Frequently asked questions (FAQ)

A Hardware Security Module (HSM) is a physical computing device used to safeguard and manage cryptographic keys. Keys stored in HSMs can be used for cryptographic operations. The key material stays safely in tamper-resistant, tamper-evident hardware modules. The HSM only allows authenticated and authorized applications to use the keys. The key material never leaves the HSM protection boundary.

Azure Dedicated HSM is a cloud-based service that provides HSMs hosted in Azure datacenters that are directly connected to a customer's virtual network. These HSMs are dedicated Thales Luna 7 HSM network appliances. They're deployed directly to a customers' private IP address space and Microsoft does not have any access to the cryptographic functionality of the HSMs. Only the customer has full administrative and cryptographic control over these devices. Customers are responsible for the management of the device and they can get full activity logs directly from their devices. Dedicated HSMs help customers meet compliance/regulatory requirements such as FIPS 140-2 Level 3, HIPAA, PCI-DSS, and eIDAS and many others.

Customers must have an assigned Microsoft Account Manager and meet the monetary requirement of 5 million ($5M) USD or greater in overall committed Azure revenue annually to qualify for onboarding and use of Azure Dedicated HSM.

Microsoft partnered with Thales to deliver the Azure Dedicated HSM service. The specific device used is the Thales Luna 7 HSM model A790. This device not only provides FIPS 140-2 Level-3 validated firmware, but also offers low-latency, high performance, and high capacity via 10 partitions.

HSMs are used for storing cryptographic keys that are used for cryptographic functionality such as TLS (transport layer security), encrypting data, PKI (public key infrastructure), DRM (digital rights management), and signing documents.

Customers can provision HSMs in specific regions using PowerShell or command-line interface. The customer specifies what virtual network the HSMs is connected to and once provisioned the HSMs are available in the designated subnet at assigned IP addresses in the customer's private IP address space. Then customers can connect to the HSMs using SSH for appliance management and administration, set up HSM client connections, initialize HSMs, create partitions, define, and assign roles such as partition officer, crypto officer, and crypto user. Then the customer uses Thales provided HSM client tools/SDK/software to perform cryptographic operations from their applications.

Thales supplies all software for the HSM device once provisioned by Microsoft. The software is available at the Thales customer support portal. Customers using the Dedicated HSM service are required to be registered for Thales support and have a Customer ID that enables access and download of relevant software. The supported client software is version 7.2, which is compatible with the FIPS 140-2 Level 3 validated firmware version 7.0.3.

The following items incur extra cost when using the Dedicated HSM service.

• Use of dedicated on-premises backup device is feasible to use with Dedicated HSM service, but incurs an extra cost and should be directly sourced from Thales.
• Dedicated HSM is provided with a 10 partition license. A customer can request more partitions and pay for more licenses directly sourced from Thales.
• Dedicated HSM requires networking infrastructure (virtual network, VPN Gateway, Etc.) and resources such as virtual machines for device configuration. These resources incur extra costs and are not included in the Dedicated HSM service pricing.

No. Azure Dedicated HSM only provides HSMs with password-based authentication.

No. Azure Dedicated HSM service does not support functionality modules.

Microsoft only offers the Thales Luna 7 HSM model A790 via the Dedicated HSM service and cannot host any customer-provided devices.

The Azure Dedicated HSM service uses Thales Luna 7 HSMs. These devices do not support payment HSM specific functionality (such as PIN or EFT) or certifications. If you would like Azure Dedicated HSM service to support Payment HSMs in future, pass on the feedback to your Microsoft Account Representative.

As of October 2022, Dedicated HSM is available in 22 regions. Further regions are planned and can be discussed via your Microsoft Account Representative.

• East US
• East US 2
• West US
• West US 2
• Canada East
• Canada Central
• South Central US
• Southeast Asia
• India Central
• India South
• Japan East
• Japan West
• North Europe
• West Europe
• UK South
• UK West
• Australia East
• Australia Southeast
• Switzerland North
• Switzerland West
• US Gov Virginia
• US Gov Texas

You use Thales provided HSM client tools/SDK/software to perform cryptographic operations from your applications. The software is available at the Thales customer support portal. Customers using the Dedicated HSM service are required to be registered for Thales support and have a Customer ID that enables access and download of relevant software.

Yes, you need to use virtual network peering within a region to establish connectivity across virtual networks. For cross-region connectivity, you must use VPN Gateway.

