Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM

As cloud computing grows more autonomous and AI systems manage increasingly critical data, building trust directly into the infrastructure becomes essential. The Azure Integrated Hardware Security Module (HSM) offers hardware-enforced key protection within Azure, ensuring cryptographic trust flows from hardware to services through a verifiable and transparent design.

As cloud workloads evolve and AI manages vital data, embedding trust into our infrastructure at every level is crucial. At Microsoft, we integrate security at the very core of our cloud systems, spanning from hardware to services. With the Azure Integrated HSM, Microsoft is transforming how we ensure cryptographic trust in cloud environments.

The Azure Integrated HSM is a robust, tamper-resistant hardware security module created by Microsoft and is incorporated into all new Azure servers. This system enhances current key management services by providing hardware-backed protection directly at the execution stage of workloads. This method shifts security from being solely dependent on centralized services, making hardware-supported security an intrinsic feature of the compute platform itself.

Designed to comply with FIPS 140-3 Level 3, a gold standard for hardware security modules used by various governments and regulated industries globally, Azure Integrated HSM ensures strong tamper resistance, isolation via hardware, and protection against both physical and logical key extraction. By embedding these security guarantees directly into the platform, Azure makes high compliance levels standard rather than a specialised setting or added premium feature.

Enhancing Trust through Transparency with Open-Source Designs

Our philosophy for hardware security is straightforward: transparency breeds trust, and collaboration within the industry boosts security. Openness allows customers, partners, and regulators to verify design decisions and security boundaries.

Recently, at the Open Compute Project (OCP) EMEA Summit, we shared our intention to open the Azure Integrated HSM to the wider open hardware community. Through OCP, we plan to provide the Azure Integrated HSM firmware, driver, and software stack as open source, and establish an OCP workgroup to oversee ongoing development—including architectural designs, protocol specifications, firmware, and hardware. You can find the Azure Integrated HSM firmware on the Azure Integrated HSM GitHub repository, along with independent validation resources such as the OCP SAFE audit report.

This openness is particularly vital for regulated sectors and sovereign cloud scenarios, where independent validation of security measures is paramount. By allowing key components to be reviewed by outsiders, Azure Integrated HSM empowers customers, partners, and regulators to evaluate implementation details transparently instead of relying solely on vendor claims.

This strategy bolsters confidence in the platform and lays a more transparent and verifiable foundation for cloud security while cutting down on dependence on proprietary vendor protocols. In an era where cryptographic trust underpins everything from AI computing to national digital infrastructure, open-sourcing the HSM is a significant step toward interoperability, auditability, and building customer trust.

A Layered Strategy for Key Management

This innovative design complements services such as Azure Key Vault and Azure Managed HSM, which provide centralized key lifecycle management, governance, and policy enforcement. With Azure Integrated HSM, we introduce an additional layer that secures cryptographic protection right down to the individual server. This ensures keys are safeguarded not only when stored but also while actively used by workloads. Azure Integrated HSM also adheres to industry standards like TDISP, ensuring a secure link between the HSM and confidential computing environments.

Azure Integrated HSM will soon be available on Azure V7 virtual machines for all customers worldwide.

Establishing a New Benchmark for Server-Located Key Protection at Scale

With Azure Integrated HSM, encryption keys are generated, stored, and utilised entirely within secure hardware. These keys are designed never to appear in host or guest memory, nor in any software processes, including during cryptographic operations. By keeping keys within the hardware boundary at all times, Azure Integrated HSM effectively removes entire classes of attacks aimed at key and credential exfiltration from memory or software layers.

This development empowers true customer control, enforced by the hardware instead of mere policies. Security no longer relies on operational procedures or complex isolation assumptions; it is an intrinsic hardware feature.

Traditional cloud security methods depend on centralised HSM services accessed over the network. While effective, these approaches can introduce shared risks, scalability issues, and performance limitations as workloads expand.

By anchoring cryptographic protection directly to the server, security naturally scales with computing power. This method avoids shared bottlenecks, unnecessary network delays, and the need to compromise performance for security. As Azure grows, so does its security.

Thanks to hardware roots of trust, verified boot, and attestation, Azure Integrated HSM transforms trust into a verifiable feature rather than just a contractual agreement. Customers and regulators can cryptographically validate that approved hardware, firmware, and configurations are intact, further reaffirmed by the open-source firmware. Trust becomes something you can verify, not just something you accept.

These features together create a new standard for cloud security, where hardware-enforced, verifiable trust becomes the norm for modern workloads—from foundational infrastructure services to next-generation AI applications. When combined with confidential computing, open silicon roots of trust, Azure Boost, and datacentre-level secure control modules, Azure Integrated HSM helps to forge an unbroken chain of trust from hardware to software.

We welcome customers, partners, and the wider open-source community to contribute to our architecture and help shape the future of standards. Together, we can develop secure, sovereign, and open cloud infrastructure ready for future challenges.

For further details, check out the announcement blog and learn more about Azure Security.