Secure Sensitive AI on Azure Confidential Computing with NVIDIA and Protopia
Your most valuable AI use cases often involve your most sensitive information: customer records, claims, clinical notes, and transaction histories. Dedicated infrastructure can offer control, but it can also limit access to flexible cloud capacity. The opportunity is to expand where that work can run without treating data protection as an afterthought. For a team exploring claims review or clinical-note analysis, the question is not simply whether a model can run in the cloud. It is where sensitive information could be exposed along the journey from application to model and back. Enterprises want to run their highest-value inference on the same scalable cloud they already run everything else on. The catch is that the highest-value inference is usually the most sensitive: customer records, claims and underwriting packets, clinical notes, transaction histories. Data policy keeps that work off shared, multi-tenant capacity and pins it to dedicated, single-tenant deployments. That is the isolation tax: the most valuable, most token-heavy workloads are exactly the ones kept off the infrastructure built to run them, so dedicated capacity sits underused and costs more than it should. Microsoft Foundry already gives this work an enterprise platform: a model catalog that now includes NVIDIA Nemotron, managed and serverless endpoints, and the governance regulated industries require. What has been missing is a way to run sensitive agentic workflows on that shared capacity while reducing the risk of data exposure. The trust dilemma on public cloud Azure Confidential Computing (ACC) addresses a fundamental trust challenge for AI workloads in multi-tenant cloud environments: the model, infrastructure, and data may each be owned or controlled by different parties. Model owners need to protect proprietary weights and intellectual property, and data owners need safeguards for sensitive information throughout processing. ACC provides the trusted foundation for addressing these requirements by helping protect models and their execution from unauthorized host access while enabling additional safeguards across the inference data path. The reference architecture brings together Azure Confidential Computing with NVIDIA H100 GPU capabilities and Protopia AI’s Stained Glass Transform to provide layered protection for sensitive AI workloads running at Azure scale. Confidential Computing: securing the model with NVIDIA Confidential Computing is designed to protect data and AI models while they are in use inside the enclave. The NVIDIA Hopper architecture introduced GPU-based confidential computing, extending the hardware trusted execution environment from the CPU to the GPU so that model weights, activations, and execution state remain within an attested boundary and are designed to be inaccessible to the host operating system, hypervisor, and infrastructure operator. NVIDIA device attestation provides cryptographic evidence about the GPU’s identity and security state before keys are released. For a model owner, these controls are designed to restrict access to model IP while the model runs. Enterprises should not have to choose between protecting their models and running them where compute is available and most convenient. NVIDIA has designed Confidential Computing to keep a model’s weights and execution within the GPU’s trusted execution environment, helping proprietary models run on shared infrastructure while limiting access to their IP. Combined with Protopia’s inference data protection on Azure, customers have a path designed to support sensitive AI workloads in the cloud they already trust. Bring confidential inference to Azure Azure brings confidential inference to production scale, surrounding the confidential GPU with the platform an enterprise needs to operate AI. The Azure NCCads H100 v5 series combines 4th-generation AMD EPYC confidential VMs with NVIDIA H100 Tensor Core GPUs to support confidential AI workloads. The trusted execution environment spans the AMD SEV-SNP CPU and the attached H100 in confidential mode, isolating GPU memory and the channel between CPU and GPU. When enabled and properly configured, Confidential Computing is designed to help limit access to unencrypted customer data within that boundary, including the cloud operator. Azure provides tools to help verify and operate the boundary: Microsoft Azure Attestation (MAA) can assess the confidential VM, while Azure Key Vault Managed HSM can be configured to release decryption keys after successful attestation. "Azure was the first cloud to bring Confidential Computing to NVIDIA H100 GPUs, so customers can protect their data in use, even from the cloud operator, while getting the performance they need for AI. Paired with Protopia’s Stained Glass Transform, this reference architecture protects data across the full inference path, helping regulated organizations bring their most sensitive agentic workloads to Azure.