Yes, you can sync on-premises HSMs with Dedicated HSM. Point-to-point VPN or point-to-site connectivity can be used to establish connectivity with your on-premises network.

No. Azure Dedicated HSMs are only accessible from inside your virtual network.

Yes, if you have on-premises Thales Luna 7 HSMs. There are multiple methods. Refer to the Thales HSM documentation.

• Windows, Linux, Solaris, AIX, HP-UX, FreeBSD
• Virtual: VMware, Hyper-V, Xen, KVM

To have high availability, you need to set up your HSM client application configuration to use partitions from each HSM. Refer to the Thales HSM client software documentation.

Azure Dedicated HSM uses Thales Luna 7 HSM model A790 devices and they support password-based authentication.

PKCS#11, Java (JCA/JCE), Microsoft CAPI, and CNG, OpenSSL

Yes. Contact your Thales representative for the appropriate Thales migration guide.

No. Azure Dedicated HSM service does not support functionality modules.

Azure Dedicated HSM is the appropriate choice for enterprises migrating to Azure on-premises applications that use HSMs. Dedicated HSMs present an option to migrate an application with minimal changes. If cryptographic operations are performed in the application's code running in an Azure VM or Web App, they can use Dedicated HSM. In general, shrink-wrapped software running in IaaS (infrastructure as a service) models that support HSMs as a key store can use Dedicate HSM, such as traffic manager for keyless TLS, ADCS (Active Directory Certificate Services), or similar PKI tools, tools/applications used for document signing, code signing, or a SQL Server (IaaS) configured with TDE (transparent database encryption) with primary key in an HSM using an EKM (extensible key management) provider. Azure Key Vault is suitable for "born-in-cloud" applications or for encryption at rest scenarios where customer data is processed by PaaS (platform as a service) or SaaS (Software as a service) scenarios such as Office 365 Customer Key, Azure Information Protection, Azure Disk Encryption, Azure Data Lake Store encryption with customer-managed key, Azure Storage encryption with customer managed key, and Azure SQL with customer managed key.

Azure Dedicated HSM is most suitable for migration scenarios in which you migrate on-premises applications to Azure that are already using HSMs, providing a low-friction method for migrating to Azure with minimal changes to the application. If cryptographic operations are performed in the application's code running in Azure VM or Web App, Dedicated HSM may be used. In general, shrink-wrapped software running in IaaS (infrastructure as a service) models that support HSMs as a key store can use Dedicate HSM, such as:

• Traffic Manager for Keyless TLS
• ADCS (Active Directory Certificate Services)
• Similar PKI tools
• Tools/applications used for document signing
• Code signing
• SQL Server (IaaS) configured with TDE (transparent database encryption) with primary key in an HSM using an EKM (extensible key management) provider

No. Dedicated HSM is provisioned directly into a customer's private IP Address space so it is not accessible by other Azure or Microsoft services.

Yes. Each HSM appliance is fully dedicated to one single customer and no one else has administrative control once provisioned and the administrator password changed.

Microsoft does not have any administrative or cryptographic control over the HSM. Microsoft has monitor level access via serial port connection to retrieve basic telemetry such as temperature and component health, to allow Microsoft to provide proactive notification of health issues. If necessary, the customer can disable this account.

The HSM device ships with a default user of admin with its usual default password. Microsoft did not want to have default passwords in use while any device is in a pool waiting for provisioning by customers. This would not meet our strict security requirements. For this reason, we set a strong password, which is discarded at provisioning time. Also, at provisioning time we create a new user in the admin role called "tenant admin". The "tenant admin" user has the default password, which customers change as the first action when first logging into the newly provisioned device. This process ensures high degrees of security and maintains our promise of sole administrative control for our customers. It should be noted that the "tenant admin" user can be used to reset the admin user password if a customer prefers to use that account.

No. Microsoft does not have any access to the keys stored in customer allocated Dedicated HSM.

No. Azure Dedicated HSM is a baremetal HSM for lease service. Our service does not store customer data. All key materials and data are stored within the customers HSM appliance. Each HSM appliance is fully dedicated to one single customer, for which they have full administrative control.

The customer has full administrative control including upgrading software/firmware if specific features are required from different firmware versions. Before making changes, consult with Thales Support about your software/firmware upgrade scenario.

You can manage Dedicated HSMs by accessing them using SSH.

The Thales HSM client software is used to manage the HSMs and partitions.

