Trusted Execution Environment (TEE)

A Trusted Execution Environment (TEE) helps protect code and data while they're in use.

What is a TEE?

A TEE is an isolated area of CPU and memory protected by hardware encryption. Code outside the TEE can't read or modify TEE data. Only authorized code can access it.

Code inside the TEE runs in plaintext for execution, but appears encrypted to anything outside the boundary. A platform security processor on the CPU manages this protection.

Azure confidential computing has two primary models: VM-level TEE isolation for broad adoption, and enclave-based models for specialized applications.

The VM-level model uses AMD SEV-SNP (general availability) or Intel Trust Domain Extensions (TDX) to encrypt VM memory. It supports many lift-and-shift VM and container workloads without code changes.

The enclave-based model uses CPU features such as Intel Software Guard Extensions (SGX) to create protected memory regions inside a VM. This model is typically used for specialized or existing enclave-native applications.

Both technologies underpin confidential infrastructure as a service (IaaS) and platform as a service (PaaS) offerings on Azure.

New graphics processing unit (GPU) designs also support TEE capabilities. You can combine GPU and CPU TEEs, such as the NVIDIA-based confidential GPU offering, to support trustworthy AI workloads.

Related content

For technical information on how the TEE is implemented across different Azure hardware, see:

• AMD SEV-SNP confidential VMs
• Intel TDX VMs
• NVIDIA hardware
• Intel SGX-enabled VMs (specialized scenarios)