---
title: "Azure Key Vault Bring Your Own Key"
slug: "fortanix-dsm-azure-key-vault-byok-bring-your-own-key"
updated: 2026-08-27T08:01:43Z
published: 2026-08-27T08:01:43Z
canonical: "support.fortanix.com/fortanix-dsm-azure-key-vault-byok-bring-your-own-key"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Key Vault Bring Your Own Key

## 1.0 Introduction

This article describes how to perform Bring Your Own Key (BYOK) lifecycle management in Azure Key Vault (AKV) using Fortanix-Data-Security-Manager (DSM). The Fortanix solution for AKV offers complete BYOK, as explained in this article, as well as Cloud Native Key Management Service (CNKMS) with complete lifecycle management for automation.

## 2.0 Getting Started with Fortanix Cloud Data Control

*To understand which solution between CNKMS, BYOK, Bring Your Own KMS or Bring Your Own Encryption (BYOE) is right for you, refer to* [*Fortanix DSM - Cloud Data Control - Getting Started*](/v1/docs/fortanix-dsm-cloud-data-control-getting-started)*.*

## 3.0 Azure Key Vault Group Setup and Cloud Native Key Management

*For more information on how to set up an Azure-backed group in Fortanix DSM, refer to* [*Fortanix DSM - Azure Key Vault Group Setup*](/v1/docs/fortanix-dsm-azure-key-vault-cdc-group-setup)*.*

*For more information on how to perform native key lifecycle management in Azure Key Vault using Fortanix DSM, refer to* [*Fortanix DSM - Azure Key Vault Cloud Native Key Management*](/v1/docs/fortanix-dsm-azure-key-vault-cloud-native-key-management).

## 4.0 Fortanix Azure BYOK Workflows Overview

- **Generate key**: Navigate to a source key in Fortanix DSM and copy the key into an Azure CDC group to create a linked key and a BYOK key in Azure Key Vault.
- **Rotate source key:** Rotate the source key that was originally generated in "Fortanix DSM" and click “rotate linked/copied keys”.
- **Disable/Enable**: Navigate to the detailed view of the key in the Azure CDC group and disable or enable it from Fortanix DSM.
- **Soft key deletion**: Azure will not allow you to natively delete a key directly unless you explicitly schedule it for deletion and the mandatory waiting period expires (you can set it anywhere from 7 to 90 days in Azure Key Vault, with 90 days being the default). Additionally, you can enable “Purge Protection” using Azure to avoid manual Purge of keys. If enabled, a mandatory retention period is enforced for deleted keys. If disabled, the keys can be purged during the retention period (you can set the retention period anywhere from 7 to 90 days in Azure Key Vault, with 90 days being the default). *For more information, refer to* [*Azure Key Vault soft-delete overview*](https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview)*.*

Navigate to the detailed view of an Azure virtual key and in the **AZURE KEY DETAILS** tab, click the link **SOFT DELETE KEY**.

## 5.0 Fortanix DSM Azure KMS Security Objects

You can generate a key in a configured Azure KMS (Software-backed or HSM-backed Key Vault).

### 5.1 Bring Your Own Key - Copy Key to Azure Key Vault

Use this option when you want to create a key in Fortanix DSM and then import it into the configured Azure Key Vault. The Copy Key to Azure feature allows you to transfer a security object from one Fortanix DSM group to another, including to an Azure CDC Fortanix DSM group.

This feature has the following advantages:

- Maintains a single source of key material while using/importing that key into various Fortanix DSM groups, where applications may need to use a single key to meet business objectives.
- Maintains a link of various copies of the same key material to the source key for the ability to name and rotate keys everywhere, all at once, as well as for audit and tracking purposes.

The following action happens during the copy key operation:

- A new key will be created in the target group: The new key will have the same key material as the original.
- The source key links to the copied keys: There will be a link maintained from all copied keys to the source key.
- The source key will also have basic metadata-based information about the linked keys, such as:
  - Copied by <user-name/app id>
  - Date of Copy <time stamp>
  - Target copy group name

> [!NOTE]
> NOTE
> 
> The name of the copied key is suggested automatically to you as `[original key name]_[copy1,2,...]`, but you can replace it with an alternative unique name, if required.

Perform the following steps to copy a key from a regular Fortanix DSM group to an Azure CDC group:

1. Generate an RSA or EC key in Fortanix DSM, if the key is not already present. *To create the key, refer to* [*Generate Security Objects*](/docs/v1/docs/users-guide-fortanix-data-security-manager-key-lifecycle-management#112-generate-security-objects)*.*
2. Go to the detailed view of the key and click **COPY KEY** available on the top right of the screen.

