Thales announces Luna Network Hardware Security Modules (HSMs) are now integrated with Microsoft Azure External Key Management (EKM), helping you protect sensitive cloud data while retaining control of your encryption keys outside Azure. Through Azure Key Vault Managed HSM, the integration extends customer-managed key (CMK) capabilities with a Hold Your Own Key (HYOK) model, keeping your master encryption keys in a customer-controlled Luna HSM environment.
As you move sensitive workloads to the cloud, control over encryption keys remains central to data security and digital sovereignty. This integration lets you use Azure services while maintaining key custody on-premises or with a trusted hosting provider. Externally held keys are accessible only through explicit customer authorization, separating cloud operations from customer-controlled cryptographic services.
What this means for your organization
- Retain key control: Keep your customer-managed keys outside the cloud provider’s environment, reducing reliance on the provider for key custody.
- Support compliance objectives: Strengthen data control and access governance to help address requirements associated with GDPR, PCI-DSS, and Schrems II.
- Strengthen separation of duties: Keep Azure operations separate from customer-controlled key services, with critical key wrap and unwrap operations performed in your HSM infrastructure.
- Choose your deployment model: Support on-premises, hosted, and hybrid environments with high-assurance, tamper-resistant Luna Network HSMs.
Luna Network HSMs store, protect, and manage cryptographic keys in a FIPS 140-3 Level 3 tamper-resistant environment to address stringent security and compliance requirements. They integrate with a wide range of applications to accelerate cryptographic operations and provide a quantum-safe root of trust for your entire cryptographic infrastructure.
About the solution
Azure services encrypt your data using data encryption keys (DEKs). Azure Key Vault Managed HSM coordinates the supporting key operations within a Confidential Computing environment, while the external key management proxy API connects Azure to your customer-controlled Luna HSMs. Critical key wrap and unwrap operations take place in the external HSM infrastructure, so Microsoft does not hold your externally stored master keys. This separates cloud-based data processing from external key custody, reinforcing your control over how protected data is accessed.
Learn more
For more details, download the solution brief, contact your Thales representative, or consult the Thales Customer Support Portal (KB Article: KB0031051