers:

• Compliance‑driven regulated workloads
  • Government and regulated industry workloads require FIPS 140‑3 Level 3 key protection without compromising performance.

Benefits of AziHSM

• Lower latency for cryptographic operations by reducing network round‑trips to Azure Key Vault or Managed HSM and performing crypto locally on the same node as the VM.
• Keys stored in Azure Integrated HSM are not exposed in clear text and will remain in a FIPS 140‑3 Level 3 HSM boundary
• Protection against memory and crash‑dump attacks
• Built into Azure infrastructure with an Azure Integrated HSM attached to each supported node
• No additional cost

Availability

Azure Integrated HSM is now available to use on the AMD v7 generally available platform in all the AMD v7 supported regions. This is supported for the general purpose Dasv7-series, Dalsv7-series, Dadsv7-series, Easv7-series, and Eadsv7-series for 8 vCores and above for Trusted Launch VMs. The Azure Integrated HSM general availability is for Windows support only, with Linux support coming soon. This feature will be offered at no additional cost.

Please see documentation on how to get started here: Azure Integrated HSM Overview | Microsoft Learn and How to deploy a Virtual Machine with Azure Integrated HSM enabled | Microsoft Learn. Customers can also check out our GitHub repository with customer samples and instructions on how to use Azure Integrated HSM.