Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure confidential computing helps protect data while it's being processed, from infrastructure you manage to fully managed services. Choose the approach that fits your workload and the level of control you need:
- Virtual machines and containers: Run your applications in hardware-backed trusted execution environments, including workloads that need GPU acceleration.
- Confidential services: Use data, AI, and messaging services that integrate confidential computing to protect data in use.
- Supplementary offerings: Support your workloads with key protection, attestation, and integrations for desktop, batch, migration, and backup scenarios.
Virtual machines and containers
Azure supports confidential workloads with AMD SEV-SNP and Intel Trust Domain Extensions (TDX). These technologies help protect code and data while they're in use. Both AMD SEV-SNP and Intel TDX confidential VMs support lift-and-shift migration scenarios.
- AMD SEV-SNP confidential VMs (generally available): DCasv5 and ECasv5 provide memory protection against privileged access. DCasv6 and ECasv6 are also generally available and provide higher performance.
- Intel TDX confidential VMs (generally available): DCesv6 and ECesv6 provide VM-level confidentiality for general-purpose and memory-optimized workloads.
- Confidential GPU VMs (generally available): NCCadsH100v5 combine GPU acceleration with linked CPU and GPU TEEs for sensitive AI and machine learning workloads.
- Confidential AKS worker nodes (generally available): Confidential VM Azure Kubernetes Service (AKS) worker nodes run Kubernetes worker nodes on AMD SEV-SNP confidential VMs.
- Confidential containers on Azure Container Instances (generally available): Confidential containers on Azure Container Instances provide container-level integrity and attestation with confidential computing enforcement (CCE) policies.
- Confidential containers on AKS (public preview): Confidential containers on AKS provide container-level isolation for sensitive Kubernetes workloads by using hardware-backed TEEs and security policies.
- Confidential containers on Azure Red Hat OpenShift (generally available): Deploy confidential containers on Azure Red Hat OpenShift to protect containerized workloads with confidential computing.
- Azure Container Apps, including Azure Functions (generally available): Confidential compute in Azure Container Apps uses DC-series dedicated workload profiles to protect containerized workloads. Azure Functions on Azure Container Apps can use these profiles to run event-driven function apps on confidential compute infrastructure.
Confidential services
Azure also provides first-party platform and software services built on confidential computing. The updated portfolio groups these offerings into data, AI, and foundational services.
Data services
- Azure Database for PostgreSQL (generally available): Confidential computing for Azure Database for PostgreSQL protects database workloads by running on confidential compute infrastructure.
- SQL Server on Azure confidential VMs (generally available): Deploy SQL Server to an Azure confidential VM to protect SQL Server workloads while data is in use.
- SQL Always Encrypted with secure enclaves (generally available): Always Encrypted with secure enclaves enables protected query processing inside a TEE.
- Azure Databricks on confidential VMs (generally available): Configure Azure Databricks compute with confidential VM types to protect lakehouse workloads.
- Azure Data Explorer on confidential VMs (public preview): The confidential VM option for Azure Data Explorer helps protect analytics workloads during processing.
- Azure confidential ledger (generally available): Azure confidential ledger is a tamper-evident, write-once store for sensitive records and audit scenarios.
- Azure Confidential Clean Rooms (private preview): Azure Confidential Clean Rooms enables multiparty collaboration and analysis of sensitive data in a protected environment.
AI services
- Azure AI Search (generally available): Enable confidential computing for Azure AI Search to protect search workloads during processing.
- Confidential inferencing with Azure OpenAI Whisper (private preview): Confidential inferencing with the Azure OpenAI Whisper model supports protected inferencing with TEEs, encrypted prompts, user anonymity, and OHTTP.
Foundational services
- Azure Service Bus Premium (generally available): Confidential computing for Azure Service Bus protects messaging data in use for queues, topics, and subscriptions. Enable it when creating a Premium namespace without changing application code. For more information, see the Service Bus Premium general availability announcement.
