{"id":59176,"date":"2026-10-18T11:01:29","date_gmt":"2026-10-18T01:01:29","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/why-managed-hsm-external-keys-matter-for-australian-sovereignty\/"},"modified":"2026-10-18T11:02:36","modified_gmt":"2026-10-18T01:02:36","slug":"why-managed-hsm-external-keys-matter-for-australian-sovereignty","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/why-managed-hsm-external-keys-matter-for-australian-sovereignty\/","title":{"rendered":"Why Managed HSM External Keys Matter for Australian Sovereignty"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post <strong>Why Managed HSM External Keys Matter for Australian Sovereignty<\/strong> we will explain how Microsoft\u2019s newly generally available external key management capability works, when Australian organisations may need it, and where it can create unexpected cost and operational risk.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The problem is familiar. Your data may be stored in an Australian Azure region, but a regulator, customer or board member asks a harder question: \u201cWho physically controls the keys that could unlock it?\u201d Until now, organisations with strict key-custody requirements often faced a choice between accepting cloud-managed key infrastructure or building a complicated custom solution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Key Vault Managed HSM external key management changes that choice. Managed HSM is Microsoft\u2019s dedicated service for protecting encryption keys inside tamper-resistant hardware. External key management allows the most sensitive key material to remain in a hardware security module, or HSM, operated outside Microsoft\u2019s infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the technology actually does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Encryption turns readable business data into information that cannot be understood without the correct key. An HSM is a specialised physical device designed to create, store and use those keys without exposing them like an ordinary file or password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure services normally use one key to encrypt the data and another higher-level key to protect that first key. Think of it as placing your documents in a locked safe, then protecting the safe\u2019s key inside a second, more secure vault.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With external key management, that higher-level key stays in an HSM controlled by your organisation or an approved HSM provider. Microsoft\u2019s systems can request an approved cryptographic operation, but the external key itself does not need to enter Microsoft infrastructure.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Supported Azure service\n \u2193\nAzure Managed HSM authorises the request\n \u2193\nExternal key management proxy translates the request\n \u2193\nYour external HSM performs the key operation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The proxy is a secure connector between Azure Managed HSM and the external HSM. Connections are protected using mutual TLS, which means both systems verify each other\u2019s identity before exchanging a request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, your business data is not sent to the external HSM. Azure continues encrypting and decrypting the data. The external HSM only protects the data-encryption key, helping reduce the amount of information moving between systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why general availability matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">General availability means external key management has moved beyond public preview and is supported for production use. It is available across Azure public regions, although it must be enabled for the relevant subscription and only works with Azure services that support customer-managed keys through Managed HSM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the Azure Private Link connection option remains in preview. Private Link provides a private network path rather than exposing the external key management proxy through a public endpoint. Organisations with policies prohibiting public endpoints should examine this limitation before approving a production design.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">General availability also does not mean every organisation should adopt it. Microsoft\u2019s guidance is clear that externally held keys are mainly intended for situations where legal, regulatory or contractual requirements demand that key material remain physically outside Microsoft infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">It strengthens sovereignty but does not guarantee it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Data sovereignty is broader than choosing an Australian Azure region. It includes where data is stored, which laws apply, who can administer the environment, where support personnel are located and who controls the encryption keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">External key management directly addresses the last point. An Australian organisation could operate its external HSM in Australia, under its own security procedures, with access limited to authorised local personnel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That can provide a stronger answer during a customer audit. Instead of saying that Microsoft cannot access a cloud-managed key, the organisation can show that the key material is physically held within infrastructure it selected and controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But external key custody does not automatically make a workload sovereign or compliant. If data is copied overseas, accessed by offshore administrators or sent to an international AI service, keeping the key in Australia does not remove those concerns.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Australian Privacy Principle 8 can also make an organisation accountable for how an overseas recipient handles personal information. An Australian encryption key is a useful control, but it does not replace privacy assessments, contracts, access restrictions and an accurate record of where information travels.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same principle applies to AI workloads. Key ownership cannot correct a design that sends sensitive prompts, documents or model data to an unsuitable location. Our article on AI export controls as a board-level risk explains why location, suppliers and contractual controls need to be considered together.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The biggest trade-off is operational responsibility<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Holding your own key gives you more control, but it also gives you more ways to cause an outage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft remains responsible for Azure Managed HSM. Your organisation becomes responsible for the external HSM, the proxy, network connectivity, monitoring, certificates, backups and recovery processes. Microsoft\u2019s service-level commitment does not cover the entire external key path.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the proxy becomes unavailable or the external HSM cannot respond, dependent Azure workloads may be unable to access the keys they need. Azure itself could be operating normally while your application remains unavailable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Losing an external key can be even more serious. Azure stores a reference to the key, not the key material itself. External key backup and recovery are therefore your responsibility. If the key is permanently lost and no usable backup exists, access to protected workloads could also be permanently lost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is why external key management must be treated as business-critical infrastructure, not simply another security setting. It needs redundant connectivity, tested recovery procedures, carefully separated administrator roles and round-the-clock alerting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These resilience considerations should form part of the same planning process described in our guide to building stronger Azure resilience.