“ - Vikas Bhatia, Head of Product, Azure Confidential Computing, Microsoft Protecting the inference data path Confidential execution does not, by itself, cover every component of a managed inference service. Gateways, logs, traces, caches, and scheduler metadata can sit outside the trusted execution environment. Protopia AI’s Stained Glass Transform (SGT) converts sensitive inputs into protected representations inside the data owner’s trust boundary. The architecture is designed for downstream components to receive those representations, not the original inputs. An SGT-enabled model reasons over them directly, without a host-side decoder. Security teams should inspect the serving layer to verify that this pattern is implemented as intended. This distinction matters when reviewing a service: an attested GPU does not establish how a gateway or cache handles requests. Start with a map of the data flow, then check the controls at each boundary. “Sensitive AI should not automatically mean having to operate every part of the infrastructure yourself. Applying Stained Glass Transform inside the data owner's trust boundary, or within confidential execution on Azure, offers a way to securely deploy to the cloud without exposing sensitive data to the model hosting environment (other tenants or operator), and retaining the data owner's control over their sensitive enterprise data.” - Eiman Ebrahimi, Co-Founder and CEO, Protopia AI From customer boundary to confidential inference At the data owner’s trust boundary, the Stained Glass Proxy, an OpenAI-compatible sidecar, applies the Stained Glass Transform to the prompt and its context, with no changes to the upstream stack. In transit to Azure, the architecture sends the protected representation beyond the customer’s trust boundary rather than the original plaintext input, reducing the likelihood that sensitive plaintext is captured in downstream logs, caches, or interception points. In-transit encryption is used as standard. On Azure NCCads H100 v5 confidential VMs, the request reaches an SGT-enabled model endpoint. Configure and verify confidential execution, attestation, and key-release policies for the chosen serving stack. Across the serving path, verify that components outside the execution boundary handle protected representations rather than original sensitive inputs, including logs, caches, and traces. On return, the client receives a result intended to be interpretable within the data owner’s environment. Expand your options for sensitive AI For enterprises, the value comes down to expanding where sensitive AI workloads can run while maintaining strong protections for models and data. Azure Confidential Computing provides a trusted foundation for running sensitive AI workloads on Azure, helping protect models and data while in use and enabling organizations to take advantage of Azure’s scalable GPU infrastructure. Depending on the workload and deployment configuration, this approach may provide greater infrastructure flexibility and utilization while helping organizations manage performance, model quality, and cost. Learn more Azure Confidential GPU OptionsAnnouncing Live Migration for Confidential Computing
Today at Build, Microsoft showcased Live Migration for Confidential Computing, a new capability that helps move Intel® TDX Confidential VMs to updated infrastructure with limited-service interruption while helping protect VM memory and execution context during migration.Improve Campaign Reach and Measurement with Azure Confidential Clean Rooms
Why campaign performance now depends on trusted data collaboration For many years, third-party cookies helped advertisers, publishers, and measurement partners recognize users across parts of the open web. That model continues to evolve as browsers and mobile platforms introduce stronger privacy protections and limit access to certain cross-site and device-level identifiers. As a result, some advertisers and publishers are placing greater emphasis on the first-party data they collect directly to support audience activation and campaign measurement. Advertising partnerships may involve identifiers and behavioral data covered by privacy, data-protection, or industry rules. Data that has been altered to reduce direct identification—such as hashed email addresses or advertising identifiers—may still be linked to individuals and should not automatically be considered anonymous. Depending on the law and context, it may be treated as personally identifiable information (PII) or personal data under the European Union’s General Data Protection Regulation (GDPR). Organizations must have an appropriate legal basis and a clear purpose for using such data. The European Union’s Digital Markets Act (DMA) also affects how designated digital platforms combine certain personal data across services. In the United States, health information held by organizations covered by the Health Insurance Portability and Accountability Act (HIPAA) may be subject to additional restrictions, including for some marketing uses. The requirements for each collaboration depend on the parties, data, purpose, consent or authorization, and jurisdiction. Together, these changes create a practical challenge: campaign analysis increasingly depends on combining detailed records held by different organizations, but privacy, security, and governance obligations make unrestricted exchange of customer-level data difficult. Advertisers and publishers therefore need a controlled way to match audiences and measure outcomes using only authorized data—without exposing or freely sharing the underlying records. Azure Confidential Clean Rooms is designed to address this challenge. It allows each party’s detailed data to be used for an agreed analysis while helping protect raw data from access by other participants. This provides a controlled, verifiable environment for audience matching and campaign measurement without unrestricted file sharing. What campaign leaders should look for: the potential to broaden addressable audiences, strengthen evidence of campaign lift, reduce operational risk, and establish a repeatable model for trusted collaboration across media and measurement partners. Campaign decisions with secure multiparty analytics Azure Confidential Clean Rooms is a fully managed service that enables advertisers, publishers, agencies, and measurement partners to analyze sensitive datasets together while helping protect each