Microsoft lets Azure customers keep root encryption keys outside Azure

What it shows

A steel lockbox with a key card in its front slot; the green card stands for the root encryption key kept in the customer's own hardware.

Its labels

• New: The root key can stay in hardware the customer runs
• The root key is the one that unlocks the other keys
• Or run through a trusted third party

The story

Microsoft lets Azure customers keep root encryption keys outside Azure · 22 Oct 2026