Services that support customer managed keys (CMKs) in Azure Key Vault and Azure Managed HSM
The following services support server-side encryption with customer managed keys in Azure Key Vault and Azure Managed HSM. For implementation details, see the service-specific documentation or the service's Microsoft Cloud Security Benchmark: security baseline (section DP-5).
AI and machine learning
Analytics
Containers
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Azure Kubernetes Service | Yes | Yes | Enable host encryption on your AKS cluster nodes |
| Azure Red Hat OpenShift | Yes | Bring your own keys (BYOK) with Azure Red Hat OpenShift | |
| Container Instances | Yes | Encrypt data with a customer-managed key | |
| Container Registry | Yes | Encrypt container images with a customer-managed key |
Compute
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| App Service | Yes* | Yes | Configure customer-managed keys for App Service |
| Azure Functions | Yes* | Yes | Configure customer-managed keys for Azure Functions |
| Azure HPC Cache | Yes | Use customer-managed keys with HPC Cache | |
| Azure Managed Applications | Yes* | Yes | Azure managed applications overview |
| Azure portal | Yes* | Yes | Security in the Azure portal |
| Azure VMware Solution | Yes | Yes | Configure customer-managed keys in Azure VMware Solution |
| Batch | Yes | Use customer-managed keys with Batch accounts | |
| SAP HANA | Yes | ||
| Site Recovery | Yes | Enable replication with customer-managed keys | |
| Virtual Machine Scale Set | Yes | Yes | Encrypt virtual machine scale sets using the portal |
| Virtual Machines | Yes | Yes | Azure Disk Encryption for Windows and Linux VMs |
Databases
Hybrid + multicloud
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Azure Stack Edge | Yes | Protect data at rest on Azure Stack Edge Pro R |
Integration
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Azure Health Data Services | Yes | Configure customer-managed keys for Azure Health Data Services DICOM, Configure customer-managed keys for Azure Health Data Services FHIR | |
| Event Hubs | Yes | Configure customer-managed keys for encryption | |
| Logic Apps | Yes | ||
| Service Bus | Yes | Configure customer-managed keys for encryption |
IoT services
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Device Update for IoT Hub | Yes | Yes | Data encryption for Device Update for IoT Hub |
| IoT Hub Device Provisioning | Yes |
Management and governance
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| App Configuration | Yes | Use customer-managed keys to encrypt data | |
| Automation | Yes | Encryption of automation assets | |
| Azure Migrate | Yes | Tutorial: Migrate VMware VMs to Azure | |
| Azure Monitor | Yes | Customer-managed keys in Azure Monitor |
Media
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Azure Communication Services | Yes | Data encryption in Azure Communication Services | |
| Media Services | Yes | Use your own encryption keys with Azure Media Services |
Security
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Azure Information Protection | Yes | How are the Azure Rights Management cryptographic keys managed and secured? | |
| Microsoft Defender for Cloud | Yes | Customer-managed keys in Azure Monitor | |
| Microsoft Defender for IoT | Yes | ||
| Microsoft Sentinel | Yes | Yes | Encryption at rest in Microsoft Sentinel |
Storage
Other
| Product, Feature, or Service | Key Vault | Managed HSM | Documentation |
|---|---|---|---|
| Universal Print | Yes | Data encryption in Universal Print |
Caveats
* This service supports storing data in your own Key Vault, Storage Account, or other data persisting service that already supports Server-Side Encryption with Customer-Managed Key.
** Any transient data stored temporarily on disk such as pagefiles or swap files are encrypted with a Microsoft key (all tiers) or a customer-managed key (using the Enterprise and Enterprise Flash tiers). For more information, see Configure disk encryption in Azure Cache for Redis.