participant’s raw data. The current preview supports analytics through Spark SQL queries agreed by the participants. These queries run in a hardware-protected environment called a Trusted Execution Environment (TEE), helping protect participants’ raw data from other collaborators and the Azure operator throughout its lifecycle. For a deeper explanation of the technology and architecture, see our earlier blog, Preview of multiparty analytics with Azure Confidential Clean Rooms. The following scenarios show how this model supports specific campaign decisions: Audience activation — Which high-value customers might this media partner reach? The advertiser contributes first-party customer data, such as securely transformed contact details, postal addresses, loyalty IDs, and purchase history. The publisher contributes its audience-matching data, on-site behavior, and consented interest or demographic segments. Azure Confidential Clean Rooms can compare identifiers that the participants have agreed to use for matching and release a reachable audience segment without exposing the underlying records. Campaign leaders can use the result to estimate potential reach and direct investment toward more relevant audiences. Identity enrichment — Can we improve match quality while protecting partner data? An agency or identity partner can contribute a third dataset to connect approved identifiers across email, mobile advertising IDs, devices, or households and add consented demographic or business attributes. Because the matching happens inside the confidential clean room, participants may improve match rates without exposing the identity partner’s underlying data or copying another party’s identifiers. Stronger matching can help expand reach and reduce media waste caused by fragmented customer identities. Measurement and attribution — Did the campaign contribute to additional business outcomes? The publisher contributes ad-exposure records, while the advertiser contributes outcomes such as purchases, order values, subscriptions, or app installs. Comparing these approved datasets can help measure unique reach and frequency, results across publishers, and the difference between groups that were and were not exposed to the campaign. For example, a retailer and a streaming publisher can compare exposure data with purchase outcomes to estimate campaign lift without revealing who saw a specific ad or made a purchase. This can give campaign leaders stronger evidence for campaign optimization and future budget allocation. These scenarios can help campaign leaders assess whether secure data collaboration may improve audience reach, matching quality, or confidence in campaign measurement. Why campaign leaders should consider Azure Confidential Clean Rooms The collaboration model is designed to give each participant greater control over how its data is accessed, used, and shared. Four capabilities are central to building trust among advertisers, publishers, agencies, and measurement partners: No centralized data pooling — Collaborators can keep source datasets in their own storage instead of copying them into a shared, permanent repository. The confidential environment verifies that expected code is running before it securely retrieves authorized data for temporary processing. This can reduce unnecessary data movement and exposure while supporting an approved analysis across partners. Controlled release of approved results — Before analysis begins, collaborators can agree which data may be used, approve the analysis, and specify who may receive the results. Safeguards can also prevent results for very small groups from being released, helping reduce the risk of identifying an individual. Verifiable governance and tamper-resistant audit trails — Participants can verify key properties of the environment instead of relying only on the clean-room provider’s claims. Open-source components and hardware-backed verification help participants confirm that the expected Microsoft-provided code is running. Tamper-resistant audit trails generated in the confidential environment can support compliance reviews. Data protection throughout the process — Each party can encrypt its data before it leaves its environment. Participants allow access to encryption keys only after the confidential environment verifies that expected code is running. Try Azure Confidential Clean Rooms Consider a campaign where better partner data could help improve audience reach, matching quality, or measurement confidence. Sign up to participate in a preview of multiparty analytics with Azure Confidential Clean Rooms. The Microsoft team will contact you to discuss the campaign scenario, participating datasets, and governance requirements. Learn more Sign-up: Preview of multiparty analytics with Azure Confidential Clean Rooms Preview blog: Multiparty analytics with Azure Confidential Clean Rooms Azure documentation: Confidential Clean RoomsGA: DCasv6 and ECasv6 confidential VMs based on 4th Generation AMD EPYC™ processors
