What Are the Services Provided by Microsoft Azure?

Microsoft Azure is Microsoft’s cloud computing platform, offering on-demand computing, storage, databases, networking, and security services. Its data-security offerings center on cloud key management through Azure Key Vault, Managed HSM, and Azure Cloud HSM.

Microsoft Azure provides a broad set of cloud services that let organizations build, deploy, and manage applications without owning physical infrastructure. Azure runs across Microsoft’s global network of data centers and is one of the three largest public clouds alongside Amazon Web Services and Google Cloud Platform. For protecting data, Azure’s core security services store and manage cryptographic keys.

Key Takeaways

• Azure key management has three main options: Azure Key Vault (multi-tenant), Managed HSM (single-tenant pool), and Azure Cloud HSM (single-tenant cluster, successor to Dedicated HSM).
• Azure Key Vault Standard protects keys in software at FIPS 140-2 Level 1; Key Vault Premium and Managed HSM use FIPS 140-3 Level 3 validated Marvell LiquidSecurity HSMs.
• Azure Dedicated HSM is retiring: no new onboarding since August 2025, full support through July 31, 2028, with Azure Cloud HSM as its successor.
• Key Vault supports RSA keys of 2048, 3072, and 4096 bits and EC curves P-256, P-384, P-521, and P-256K. Symmetric (AES) keys are supported in Managed HSM.
• Bring Your Own Key (BYOK) lets you generate a key on-premises and import it into Azure wrapped, so the key is never exposed in plaintext during transfer.

What Is Microsoft Azure?

Microsoft Azure is a cloud computing platform that delivers computing, storage, databases, machine learning, networking, and security as on-demand services over the internet.

Instead of buying and running their own servers, organizations rent Azure resources and pay for what they use. Azure is available worldwide, holds a wide range of compliance certifications, and serves customers from small teams to large enterprises. This article focuses on Azure’s data-security services, specifically the cloud key management options that store and protect cryptographic keys.

Azure Cloud Key Management Services

Azure offers three primary services for storing and managing cryptographic keys, which differ mainly in tenancy and level of assurance.

Service	Tenancy	FIPS validation	Best for
Azure Key Vault (Standard)	Multi-tenant	FIPS 140-2 Level 1 (software-protected keys)	General secrets, certificates, and software-protected keys
Azure Key Vault (Premium)	Multi-tenant	FIPS 140-3 Level 3 (HSM-protected keys)	HSM-backed keys without managing hardware
Managed HSM	Single-tenant pool	FIPS 140-3 Level 3	Regulated workloads needing sole control of a dedicated HSM pool
Azure Cloud HSM	Single-tenant cluster	FIPS 140-3 Level 3	Successor to Dedicated HSM; full administrative control with private connectivity

Key Vault Premium and Managed HSM run on Marvell LiquidSecurity HSM hardware; Microsoft selected the same LiquidSecurity family for Azure Cloud HSM in August 2025. Microsoft has also introduced Azure Integrated HSM, which embeds Microsoft-designed HSM chips directly into VM host servers for local, tamper-resistant key handling.

Azure Key Vault: Keys, Secrets, and Certificates

Azure Key Vault is a multi-tenant service that safeguards cryptographic keys, secrets, and certificates for cloud applications.

Key Vault comes in two tiers. The Standard tier protects keys with software and is validated to FIPS 140-2 Level 1. The Premium tier protects keys with FIPS 140-3 Level 3 validated Marvell LiquidSecurity HSMs. New HSM-protected key versions use the FIPS 140-3 Level 3 platform (referred to internally as HSM Platform 2); some older Premium key versions may still sit on the earlier FIPS 140-2 Level 2 platform. You can check a key’s hsmPlatform attribute to see which platform protects it.

Key Vault supports the following key types and operations:

• RSA key sizes: 2048, 3072, and 4096 bits.
• Elliptic-curve types: P-256, P-384, P-521, and P-256K (SECP256K1).
• Encryption / key wrapping: Microsoft recommends RSA-OAEP-256. The older RSA-OAEP and RSA1_5 (RSA PKCS#1 v1.5) are kept only for backward compatibility.
• Signing and verification: RS256/RS384/RS512, PS256/PS384/PS512, and ECDSA (ES256, ES256K, ES384, ES512).
• Symmetric (AES) keys: supported in Managed HSM, not in standard Key Vault.

Key Vault also automates certificate lifecycle management, including enrollment and renewal from public Certificate Authorities. It does not act as a CA itself.

Managed HSM and Azure Cloud HSM

Managed HSM and Azure Cloud HSM are single-tenant services for organizations that need sole control of dedicated, FIPS 140-3 Level 3 validated hardware.

Managed HSM is a fully managed, highly available, single-tenant pool. You get administrative control of your keys through local role-based access control, while Microsoft handles hardware maintenance. The service is designed so that Microsoft and its agents have no access to your keys, which are never visible in plaintext to Microsoft systems. Managed HSM supports RSA, EC, and symmetric (AES / oct-HSM) keys; 256-bit AES keys used there are quantum-resistant.

Azure Cloud HSM is a single-tenant HSM cluster and the general-availability successor to Azure Dedicated HSM. It offers fast provisioning, built-in redundancy across zones, and private connectivity, while the customer keeps full control of the keys.

