What is External Key Management?

External Key Management (EKM) is an approach where organizations generate, store, and manage encryption keys outside of cloud infrastructure, while using those keys to protect data in cloud services. This approach can address key sovereignty requirements for organizations that need greater control over cryptographic material for data sovereignty and compliance in regulated sectors.

Azure Key Vault Managed HSM key sovereignty

Azure Key Vault Managed HSM helps you achieve key sovereignty by giving you full control of cryptographic keys through FIPS 140-3 Level 3 validated security, single-tenant isolation, and customer-controlled security domains. This approach delivers strong sovereignty guarantees while maintaining Azure's service-level agreements and eliminating the operational overhead of managing physical HSM infrastructure.

For most organizations, Managed HSM key sovereignty satisfies even stringent regulatory requirements. For more information, see What is Azure Key Vault Managed HSM? and Capabilities of Sovereign Public Cloud.

Managed HSM External Key Management (preview)

For organizations with regulatory or contractual requirements that mandate key material physically reside outside Microsoft infrastructure, Azure Key Vault Managed HSM also supports External Key Management as a preview feature. With EKM, the Key Encryption Key lives in a customer-operated HSM outside Azure, and Managed HSM delegates wrap and unwrap operations to it through a customer-run EKM Proxy.

Important

Managed HSM External Key Management is in preview. Preview features are made available to you on the condition that you agree to the supplemental terms of use. Some aspects of this feature might change before general availability.

EKM trades availability, performance, and operational simplicity for physical key control outside Microsoft infrastructure. It's a last-resort option for organizations with a hard legal or contractual mandate - not a general-purpose upgrade to Managed HSM keys.

For full architecture details, operational requirements, and quickstarts, see What is Managed HSM External Key Management?.

See also

• Key management in Azure - compare all Azure key management solutions.
• How to choose the right key management solution - decision guide including EKM.
• Key management controls - key management security considerations for sovereign cloud.
• Key recovery management - operational responsibilities for Managed HSM.
• Microsoft Sovereign Cloud overview - broader sovereignty capabilities.