Today, Azure has expanded its confidential computing offerings with the general availability of the DCasv6 and ECasv6 confidential VMs. Regional availability June 03 2026: Australia Central, Australia Central 2, Australia Southeast, Austria East, Belgium Central, Brazil South, Brazil Southeast, Central India, Central US, Chile Central, Denmark East, East Asia, East US, East US 2, France Central, India South Central, Indonesia Central, Israel Central, Japan East, Japan West, Korea South, Malaysia West, Mexico Central, New Zealand North, North Central US, North Europe, Poland Central, South Africa West, South Central US, South India, Southeast Asia, Spain Central, Sweden Central, Sweden South, Switzerland West, Taiwan North, UAE Central, UK West, West US 2 April 13 2026: West Europe Jan 30 2026: Canada Central, Canada East, Norway East, Norway West, Italy North, Germany North, France South, Australia East, West US, West US 3, Germany West Central Sep 16 2025: Korea Central, South Africa North, Switzerland North, UAE North, UK South, West Central US These VMs are powered by 4th generation AMD EPYC™ processors and feature advanced Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) technology. These confidential VMs offer: Hardware-rooted attestation Memory encryption in multi-tenant environments Enhanced data confidentiality Protection against cloud operators, administrators, and insider threats You can get started today by creating confidential VMs in the Azure portal as explained here. Highlights: 4th generation AMD EPYC processors with SEV-SNP 25% performance improvement over previous generation Ability to rotate keys online AES-256 memory encryption enabled by default Up to 96 vCPUs and 672 GiB RAM for demanding workloads Streamlined Security Organizations in certain regulated industries and sovereign customers migrating to Microsoft Azure need strict security and compliance across all layers of the stack. With Azure Confidential VMs, organizations can ensure the integrity of the boot sequence and the OS kernel while helping administrators safeguard sensitive data against advanced and persistent threats. The DCasv6 and ECasv6 family of confidential VMs support online key rotation to give organizations the ability to dynamically adapt their defenses to rapidly evolving threats. Additionally, these new VMs include AES-256 memory encryption as a default feature. Customers have the option to use Virtualization-Based Security (VBS) in Windows, which is currently in preview to protect private keys from exfiltration via the Guest OS or applications. With VBS enabled, keys are isolated within a secure process, allowing key operations to be carried out without exposing them outside this environment. Faster Performance In addition to the newly announced security upgrades, the new DCasv6 and ECasv6 family of confidential VMs have demonstrated up to 25% improvement in various benchmarks compared to our previous generation of confidential VMs powered by AMD. Organizations that need to run complex workflows like combining multiple private data sets to perform joint analysis, medical research or Confidential AI services can use these new VMs to accelerate their sensitive workload faster than ever before. "While we began our journey with v5 confidential VMs, now we’re seeing noticeable performance improvements with the new v6 confidential VMs based on 4th Gen AMD EPYC “Genoa” processors. These latest confidential VMs are being rolled out across many Azure regions worldwide, including the UAE. So as v6 becomes available in more regions, we can deploy AMD based confidential computing wherever we need, with the same consistency and higher performance." — Mohammed Retmi, Vice President - Sovereign Public Cloud, at Core42, a G42 company. "KT is leveraging Azure confidential computing to secure sensitive and regulated data from its telco business in the cloud. With new V6 CVM offerings in Korea Central Region, KT extends its use to help Korean customers with enhanced security requirements, including regulated industries, benefit from the highest data protection as well as the fastest performance by the latest AMD SEV-SNP technology through its Secure Public Cloud built with Azure confidential computing." — Woojin Jung, EVP, KT Corporation Kubernetes support Deploy resilient, globally available applications on confidential VMs with our managed Kubernetes experience - Azure Kubernetes Service (AKS). AKS now supports the new DCasv6 and ECasv6 family of confidential VMs, enabling organizations to easily deploy, scale and manage confidential Kubernetes clusters on Azure, streamlining developer workflows and reducing manual tasks with integrated continuous integration and continuous delivery (CI/CD) pipelines. AKS brings integrated monitoring and logging to confidential VM node pools with in-depth performance and health insights, the clusters and containerized applications. Azure Linux 3.0 and Ubuntu 24.04 support are now in preview. AKS integration in this generation of confidential VMs also brings support for Azure Linux 3.0, that contains the most essential packages to be resource efficient and contains a secure, hardened Linux kernel specifically tuned for Azure cloud deployments. Ubuntu 24.04 clusters are also supported in addition to Azure Linux 3.0. Organizations wanting to ease the orchestration issues associated with deploying, scaling and managing hundreds of confidential VM node pools can now choose from either of these two for their node pools. General purpose & Memory-intensive workloads Featuring general purpose optimized memory-to-vCPU ratios and support for up to 96 vCPUs and 384 GiB RAM, the DCasv6-series delivers enterprise-grade performance. The DCasv6-series enables organizations to run sensitive workloads with hardware-based security guarantees, making them ideal for applications processing regulated or confidential data. For more memory demanding workloads that exceed even the capabilities of the DCasv6 series, the new ECasv6-series offer high memory-to-vCPU ratios with increased scalability up to 96 vCPUs and 672 GiB of RAM, nearly doubling the memory capacity of DCasv6. You can get started today by creating confidential VMs in the Azure portal as explained here. Additional Resources: Quickstart: Create confidential VM with Azure portal Quickstart: Create confidential VM with ARM template Azure confidential virtual machines FAQKT accelerates cloud and AI adoption with Azure Confidential Computing
