The useful question is what changes for users, developers or buyers, and whether the announcement stays industry context or becomes something people can actually use.

Azure Key Vault Managed HSM already provides strong key sovereignty by generating and storing encryption keys in dedicated, single-tenant FIPS 140-3 Level 3 HSMs that only the customer controls. Microsoft operators cannot access the key material, and the service uses hardware-enforced isolation to prevent unauthorized access. This setup meets most regulatory needs, but some organizations require keys to reside physically outside Azure datacenters. External key management now addresses this by enabling cryptographic operations to invoke keys stored on customer-owned or third-party HSMs. The feature is designed for highly regulated sectors such as government, financial services, and critical infrastructure, where data-sovereignty rules mandate external key storage.

External key management extends Managed HSM through a dedicated API endpoint that connects directly to the customer-controlled HSM, allowing cryptographic operations in Azure to use keys without storing them in Microsoft infrastructure. The external key never resides in or passes through Azure, and the customer can disconnect the hardware at any time to halt operations. Microsoft does not build or operate the integration proxy; instead, customers can use vendor-provided implementations, rely on partners, or develop their own solutions. This open model shifts operational responsibility to the customer, reflecting the trade-off between increased control and added management overhead.

The feature is currently in public preview, with Microsoft seeking customer feedback to refine operational guidance, vendor integrations, and prioritized scenarios for general availability. External key management is intended for workloads where regulatory or contractual obligations require keys to remain outside the cloud provider’s environment. For most organizations, Managed HSM’s native approach remains recommended due to higher availability, reduced complexity, and a security posture that meets or exceeds sovereignty requirements without additional risk.

External key management represents the latest step in Microsoft’s effort to provide granular control over key protection, allowing organizations to maintain secure, scalable operations while adhering to strict data-sovereignty mandates. The feature complements Managed HSM’s existing capabilities, offering an alternative for scenarios where physical key residency outside Azure is non-negotiable. Customers are encouraged to evaluate whether the added control aligns with their operational and regulatory needs before adopting external key management.