Azure Document Intelligence in Foundry Tools
An Azure service that turns documents into usable data. Previously known as Azure Form Recognizer.
Managed HSM support for Document Intelligence
CHUNSIK KIM
1
Reputation point Microsoft Employee
Please help confirm whether Managed HSM is supported for Azure Document Intelligence.
Attached link (https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-customer-managed-keys-support) seems to indicate it's not supported, but i see I can select Managed HSM as an option to choose from encryption setting in the Document Intelligence, but with an error (The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link https://go.microsoft.com/fwlink/?linkid=2156688.)
Please be ware that the target managed HSM is enabled for all networks and do not have private endpoint configured.
Azure Document Intelligence in Foundry Tools
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 16%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
SRILAKSHMI C 19,100 Reputation points Microsoft External Staff Moderator2026-06-17T07:17:04.42+00:00 Hello @CHUNSIK KIM
Thank you for reaching out to Microsoft Q&A.
Based on the information provided, you are attempting to configure Customer-Managed Keys (CMK) for Azure Document Intelligence using an Azure Managed HSM, but the portal fails with the following error:
"The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link..."
From the screenshot and your description, we understand that:
- The Managed HSM is configured to allow all network access.
- No private endpoint is configured on the Managed HSM.
- The Managed HSM appears as a selectable option in the Azure portal under the Document Intelligence encryption settings.
- The failure occurs when the portal attempts to enumerate keys from the Managed HSM.
Supportability of Managed HSM with Azure Document Intelligence
Based on the currently published Microsoft documentation, we cannot conclusively confirm that Azure Document Intelligence supports Customer-Managed Keys backed by Azure Managed HSM.
The Microsoft documentation that tracks Customer-Managed Key support across Azure services:
https://learn.microsoft.com/azure/security/fundamentals/encryption-customer-managed-keys-support
does not currently list Azure Document Intelligence as a service supporting Managed HSM-backed encryption.
Additionally, the Document Intelligence documentation currently available focuses on service capabilities, models, and features, but does not explicitly document support for Azure Managed HSM as a key store for CMK scenarios.
Because of this, the presence of the Managed HSM option in the portal should not be interpreted as confirmation that the scenario is fully supported. In some cases, Azure services share a common encryption configuration experience in the portal, and certain options may appear even when support is limited or not yet fully implemented for a specific service.
About the "Connection to data plane failed" error
The error message itself indicates that the portal is unable to communicate successfully with the Managed HSM data plane.
The portal guidance specifically references troubleshooting steps that are commonly associated with:
Private Endpoint configurations
Network access restrictions
Data-plane connectivity issues
Authorization and permission validation
However, since you have already confirmed that:
Private Endpoints are not configured
The Managed HSM is open to all networks
the issue may be related to one of the following:
- Managed HSM data-plane permissions
- Managed HSM activation status
- Azure portal validation logic
- A current product limitation regarding Document Intelligence and Managed HSM integration
- A potential portal-side issue
Recommended troubleshooting
Since the currently available documentation does not explicitly confirm Managed HSM support for Document Intelligence, we recommend the following:
Follow the troubleshooting guidance referenced in the portal error message.
Verify that the Managed HSM is fully activated and operational.
Managed HSM requires activation before its data plane becomes fully functional. Even when the resource is provisioned successfully, key enumeration and management operations can fail if activation has not completed successfully.
Validate that the Managed HSM data plane is accessible independently.
For example, confirm that:
- Keys can be listed through Azure CLI, PowerShell, or REST APIs.
- The identity performing the operation has the required Managed HSM roles and permissions.
Test the same encryption workflow using a standard Azure Key Vault key.
If Azure Key Vault succeeds while Managed HSM consistently fails, that would suggest either:
- A supportability gap, or
- A service-specific limitation with Managed HSM integration.
To help determine whether this is a configuration issue or a product limitation, could you please provide:
- Azure region of the Document Intelligence resource
- Document Intelligence SKU/tier
- Confirmation whether Customer-Managed Keys work successfully with a standard Azure Key Vault
- Any Activity Log entries or deployment errors associated with the encryption configuration attempt
I Hope this helps. Do let me know if you have any further queries.
Thank you!
Sign in to comment
Sign in to answer