A customer has full access to HSM activity logs via syslog and SNMP. A customer must set up a syslog server or SNMP server to receive the logs or events from the HSMs.

Yes. You can send logs from the HSM appliance to a syslog server

Yes. High availability configuration and setup are performed in the HSM client software provided by Thales. HSMs from the same virtual network or other VNETs in the same region or across regions, or on premises HSMs connected to a virtual network using site-to-site or point-to-point VPN can be added to same high availability configuration. It should be noted that this synchronizes key material only and not specific configuration items such as roles.

Yes. They must meet the high availability requirements for Thales Luna 7 HSMs

No.

Sixteen members of an HA group have under-gone, full-throttle testing with excellent results.

There is no specific uptime guarantee provided for the Dedicated HSM service. Microsoft ensures network level access to the device, and hence standard Azure networking SLAs apply.

Azure datacenters have extensive physical and procedural security controls. In addition to that Dedicated HSMs are hosted in a further restricted access area of the datacenter. These areas have more physical access controls and video camera surveillance for added security.

Dedicated HSM service uses Thales Luna 7 HSM appliances. These devices support physical and logical tamper detection. If there is ever a tamper event, the HSMs are automatically zeroized.

It is highly recommended to use an on-premises HSM backup device to perform regular periodic backup of the HSMs for disaster recovery. You must use a peer-to-peer or site-to-site VPN connection to an on-premises workstation connected to an HSM backup device.

Support is provided by both Microsoft and Thales. If you have an issue with the hardware or network access, raise a support request with Microsoft and if you have an issue with HSM configuration, software, and application development raise a support request with Thales. If you have an undetermined issue, raise a support request with Microsoft and then Thales can be engaged as required.

After you register for the service, you will receive a Thales Customer ID that allows for registration in the Thales customer support portal, enabling access to all software and documentation as well as support requests directly with Thales.

Microsoft does not have the ability to connect to HSMs allocated to customers. Customers must upgrade and patch their HSMs.

The HSM has a command-line reboot option, however, we are experiencing issues where the reboot stops responding intermittently and for this reason it is recommended for the safest reboot that you raise a support request with Microsoft to have the device physically rebooted.

Yes, Dedicated HSM provisions Thales Luna 7 HSMs that are FIPS 140-2 Level-3 validated.

Dedicated HSM service provisions Thales Luna 7 HSM appliances. They support a wide range of cryptographic key types and algorithms including: Full Suite B support

• Asymmetric:
  • RSA
  • DSA
  • Diffie-Hellman
  • Elliptic Curve
  • Cryptography (ECDSA, ECDH, Ed25519, ECIES) with named, user-defined, and Brainpool curves, KCDSA
• Symmetric:
  • AES-GCM
  • Triple DES
  • DES
  • ARIA, SEED
  • RC2
  • RC4
  • RC5
  • CAST
  • Hash/Message Digest/HMAC: SHA-1, SHA-2, SM3
  • Key Derivation: SP 800-108 Counter Mode
  • Key Wrapping: SP 800-38F
  • Random Number Generation: FIPS 140-2 approved DRBG (SP 800-90 CTR mode), complying with BSI DRG.4

Yes. Dedicated HSM service provisions Thales Luna 7 HSM model A790 appliances that are FIPS 140-2 Level-3 validated.

The Dedicated HSM service provisions Thales Luna 7 HSM appliances. These devices are FIPS 140-2 Level 3 validated HSMs. The default deployed configuration, operating system, and firmware are also FIPS validated. You do not need to take any action for FIPS 140-2 Level 3 compliance.

Before requesting deprovisioning, a customer must have zeroized the HSM using Thales provided HSM client tools.

Dedicated HSM provisions Thales Luna 7 HSMs. Here's a summary of maximum performance for some operations:

• RSA-2048: 10,000 transactions per second
• ECC P256: 20,000 transactions per second
• AES-GCM: 17,000 transactions per second

The Thales Luna 7 HSM model A790 used includes a license for 10 partitions in the cost of the service. The device has a limit of 100 partitions and adding partitions up to this limit would incur extra licensing costs and require installation of a new license file on the device.

The maximum number of keys is a function of the memory available. The Thales Luna 7 model A790 in use has 32 MB of memory. The following numbers are also applicable to key pairs if using asymmetric keys.

• RSA-2048 - 19,000
• ECC-P256 - 91,000

Capacity varies depending on specific key attributes set in the key generation template and number of partitions.