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical Australian scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person financial services firm bidding for work with a larger regulated organisation. Its Azure environment is hosted in Australia and already uses customer-managed encryption keys, but the contract requires the key-holding hardware to sit outside the cloud provider\u2019s operational boundary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">External key management could allow the firm to keep using supported Azure services while placing the controlling key in an Australian-operated HSM. That may remove a procurement barrier without forcing the company to rebuild the application on private infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is not simply \u201cbetter encryption\u201d. It is the ability to satisfy a key-custody requirement, reduce contract risk and demonstrate clear control during an audit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, if the contract only asks for customer-controlled keys and does not require physical separation from Microsoft, standard Managed HSM may be the better choice. It provides dedicated, single-tenant, hardware-protected key storage with less complexity and stronger built-in availability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Five questions to answer before proceeding<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Is external custody genuinely required?<\/strong> Ask for the exact legal, contractual or policy wording. Do not add cost because someone used \u201csovereignty\u201d as a general concern.<\/li>\n<li><strong>Which workloads need it?<\/strong> Apply the control to specific high-risk data rather than every Azure service by default.<\/li>\n<li><strong>Can the service use external keys?<\/strong> Confirm that each Azure service supports customer-managed keys through Managed HSM.<\/li>\n<li><strong>Who owns availability?<\/strong> Assign responsibility for the proxy, HSM, certificates, monitoring, incident response and vendor support.<\/li>\n<li><strong>Has recovery been tested?<\/strong> Test key backup, rotation, regional failure and loss of connectivity before protecting production data.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">How this fits with Essential Eight<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">External key management does not, by itself, achieve Essential Eight compliance. Essential Eight is the Australian government\u2019s baseline cybersecurity framework covering controls such as patching, multi-factor authentication, restricted administrator access and reliable backups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Secure key management supports a broader security program, particularly for sensitive or regulated workloads. It should sit alongside identity protection, device controls, vulnerability management, monitoring and tested recovery rather than replacing them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The right outcome is proportionate control<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Managed HSM external key management is an important option for Australian organisations with strict sovereignty requirements. It creates a clearer separation between the cloud platform and the hardware holding the most sensitive encryption key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most businesses, though, standard Azure Managed HSM will remain the simpler and more resilient choice. The decision should be driven by evidence from contracts, regulations and risk assessments\u2014not by the assumption that more control is automatically safer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc is a Melbourne-based Microsoft Partner and Wiz Security Integrator with more than 20 years of enterprise IT experience. We help organisations assess Azure security, key management and sovereignty requirements without turning every compliance concern into an oversized technology project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether external key management is necessary for your workloads, we are happy to review the requirement and your current Azure design\u2014no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Microsoft\u2019s Managed HSM external key management is now generally available. Here is what Australian leaders need to know about key custody, data sovereignty, compliance and operational risk.<\/p>\n","protected":false},"author":1,"featured_media":59178,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[46,19,13,130],"tags":[],"class_list":["post-59176","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure-key-vault","category-azure-security","category-blog","category-cybersecurity-strategy-governance"],"jetpack-related-posts":[{"id":59179,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/keeping-your-keys-yours-with-external-key-management-in-azure\/","url_meta":{"origin":59176,"position":0},"title":"Keeping Your Keys Yours with External Key Management in Azure","author":"CPI Staff","date":"October 18, 2026","format":false,"excerpt":"External key management can strengthen data sovereignty, but it also introduces new costs and risks. Here is what Australian technology leaders should assess before adopting it.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png 1x, \/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png 1.5x, \/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png 2x, \/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png 3x, \/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png 4x"},"classes":[]},{"id":59277,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/azure-application-gateway-keyless-tls-without-slowing-delivery\/","url_meta":{"origin":59176,"position":1},"title":"Azure Application Gateway Keyless TLS Without Slowing Delivery","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside protected hardware while Application Gateway handles secure traffic. Learn where it fits, what it changes and how to adopt it safely.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 2x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 3x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 4x"},"classes":[]},{"id":56780,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/security-best-practices-for-azure-ai-services\/","url_meta":{"origin":59176,"position":2},"title":"Security Best Practices for Azure AI Services","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Practical, step-by-step guidance to secure Azure AI services end to end\u2014identity, networks, data, prompts, and monitoring\u2014so your teams can innovate confidently without exposing your organisation.","rel":"","context":"In &quot;Azure AI Services&quot;","block_context":{"text":"Azure AI Services","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-ai-services\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1.5x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 2x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 3x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 4x"},"classes":[]},{"id":59129,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/16\/vmware-to-azure-migration-security-choices-cios-face-in-2026\/","url_meta":{"origin":59176,"position":3},"title":"VMware to Azure Migration Security Choices CIOs Face in 2026","author":"CPI Staff","date":"October 16, 2026","format":false,"excerpt":"Moving VMware workloads to Azure involves more than choosing VM sizes. CIOs must decide where Confidential VMs, Secure Boot and the right encryption model reduce risk without inflating cost.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1.5x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 2x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 3x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 4x"},"classes":[]},{"id":53906,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-to-secure-api-keys-with-python\/","url_meta":{"origin":59176,"position":4},"title":"How to Secure API Keys with Python","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Practical patterns to protect API keys in Python. Learn safe storage, retrieval, rotation, and CI\/CD hygiene with code examples and cloud options.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 1x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 1.5x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 2x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 3x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 4x"},"classes":[]},{"id":58540,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now\/","url_meta":{"origin":59176,"position":5},"title":"The Azure Key Vault SDK Fix CIOs Should Ask Teams to Assess Now","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A critical Java SDK flaw could weaken local checks on encrypted data. Here is what CIOs should ask engineering teams to find, patch and prove.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 1x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 1.5x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 2x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 3x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59176"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59176\/revisions"}],"predecessor-version":[{"id":59177,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59176\/revisions\/59177"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59178"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}