A leading South Korea telecom provider, KT Corporation, serves more than 20 million consumers and thousands of enterprise customers in finance, manufacturing, and the public sector. As businesses across the country undergo digital transformation, KT needed to expand its cloud offerings but faced hurdles from government regulations and customer expectations. Data security: Caution and compliance Expanding cloud applications presented several challenges. South Korea’s Personal Information Protection Act (PIPA) imposes strict requirements on how organizations handle personal data, placing limits on cross-border transfers without explicit consent. At the same time, many of KT’s customers remain wary of the public cloud and hesitant to share data due to security concerns. “In Korea, sovereignty and privacy aren’t merely government regulations,” says Sungkwon Kang, senior vice president and head of cloud at KT. “They are fundamental service requirements of key customers.” Many of the company’s applications store and process personally identifiable information - data that is both highly sensitive and tightly regulated. KT already used standard encryption for data at rest and in transit, but leaders still worried that data in use could be vulnerable to attack. To move forward, KT needed a way to assure business customers of end-to-end confidentiality, integrity, and compliance without sacrificing the scale and agility of public cloud. Secure Public Cloud service with Azure Confidential Computing In partnership with Microsoft and Advanced Micro Devices (AMD), KT built a next-generation Secure Public Cloud service powered by Azure Confidential Computing (ACC). ACC protects data in use, encrypting information in RAM and during computation. It also enforces strict hardware attestation, key management, and cryptographic guarantees. “Only the data owner can access the data,” explains Youngmin Kim, senior vice president and head of IT development at KT. KT has already migrated critical workloads to this secure public cloud, including its personal information management services. That migration took about six months, and the environment is now stable and running smoothly. The effort now serves as KT’s reference architecture as the company moves additional services onto the platform. Throughout the transition, KT prioritized customers’ sovereignty requirements. “We store customer data in-region, with transparency and sovereignty controls built into the Azure platform,” says Kang. The same foundation supports KT’s AI scenarios, enabling customers to adopt advanced capabilities with confidence. Performance increases and greater trust KT’s goal in adopting ACC was to give its public-sector and financial customers the confidence to embrace cloud services without hesitation. Strong, verifiable data protection helps build that trust. To support this vision, KT is working closely with manufacturing, financial, and public-sector organizations to increase transparency through service validations and ongoing technology briefings with Microsoft. “We’re building a cloud ecosystem where even the most sensitive organizations can confidently embrace digital and AI transformation with us,” says Kang. We want customers to trust Azure services as much as their own data centers, knowing they have the same level of security control, transparency, and compliance. To support its secure cloud architecture, KT has adopted ACC v6 Confidential Virtual Machines, which run on AMD’s fourth-generation EPYC Genoa processors. With the new VMs, KT is already seeing performance improvements of 15–60% over v5 in similar scenarios. KT is also expanding its software-as-a-service (SaaS) offerings, including AI-driven services for both business-to-business and business-to-consumer customers. Like other shared services, SaaS requires customers to store data in the public cloud, raising similar security concerns. To enhance security and build customer trust, KT is building its SaaS services on Azure, using ACC to protect sensitive data in use. “We’re delivering bolder innovations with stronger protections,” says Kang. Discover more about KT Corporation on Facebook, Instagram, LinkedIn, and YouTube.
DCasv6 and ECasv6 confidential VMs in Azure Government Cloud
Today, we are announcing the launch of the DCasv6 and ECasv6 series of confidential virtual machines (CVMs) in Azure Government. Azure Government: Compliant, Hyperscale, Sovereign Cloud Azure Government was designed to remove the constraints that have historically limited federal cloud adoption by delivering hyperscale innovation without sacrificing regulatory certainty. Supporting over 180 services, Azure Government allows customers to consume advanced cloud capabilities without having to individually validate service availability or compliance. It is a complete end-to-end platform, delivering identity, DevOps, and services as commercial Azure, while operating entirely within accredited boundaries. Confidential virtual machines address one of the barriers to multi-tenant cloud adoption: When deployed on Azure Government, Confidential VMs combine physical isolation, sovereign operations, and hardware-enforced cryptographic isolation into a single execution environment. This enables customers to get additional protections from insider threats. At its core, Azure Government runs the same Azure codebase that powers Microsoft’s commercial cloud, providing access to compute, networking, storage, data, and AI services. DCasv6 and ECasv6: Confidential virtual machines in Azure government cloud The DCasv6 and ECasv6-series virtual machines built on 4th Generation AMD EPYC™ processors are the first in Azure Government