- Azure Event Hubs Dedicated (generally available): Confidential computing for Azure Event Hubs protects event data in use with hardware-based isolation. Enable it when creating a Dedicated namespace without changing application code. For more information, see the Event Hubs Dedicated announcement.
- Azure Event Grid (private preview): Confidential computing support for Azure Event Grid extends the portfolio to event distribution. The linked product overview describes Event Grid; confidential computing support is in private preview.
Availability varies by service, tier, and region. Check the linked product documentation for supported configurations and limitations.
How Microsoft uses Azure confidential computing
Microsoft uses Azure confidential computing in first-party services and operations. These patterns align with the Secure Future Initiative (SFI) principles: secure by design, secure by default, and secure in operations.
The July 2026 SFI progress report, Microsoft's fourth report, describes progress across the initiative: three objectives reached their target state, three objectives are nearing completion, and twelve objectives made significant progress. For Azure, the report highlights Azure Integrated HSM as strengthening hardware-rooted trust for cloud and AI workloads through hardware-backed cryptographic key protection and greater transparency across published firmware, drivers, and software components.
Examples of Microsoft use include:
- Microsoft Entra ID: Protect key material and identity infrastructure workloads to reduce unauthorized access risk.
- Microsoft cryptographic and code-signing services: Isolate sensitive signing and cryptographic operations in TEEs to support high-volume service transactions.
- Data and analytics workflows (including Azure Databricks): Run analytics pipelines on confidential VMs to help protect data during processing.
- Privacy Sandbox workloads: Apply hardware-backed isolation to improve user privacy while preserving platform functionality.
- Payment processing workloads (including Microsoft Pay): Protect payment data while it is being processed.
- End-user computing scenarios (including Azure Virtual Desktop): Cryptographically isolate guest workloads in high-risk and highly regulated access scenarios.
Common benefits from these deployments include:
- Reduced exposure of sensitive data in memory by processing data inside hardware-backed TEEs.
- Lower insider and operator-access risk through attestation, policy enforcement, and workload isolation.
- Stronger compliance posture for identity, payments, and privacy-sensitive scenarios.
- Broader "encrypt data in use" patterns across platform and application services.
For the published status and customer guidance, see the July 2026 SFI progress report and full report (PDF). Check the SFI hub for subsequent updates.
Supplementary offerings
The updated portfolio includes the following generally available infrastructure services alongside confidential VMs and GPUs:
- Azure Integrated HSM (generally available): Azure Integrated HSM provides dedicated, low-latency, FIPS 140-3 Level 3 key protection in Azure infrastructure.
- Azure Key Vault Managed HSM (generally available): Azure Key Vault Managed HSM provides a single-tenant, standards-compliant HSM service for key protection.
- Microsoft Azure Attestation (generally available): Azure Attestation provides remote attestation for TEEs and verifies workload integrity.
- Azure Virtual Desktop on confidential VMs (generally available): Deploy Azure Virtual Desktop on confidential VMs to help protect desktop sessions with encryption in memory and hardware-backed trust.
- Azure Batch on confidential VMs (generally available): Run batch workloads on confidential VMs. Use the Batch pool VM size guidance to check supported VM sizes in your region.
Related security capabilities include:
- Trusted Launch adds secure boot, virtual trusted platform module, and boot integrity monitoring to Generation 2 VMs.
- Trusted Hardware Identity Management manages TEE certificate caches in Azure and provides trusted computing base information for attestation baselines.
The portfolio also includes new integrations for migrating and protecting confidential VM workloads:
- New: Azure Migrate support for confidential VMs (public preview): Migrate on-premises Windows and Linux VMs to Azure confidential VMs by using Azure Migrate.
- New: Azure Backup support for confidential VMs (public preview): Back up confidential VMs by using Azure Backup to protect supported OS-disk encrypted confidential VMs with platform-managed or customer-managed keys. Review the product support matrix for supported VM series, regions, and backup and restore capabilities.