Use Azure Key Vault Managed HSM When Required

Sign in to the Microsoft Azure Portal.

Navigate to Azure Key Vault Managed HSMs blade available at https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2FmanagedHSMs to list the Managed HSM instances available across your Microsoft Azure subscriptions.

Choose the Azure subscription that you want to examine from the Subscription equals all filter box and choose Apply.

If no Managed HSM instances are listed for the selected subscription, no dedicated hardware security module is currently provisioned within that subscription.

If one or more Managed HSM instances are listed, click on the name (link) of the instance that you want to examine and check the Status value on the Overview page. If Status is not Active, the Managed HSM instance has not been activated and is not yet available for use.

Repeat step no. 5 for each Managed HSM instance listed for the selected subscription.

Repeat steps no. 3 – 6 for each subscription available within your Microsoft Azure account.

Optionally, to check whether individual cryptographic keys are backed by a hardware security module, navigate to Policy available at https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Compliance and review the compliance state of the built-in policy definition Keys should be backed by a hardware security module (HSM) (Policy ID 587c79fe-dd04-4a5e-9d0b-f89598c7261b).

If your organization has a documented regulatory or compliance requirement mandating the use of a dedicated hardware security module, and no active Managed HSM instance is available in the audited scope, the selected scope is not compliant with this recommendation.

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
--query '[*].id'

The command output should return the requested subscription identifiers (IDs):

[
    "abcdabcd-1234-abcd-1234-abcdabcdabcd",
    "abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

Run keyvault list command (Windows/macOS/Linux) with custom query filters to list the name and type of each Key Vault vault and Managed HSM instance available in the selected Azure subscription. By default, this command lists both resource types; pass --resource-type hsm to list only Managed HSM instances:

az keyvault list
--query '[*].{name:name, type:type}'

The command output should return the requested resource names and types:

[
    {
        "name": "cc-project5-key-vault",
        "type": "Microsoft.KeyVault/vaults"
    },
    {
        "name": "cc-compliance-hsm",
        "type": "Microsoft.KeyVault/managedHSMs"
    }
]

Check whether any entry has a "type" value of "Microsoft.KeyVault/managedHSMs". If no entry returns this type, and your organization has a regulatory or compliance requirement mandating the use of a dedicated hardware security module, no Managed HSM instance is currently provisioned in the selected Azure subscription.

For each Managed HSM instance identified at the previous step, run keyvault show command (Windows/macOS/Linux) with the name of the Managed HSM instance as the identifier parameter to determine its activation status:

az keyvault show
--hsm-name cc-compliance-hsm
--query 'properties.provisioningState'

The command output should return the requested provisioning state:

"Activated"

If the command output does not return "Activated", the selected Managed HSM instance has not completed activation (that is, the security domain has not been downloaded) and cannot yet process key operations.

Repeat steps no. 4 – 7 for each subscription available within your Microsoft Azure account.

Sign in to the Microsoft Azure Portal.

Navigate to Azure Key Vault Managed HSMs blade available at https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2FmanagedHSMs to list the Managed HSM instances available across your Microsoft Azure subscriptions.

Choose Create.

On the Basics tab, provide the following information:

1. For Subscription, select the Azure subscription that you want to use.
2. For Resource group, select an existing resource group or choose Create new and provide a name.
3. For Managed HSM name, provide a unique name for the new Managed HSM instance.
4. For Region, select the Azure region where the Managed HSM instance should reside.
5. For Initial administrator(s), search for and select the Microsoft Entra users or groups that you want to designate as the initial Managed HSM administrators.

Adjust the settings on the Advanced, Networking, and Tags tabs as needed, then choose Review + create, followed by Create.

Once the deployment completes, click on the name (link) of the new Managed HSM instance to navigate to its Overview page.

In the Overview page, select Activate managed HSM, then follow the portal prompts to upload a minimum of three (maximum ten) RSA public key certificates and specify the quorum (the minimum number of private keys required to decrypt the security domain).

Choose Download to download the encrypted security domain file. Once the download completes successfully, the Status value for the Managed HSM instance changes to Active and the instance is ready to use.

Store the downloaded security domain file and the corresponding RSA private keys in a secure location; they are required for disaster recovery and to create additional Managed HSM instances that share the same security domain.

Repeat steps no. 3 – 9 for each Managed HSM instance that you need to provision.

Repeat steps no. 2 – 10 for each subscription available within your Microsoft Azure account.

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
--query '[*].id'

The command output should return the requested subscription identifiers (IDs):

[
    "abcdabcd-1234-abcd-1234-abcdabcdabcd",
    "abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to configure as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

Run ad signed-in-user show command (Bash on macOS/Linux, or Azure Cloud Shell on Windows) with custom output filters to get the object ID (OID) of the signed-in user and store it in a variable, to designate as the initial Managed HSM administrator. In PowerShell, use $oid = az ad signed-in-user show --query id -o tsv instead:

oid=$(az ad signed-in-user show --query id -o tsv)

Alternatively, prepare a space-separated list of object IDs for the Microsoft Entra users or groups that you want to designate as administrators.

Run keyvault create command (Windows/macOS/Linux) with the name of the new Managed HSM instance, the associated resource group, a retention period for soft-delete, and the administrator object ID(s) as parameters, to provision a new Managed HSM instance:

az keyvault create
--hsm-name cc-compliance-hsm
--resource-group cloud-shell-storage-westeurope
--location westeurope
--administrators $oid
--retention-days 90

The command output should return the configuration information available for the newly provisioned Managed HSM instance, including a "provisioningState" value of "Succeeded" and a "type" value of "Microsoft.KeyVault/managedHSMs". The Managed HSM instance cannot process key operations until it is activated in the following steps.

Run openssl req command (OSX/Linux/UNIX) three times to generate three self-signed RSA certificates, used as wrapping keys to activate the Managed HSM instance. The -nodes flag leaves the resulting private keys unencrypted on disk for this demonstration; for production environments, generate and store these RSA key pairs on an air-gapped system or protected key store instead, since they are required to recover the security domain:

openssl req -newkey rsa:2048 -nodes -keyout cert_0.key -x509 -days 365 -out cert_0.cer
openssl req -newkey rsa:2048 -nodes -keyout cert_1.key -x509 -days 365 -out cert_1.cer
openssl req -newkey rsa:2048 -nodes -keyout cert_2.key -x509 -days 365 -out cert_2.cer

Run keyvault security-domain download command (Windows/macOS/Linux) with the name of the Managed HSM instance, the paths to the RSA public key certificates generated in the previous step, and the required quorum, to download the security domain and activate the Managed HSM instance:

Note: Before running the command, ensure your workstation has direct network connectivity (port 443) to the Managed HSM data plane endpoint (<hsm-name>.managedhsm.azure.net). If public network access is disabled or restricted to specific networks/private endpoints, run this command from a host or virtual machine within the allowed virtual network; the download fails with a network/fetch error otherwise.

az keyvault security-domain download
--hsm-name cc-compliance-hsm
--sd-wrapping-keys cert_0.cer cert_1.cer cert_2.cer
--sd-quorum 2
--security-domain-file cc-compliance-hsm-SD.json

The command downloads the encrypted security domain to the file specified by --security-domain-file and produces no console output. Once the download completes successfully, the Managed HSM instance is in an active state and ready for use. Store the security domain file and the RSA private keys securely; they are required for disaster recovery or for creating another Managed HSM instance that shares the same security domain.

Repeat steps no. 5 – 9 for each Managed HSM instance that you need to provision.

Repeat steps no. 3 – 10 for each subscription available within your Microsoft Azure account.