to implement AMD SEV-SNP. This generation introduces several controls that change both security posture and operational readiness: Hardware-Enforced Memory Isolation: AMD SEV-SNP provides full, AES-256 encrypted memory with keys generated and managed by the onboard AMD Secure Processor. Online key rotation: Support for the online key rotation with the introduction of Virtual Machine Metablob disk (VMMD). Programmatic Attestation for Audit and Zero-Trust: Before provisioning any workload, customers can perform an attestation. This cryptographic procedure validates the integrity of the hardware and software, producing a signed report that proves the VM is a genuine confidential instance. Confidential OS Disk Encryption with Flexible Key Management: Cryptographic protection extends beyond runtime memory to the operating system disk itself. The disk's encryption keys are bound to the VM's virtual Trusted Platform Module (vTPM), which is protected within the TEE. Customers can choose between platform-managed keys (PMK) for simplicity and regulatory ease, or customer-managed keys (CKM) for full, sovereign control over the key lifecycle - a common requirement for the most stringent compliance regimes. Conclusion With the DCasv6 and ECasv6-series virtual machines now generally available in Azure government regions, customers can modernize their infrastructure deployments through confidential computing which replaces implicit trust with cryptographic isolation, and when deployed on Azure Government’s sovereign cloud within physically isolated data centers, it enables agencies to modernize at operational speed without compromising control. Azure Government is in a unique position to deliver the full operational depth of a hyperscale cloud, from identity and DevOps to monitoring and edge execution, inside an environment purpose-built for federal compliance. When combined with the latest Confidential VMs, customers gain secure infrastructure built on a platform where agility, visibility, and trust reinforce each other. Additional resources Azure Government documentation | Microsoft Learn Government Validation SystemGenerational Performance Leap for Azure Confidential Computing
At Microsoft, protecting customer data is a foundational commitment. Organizations moving their most sensitive workloads to the cloud require assurances beyond just encryption of data-at-rest and data-in-transit. They need robust protection while the data is in use, and they need it without sacrificing the performance of their business-critical applications. Confidential Computing emerged as a technology to address this need for data-in-use protection. For years, a key consideration for adopting confidential computing has been the perceived trade-off between stronger security and application performance. To provide our customers with transparent, third-party validation, Microsoft and AMD commissioned a technical analysis from Prowess Consulting, an independent research firm specializing in hands-on performance validation for the enterprise IT industry. Their report provides an assessment of our latest generation confidential VMs. Azure confidential VMs, powered by the latest 4th generation AMD EPYC™ processors, deliver both next-generation performance and hardware-enforced security, fundamentally shifting the conversation from a security trade-off to a performance dividend. Enterprises are required to handle sensitive information or personal data like transactions, analytics or intellectual property (IP) while operating under strict compliance regimes like GDPR or HIPAA can now seamlessly transition to the cloud, running their high performance, mission-critical applications on Azure’s latest confidential VMs. A Generational Leap in Performance While uncertainty surrounding the performance overhead of enabling confidential computing features and performance gaps, confidential computing has broadened its appeal as processors leap forward in both performance and capabilities with each successive generation. The motivation of the study was to identify a clear performance uplift by comparing the latest Azure DCasv6 confidential VMs, powered by 4th generation AMD EPYC™ processors, against the previous generation. The data confirms that upgrading delivers a significant and measurable performance uplift across the stack. A 77% gain in memory bandwidth, driven by architectural enhancements including the adoption of DDR5 memory, directly benefiting data-intensive applications. A 34% increase in Redis throughput, demonstrating substantial real-world gains for in-memory databases and caching workloads where latency is critical. A 30% rise in CPU throughput, confirming faster execution for compute-bound workloads on the latest generation of Azure confidential VMs. Quantifying the Overhead of SEV-SNP Beyond generational gains, the Prowess report sought to answer the critical question: What is the real performance overhead of enabling AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)? This hardware-level security feature isolates VMs by encrypting memory in use, protecting it even from the host hypervisor. The study compared confidential VMs (DCasv6) against general-purpose counterparts (Dasv6) running on identical 4th Gen AMD EPYC processors. The overhead introduced by these advanced protections was found to be minimal and predictable. An 8% overhead for CPU-intensive and Redis workloads. A mere 2% overhead for memory-intensive workloads. These results affirm that a robust security posture with a minimum impact on performance or latency, making it a practical choice for a broad spectrum of production workloads. From Technical Validation to Business Value For IT leaders and developers, these findings