Important: Azure Dedicated HSM is retiring Microsoft stopped accepting new Azure Dedicated HSM customers in August 2025 and will support existing customers until July 31, 2028. New customers should choose Azure Cloud HSM, Managed HSM, or Azure Key Vault instead. Existing keys cannot be migrated directly off Dedicated HSM because the Thales Luna HSM key-export policy prevents private keys from leaving the module, so new keys must be created in the successor service.

Bring Your Own Key (BYOK) in Azure

Bring Your Own Key (BYOK) lets you generate a key in your own hardware security module and import it into Azure, keeping control of key generation.

With BYOK, the key is encrypted (wrapped) before transfer, so it is never exposed in plaintext on the way into Azure. Once imported into Azure Key Vault Premium or Managed HSM, the key stays inside the FIPS 140-3 Level 3 HSM boundary and can be used for day-to-day cryptographic operations. BYOK is common in regulated industries where the organization must be able to prove it generated the key material itself. For the terminology and process details, see what BYOK is.

Azure Key Management and Post-Quantum Cryptography

The symmetric keys Azure protects are already quantum-resistant, but the RSA and elliptic-curve keys most workloads rely on are not.

A large quantum computer running Shor’s algorithm would break RSA and ECC, the asymmetric algorithms behind most Azure keys and certificates. AES-256 stays safe because Grover’s algorithm only halves its effective security, leaving roughly 128-bit post-quantum strength. NIST published its first post-quantum standards in August 2024: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. Organizations storing keys in Azure should begin inventorying where RSA and ECC are used so they can plan a migration to these algorithms as cloud support arrives.

How Encryption Consulting Helps

Encryption Consulting’s Cloud Data Protection Services help you design and operate key management in Azure, including Azure Key Vault, Managed HSM, and the move from Azure Dedicated HSM to Azure Cloud HSM. Our team advises on FIPS 140-3 Level 3 configuration, BYOK, key rotation, and access control so your cloud keys stay under your control. We also map where RSA and ECC are used across your estate so you can plan a post-quantum migration. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What is Microsoft Azure in simple terms?

Microsoft Azure is Microsoft’s cloud computing platform. It rents out computing power, storage, databases, networking, and security services over the internet, so organizations can build and run applications without owning physical servers. Azure runs across Microsoft’s global network of data centers and competes with Amazon Web Services and Google Cloud Platform. For data security, its key management services (Azure Key Vault, Managed HSM, and Azure Cloud HSM) store and protect cryptographic keys.

What is the difference between Azure Key Vault, Managed HSM, and Azure Cloud HSM?

Azure Key Vault is a multi-tenant service: its Standard tier protects keys in software (FIPS 140-2 Level 1) and its Premium tier uses FIPS 140-3 Level 3 validated HSMs. Managed HSM is a single-tenant, FIPS 140-3 Level 3 pool you control. Azure Cloud HSM is a single-tenant HSM cluster and the successor to the retiring Azure Dedicated HSM. Key Vault Premium and Managed HSM run on Marvell LiquidSecurity hardware, which Microsoft also selected for Azure Cloud HSM in August 2025.

What FIPS 140 level is Azure Key Vault?

Azure Key Vault Standard is validated to FIPS 140-2 Level 1 because it protects keys in software. Azure Key Vault Premium and Managed HSM use FIPS 140-3 Level 3 validated Marvell LiquidSecurity HSMs. New HSM-protected keys use the FIPS 140-3 Level 3 platform, while some older Premium key versions may still sit on the earlier FIPS 140-2 Level 2 platform. You can check a key’s hsmPlatform attribute to confirm which platform protects it.

Does Azure Key Vault support Bring Your Own Key (BYOK)?

Yes. Azure supports Bring Your Own Key, letting you generate a key in your own on-premises HSM and import it into Azure Key Vault Premium or Managed HSM. The key is encrypted (wrapped) during transfer so it is never exposed in plaintext, then stored inside the Azure HSM boundary. BYOK gives you control over key generation while still using Azure services for day-to-day cryptographic operations.

Is Azure Dedicated HSM still available?

Azure Dedicated HSM is being retired. Microsoft stopped accepting new customer onboardings in August 2025 and will support existing customers until July 31, 2028. Its successor is Azure Cloud HSM, a single-tenant, FIPS 140-3 Level 3 validated HSM cluster. New customers should evaluate Azure Cloud HSM, Managed HSM, or Azure Key Vault instead. Existing keys cannot be migrated directly from Dedicated HSM because of Thales Luna export restrictions.

What key types and algorithms does Azure Key Vault support?

Azure Key Vault supports RSA keys of 2048, 3072, and 4096 bits and elliptic-curve keys on P-256, P-384, P-521, and P-256K. Symmetric (AES) keys are supported in Managed HSM, not standard Key Vault. For encryption, Microsoft recommends RSA-OAEP-256; the older RSA-OAEP and RSA1_5 are kept only for backward compatibility. For signing, RS256/RS384/RS512, PS256/PS384/PS512, and ECDSA (ES256, ES256K, ES384, ES512) are supported.

Protect Your Data in the Cloud

Ready to get your Azure key management right? Explore Cloud Data Protection Services, or talk to an Encryption Consulting advisor.