> [!NOTE]
> NOTE
> 
> - The allowed key types for an Azure key generated using the copy key workflow are:
>   - Standard key vault:
>     - RSA key pairs (RSA_2048, RSA_3072, and RSA_4096).
>     - Elliptic curve key pairs (ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1).
>   - Premium key vault:
>     - RSA key pairs (RSA_2048, RSA_3072, and RSA_4096).
>     - Elliptic curve key pairs (ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1).
> - The RSA and EC keys to be copied must have the “Export” permission enabled or the copy key operation will fail.
> - **COPY KEY** will be disabled for all the Azure KMS Virtual-Keys.
3. In the **COPY KEY** window,
  1. Hover on the name of the key and use the edit icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1813)(4).png) to update the name of the key, if required.
  2. Click the **Import key to HSM/External KMS** check box to filter the groups to show only HSM/KMS groups. Select the Azure CDC group for the new key into which the copied key should be imported.
  3. In the **Create key as** section,
    - Select **Software protected** or **Hardware protected** if the key vault associated with the Azure CDC group is a Premium key vault.
    - For the Standard key vault, the key is created as software-protected by default.
  4. Enter the required **Azure key name**.

> [!NOTE]
> NOTE
> 
> If the Azure key name already exists in the Azure Key Vault, then the old key will get rotated automatically.
  5. Update the **Key operated permitted** if you want to modify the permissions of the key.

> [!NOTE]
> NOTE
> 
> Only the permissions that are already present in the source key can be modified. If some permissions are missing on the source key, they cannot be added to the copied key.
4. Click **CREATE COPY** to create a copy of the key.

The source key will now appear as a key link in the **KEY LINKS** tab in the detailed view of the copied key.

> [!NOTE]
> NOTE
> 
> - Once the key is copied, perform the **SYNC KEYS** operation to ensure a backup blob for the key (along with its key versions) will be downloaded from Azure and escrowed into Fortanix DSM. *For steps to sync keys, refer to* [*Section 5.3: Sync Keys*](/v1/docs/fortanix-dsm-azure-key-vault-byok-bring-your-own-key#53-sync-keys)*.*
> - If you want to maintain a copy of the key material in Fortanix DSM, then you can import a regular RSA/EC key into Fortanix DSM using the “import key” workflow and then copy this key into Azure Key Vault using the “copy key” workflow.
> - The audit logs for a copied key in the Azure-backed group will display detailed entries, including the wrapping key type, key size, and wrapping mechanism, provided that audit logging is enabled for the source key.

### 5.2 Bring Your Own Key - Import Key

This action imports the key into the software or HSM-backed Azure Key Vault, creating a virtual key in the corresponding Azure CDC group. The virtual key in the Azure CDC group points to the actual key in the Azure Key Vault, but only stores key information and attributes, not the key material. The import action does not store a copy of the key material in Fortanix DSM.

Perform the following steps to import a key in Fortanix DSM:

1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.
2. On the **Add New Security Object** form:
  1. Enter a name for the Security Object (Key).
  2. Select the **This is an HSM/external KMS object** check box to filter the groups to show only HSM/KMS groups in the **Select group** list.
  3. In the Azure group list, select the Azure CDC group into which the keys will be imported. The keys will be imported into the region that was selected in the Azure CDC group.
  4. Select **IMPORT** to initiate the import of the key in the Azure workflow.
  5. In the **Create key as** section,
    - Select **Software protected keys** or **Hardware protected keys** if the key vault associated with the Azure CDC group is a Premium key vault.
    - For the Standard key vault, the key is created as software-protected by default.
  6. Enter the required **Azure key name**.
  7. In the **Choose a type** section, select the key type for the new Azure KMS key.

> [!NOTE]
> NOTE
> 
> - The allowed key type for an Azure key generated using the Import Key workflow is.
>   - Standard key vault:
>     - RSA key pairs ( RSA_2048, RSA_3072, and RSA_4096).
>     - Elliptic curve key pairs (ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1).
>   - Premium key vault:
>     - RSA key pairs ( RSA_2048, RSA_3072, and RSA_4096).
>     - Elliptic curve key pairs (ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1).
> - The RSA and EC key to be copied must have the “Export” permission enabled or the copy key operation will fail.

Sometimes keys of type RSA that need to be imported from a file were previously wrapped (encrypted) by a key from Fortanix DSM. This is done so that the key should not go over the TLS in plain text format. In such scenarios, select **The key has been encrypted** check box.
  8. In the **Select Key Encryption Key** section, enter or select a Key ID or security object name that will be used to unwrap (decrypt) the encrypted key in the file, which will later be stored securely in Fortanix DSM. This key should have already been created or imported into Fortanix DSM.
  9. In the **Place value here or import from file** section, select the value format type as **Hex**, **Base64**, or **Raw** and click **UPLOAD A FILE** to upload the key file.
  10. Select the permitted key operations and any key tags if required using **ADD TAG**.
  11. Enter the key **Expiration Date** and key **Activation Date**.
3. Click **IMPORT** to import the key.

