Getting started with Azure Payment HSM

This article provides steps and information necessary to get started with Azure Payment HSM.


Azure Payment HSM is a specialized service. To qualify for onboarding and use of Azure Payment HSM, customers must have an assigned Microsoft Account Manager, have a CSA, and meet the monetary requirement of five million ($5M) USD or greater in overall committed Azure revenue annually.

To inquire about the service, start the qualification process, and prepare the prerequisites before on-boarding, ask your Microsoft account manager and CSA to send a request via email.


Azure Payment HSM is currently available in the following regions:

  • East US
  • West US
  • South Central US
  • Central US
  • North Europe
  • West Europe


Azure Payment HSM customers must have:

  • Access to the Thales Customer Portal (Customer ID)
  • Thales smart cards and card reader for payShield Manager


The HSM devices will be charged based on the Azure Payment HSM pricing page. All other Azure resources for networking and virtual machines will incur regular Azure costs too.

payShield customization considerations

If you are using payShield on-premises today with a custom firmware, a porting exercise is required to update the firmware to a version compatible with the Azure deployment. Please contact your Thales account manager to request a quote.

Ensure that the following information is provided:

  • Customization hardware platform (e.g., payShield 9000 or payShield 10K)
  • Customization firmware number


For details on Azure Payment HSM prerequisites, support channels, and division of support responsibility between Microsoft, Thales, and the customer, see the Azure Payment HSM service support guide.

Next steps