mean you no longer need to architect around performance limitations to achieve stronger security. The implications are clear: Confidentiality is a mainstream capability. With such minimal overhead, confidential computing is no longer a niche solution for only the most sensitive data, but a viable option for securing a diverse array of enterprise applications. Modernize with confidence. Organizations can now confidently migrate and modernize applications on Azure confidential VMs, gaining both hardware-enforced data protection and a significant performance boost. Unlock new possibilities. This validated performance enables the processing of sensitive data from financial analytics to healthcare insights in the cloud, scenarios that were previously constrained by security and performance concerns. This report validates our commitment to delivering a confidential cloud without compromise. Next Steps We encourage you to review the detailed report and explore how Azure confidential computing can fit into your security strategy. Read the full Prowess Consulting Technical Report for a deep dive into the methodology and results. Visit the confidential computing homepage to learn more about our comprehensive portfolio. Explore the DCasv6 and ECasv6-series VMs today.Announcing preview for the next generation of Azure Intel® TDX Confidential VMs
Today, we are excited to announce the preview of Azure’s next generation of Confidential Virtual Machines powered by the 5 th Gen Intel® Xeon® processors (code-named Emerald Rapids) with Intel® Trust Domain Extensions (Intel® TDX). This will help to enable organizations to bring confidential workloads to the cloud without code changes to applications. The supported SKUs include the general-purpose families DCesv6-series and the memory optimized families ECesv6-series. Confidential VMs are designed for tenants with high security and confidentiality requirements, providing a strong, attestable, hardware-enforced boundary. They ensure that your data and applications stay private and encrypted even while in use, keeping your sensitive code and other data encrypted in memory during processing. Improvements Azure’s next generation of confidential VMs will bring improvements and new features compared to our previous generation. These VMs are our first offering to utilize our open-source paravisor, OpenHCL. This innovation allows us to enhance transparency with our customers, reinforcing our commitment to the "trust but verify" model. Additionally, our new confidential VMs support Azure Boost, enabling up to 205k IOPS and 4 GB/s throughput of remote storage along with 40 GBps VM network bandwidth. We are expanding the capabilities of our Intel® TDX powered confidential VMs by incorporating features from our general purpose and other confidential VMs. These enhancements include Guest Attestation support, and support of Intel® Tiber™ Trust Authority for enterprises seeking operator independent attestation. Offerings The DCesv6-series VMs are designed to offer a balance of memory to vCPU ratio, with up to 128 vCPUs, and up to 512 GiB of memory. The ECesv6-series VMs are designed to offer an even higher memory to vCPU ratio, with up to 64 vCPUs, and 512 GiB of memory. Availability The DCesv6-series and ECesv6-series preview is available now in the East US, West US, West US 3 and West Europe regions. Supported OS images include Windows Server 2025, Windows Server 2022, Ubuntu 22.04, and Ubuntu 24.04. Please sign up at aka.ms/acc/v6preview and we will reach out to you.
Price reduction and upcoming features for Azure confidential ledger!
Effective March 1, 2025, you can keep your records in Azure confidential ledger (ACL) at the reduced price of ~$3/day per instance! The reduced price is for the computation and the ledger use. The price of any additional storage used will remain unchanged. To tamper protect your records: Automatically create hash (e.g. MD5 or SHA256) of your blob storage data and keep those in Azure confidential ledger. For forensics, you can verify the integrity of the data against the signature in ACL. Imagine doing this as you are migrating data from one system to another, or when you restore archived records from cold storage. It is also valuable when there is a need to protect from insider/administrator risks and confidently report to authorities. If you keep your data in Azure SQL database, you can use their security ledger feature to auto generate record digests and store them in confidential ledger for integrity protection and safeguarding. You can use the SQL stored procedure to verify that no tampering or administrator modifications occurred to your SQL data! In addition, we are announcing the preview of User Defined Functions for Azure confidential ledger. Imagine doing a schema validation before writing data to the Ledger or using pattern matching to identify sensitive information in log messages and perform data massaging to mask it. To increase your awareness, request access for this preview via the sign-up form. Get started by reading our documentation and trying out confidential ledger yourself! _____________________________________________________________________________________________________ What is Azure confidential ledger and what is the change? It is a tamper protected and auditable data store backed by a Merkle tree blockchain structure for sensitive records that require high levels of integrity protection and/or confidentiality. While customers from AI, financial services, healthcare, and supply chain continue to use the ledger for their business transaction’s archival needs and confidential data’s unique identifiers for audit purposes, we are acting on their feedback for scaling ledgers to more