Azure Managed HSM (MHSM) External Key Manager (EKM) enables hold-your-own-key (HYOK) workflows with Azure Managed HSM. Azure sends data encryption keys (DEKs) to the CSP Vault for Cloud Keys, which acts as the EKM. The DEKs are encrypted and decrypted using key encryption keys (KEKs) stored in the vault.

This feature supports both Azure keysets and Azure Local keysets. This section provides information about the following topics:

For information about configuring Azure Managed HSM, see the Microsoft Azure Managed HSM documentation.

Microsoft has not publicly released the libraries required for this feature. These libraries are not included in the CSP platform by default. To use Azure Managed HSM EKM, schedule a call with Entrust Support: https://www.entrust.com/contact-support. Entrust Support will load the required libraries onto the system using a full support login.