Keep Your Keys Outside Azure: External Key Management for Managed HSM Is GA

If your regulator or sovereignty rules say you must keep physical control of your key-encryption keys, Azure Key Vault Managed HSM just got a lot more useful. External key management is now generally available.

The feature is available in all Azure public regions. It is aimed at organizations that need to retain control of their key-encryption keys while still letting supported Azure services use them for encryption. The article text is short, so check the original for the exact list of supported services and the setup details.

If key custody is part of your compliance story, this one is worth a careful read. Dive into the full technical breakdown here