of their workloads with a more competitive price! How can I use Azure confidential ledger? - Azure SQL database ledger customers can enable confidential ledger as its trusted digest store to uplevel integrity and security protection posture - Azure customers who use blob storage have found value in migrating their workloads to Azure with a tamper protection check via the Azure confidential ledger Marketplace App. - Azure customers who use data stores and databases (e.g. Kusto, Cosmos, and Log Analytics) may benefit from auditability and traceability of logs being kept in the confidential ledger with new compliance certifications in SOC 2 Type 2 and ISO27001. How much does Azure confidential ledger cost? - Approximately $3/day/ledger _____________________________________________________________________________________________________ Resources Explore the Azure confidential ledger documentation Read the blog post on: Integrity protect blob storage Read the blog post on: How to choose between ledger in Azure SQL Database and Azure Confidential Ledger Read the blog post on: Verify integrity of data transactions in Azure confidential ledger View our recent webinar in the Security Community Recent case studies: HB Antwerp & BeekeeperAIPreview: New DCasv6 and ECasv6 confidential VMs based on 4th Generation AMD EPYC™ processors
You can get started deploying your software on these confidential VMs by signing up here. Additional security enhancements With the launch of the DCasv6 and ECasv6 confidential VM family – we support AES-256 memory encryption enabled by default. Additionally, we now offer our customers the capability to leverage key protection with Virtualization-based Security (VBS) in Windows. By enabling key protection in Windows CVMs, customers can protect keys in-use from Guest OS and applications. This key protection is enforced by CPU hardware. Faster performance for confidential workloads These new CVMs have demonstrated up to 25% improvement in various benchmarks compared to our previous generation of AMD-based confidential VMs. KT is leveraging Azure confidential computing to secure sensitive and regulated data from its telco business in the cloud. With new V6 CVM offerings in Korea Central Region, KT extends its use to help Korean customers with enhanced security requirements, including regulated industries, benefit from the highest data protection as well as the fastest performance by the latest AMD SEV-SNP technology through its Secure Public Cloud built with Azure confidential computing. - Woojin Jung, EVP, KT Corporation Worldwide Region Availability These CVMs will be gradually made available across all supported Azure regions and availability zones. Please use the sign-up form to indicate interest in participating in the gated preview and regional requirements. General purpose & Memory-intensive workloads Featuring general purpose optimized memory-to-vCPU ratios and support up to 96 vCPUs and 384 GiB RAM, the DCasv6-series delivers enterprise-grade performance. The DCasv6-series enables organizations to run sensitive workloads with hardware-based security guarantees, making them ideal for applications processing regulated or confidential data. For more memory demanding workloads, the new ECasv6-series offer high memory-to-vCPU ratios with increased scalability up to 96 vCPUs and 672 GiB of RAM. The ECasv6-series is ideal for memory-intensive enterprise applications offering nearly double the memory capacity of DCasv6. The ECasv6-series scales 672 GiB RAM with up to 96 vCPUs, making them ideal for memory intensive applications that exceed even the capabilities of the DCasv6 series. DCasv6 DCadsv6 ECasv6 ECadsv6 vCPU 2 - 96 2 - 96 2 - 96 2 - 96 Memory 8 - 384 8 - 384 16 - 672 16 - 672 Max local disk NA 75-600GiB NA 75-600GiB OS Support These CVMs support the following guest operating systems: Windows Server 2019, 2022, 2025, Windows 11, Ubuntu 22.04, Ubuntu 24.04, and RHEL 9.4. Endorsements from our customers The BMW Group relies on Azure confidential VMs powered by AMD EPYC processors to enable a Zero Trust environment with end-to-end encryption for our identity authentication system, allowing over 200,000 associates to collaborate on building the future of individual mobility. The solution was made possible in part due to the fact that AMD EPYC processor based confidential VMs do not require code changes to protect data in memory. Further, our testing of the newest generation of DCasv6 VMs has shown significant improvements in performance, and we look forward to seeing them go live on Azure. - BMW Group Having early access to Microsoft’s latest confidential VMs is a game-changer, offering enhanced security and performance. Our customers are pleased that they won’t have to adapt existing algorithms to take advantage of computing within the optimal CVM environment available in their computing region and selected within the EscrowAI platform. - Mary Beth Chalk, Co-founder & Chief Commercial Officer, BeeKeeperAI Anjuna is thrilled to be among the first to access Microsoft’s latest confidential VMs, powered by the newest version of the AMD SEV-SNP technology. Our ongoing partnership with Microsoft Azure provides us with early access to explore advanced security and performance features. This collaboration empowers joint Azure and Anjuna customers to leverage the newest Azure technologies from day one, enhanced by the capabilities of the Anjuna Seaglass platform. - Ofir Azoulay-Rozanes, Director of Product Management, Anjuna Security Sign up now for exclusive access Joining our exclusive preview program gives you an opportunity to work with the product team. To get started deploying your software on the latest confidential VMs sign up here.