> [!NOTE]
> NOTE
> 
> Once the key is imported, perform the **SYNC KEYS** operation to ensure a backup blob for the key (along with its key versions) will be downloaded from Azure and escrowed into Fortanix DSM. *For steps to sync keys, refer to* [*Section 5.3: Sync Keys*](/v1/docs/fortanix-dsm-azure-key-vault-byok-bring-your-own-key#53-sync-keys).

The security key is successfully imported.

### 5.3 Sync Keys

Perform the following steps to sync the Azure keys as virtual keys in the Azure-backed DSM group:

1. Go to the Azure KMS group detailed view.
2. Click the **HSM/KMS** tab.
3. Click **SYNC KEYS** to import the new virtual keys.

Fortanix DSM will then connect to Azure Key Vault, fetch all available keys, and store them as virtual keys.

> [!WARNING]
> WARNING
> 
> When a key is copied or imported in the Azure Key Vault from Fortanix DSM, a **backup blob** for the key (along with its key versions) will be downloaded from Azure and escrowed into Fortanix DSM ONLY when the **SYNC KEYS** operation is performed on the group. In the event of a key being purged from the Key Vault, this escrow can be used to **restore the key**. The actual key material for those keys is always stored in Azure Key Vault.

> [!NOTE]
> NOTE
> 
> - Clicking **SYNC KEYS** only returns the keys from Azure Key Vault that are not present in Fortanix DSM. That is, every click will append only new keys to Fortanix DSM.
> - The time taken to sync keys from the Azure Key Vault to Fortanix DSM is a function of the number of keys in the Azure Key Vault and the network latency between the Azure location and Fortanix DSM. It can take several minutes if there are hundreds of keys and there is significant network latency.

### 5.4 Attributes/Tags Tab

This tab contains all the attributes and tags of the Azure key. A tag serves as an optional metadata label that you can assign to an Azure resource. You can add new tags using **NEW TAG** and add custom attributes by using **ADD CUSTOM ATTRIBUTE**. These are user-defined security object attributes that can be added to the security object’s metadata.

### 5.5 Azure Key Details

This tab displays details of the Azure key properties, such as Resource ID and Key version number.

The **AZURE KEY DETAILS** tab also contains the **SOFT DELETE KEY** option, which is explained in [*S*](/v1/docs/fortanix-dsm-azure-key-vault-cloud-native-key-management#46-deactivate-a-key-in-azure-cdc-group)[*ection 5.8: Soft-delete a Key in Azure Key Vault*](/v1/docs/fortanix-dsm-azure-key-vault-byok-bring-your-own-key#58-softdelete-a-key-in-azure-key-vault).

### 5.6 Security Objects Table View

After adding new Azure keys, navigate to the Security Objects menu item to view all the security objects from all the groups (Regular Azure and HSM/External KMS).

In the table, you will notice that every key belongs to a group and some keys, which are virtual keys added from an Azure Key Vault, belong to a group with a special symbol ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1812)(7).png). The table shows all keys, whether they belong to an Azure CDC group or not.

### 5.7 Deactivate a Key in Azure CDC Group

When you deactivate an Azure key in Fortanix DSM, it deactivates the virtual key in Fortanix DSM and disables the actual key in the Azure Key Vault KMS.

Perform the following steps to deactivate a key:

1. Select the Azure key that you want to deactivate.
2. In the detailed view of the key, scroll down and click **DEACTIVATE**.

### 5.8 Soft-delete a Key in Azure Key Vault

Soft-delete removes a key from Azure Key Vault, which was already scanned in the Azure CDC Group in Fortanix DSM, with an option to recover it. The key recovery period is configurable when creating the Azure Key Vault. You can set it to any value between 7 and 90 days, with 90 days as the default. Once the 90-day period is reached, the key can no longer be recovered from the soft-deleted state.

When you click **SOFT DELETE KEYS** in Fortanix DSM:

- The status of the key in the Azure CDC group changes to “**soft-deleted**”.
- The key can only be recovered for a retention period set in the key vault.
- If you want to recover this key, both the virtual key in Fortanix DSM and the actual key in Azure Key Vault become active again.
- If you do not want to recover the key within the retention period, the key will be deleted and it will enter the purge state.

Perform the following steps to soft-delete a key from Azure Key Vault:

1. Navigate to the detailed view of an Azure virtual key and click the **AZURE KEY DETAILS** tab.
2. Click **SOFT DELETE KEY**.
3. In the **Soft Key Deletion in Azure key vault** window, select the confirmation “**I understand that the key is not usable for Sign/Verify, Wrap/Unwrap or Encrypt/Decrypt operations once it is deleted**” check box.
4. Click **SOFT DELETE KEY** to confirm the key for deletion.

You can recover the soft-deleted key any time before the retention period ends using **RECOVER DELETED KEY** on the top of the screen in the detailed view of the virtual key. When **Recover Key** is clicked, the key will be recovered in Azure Key Vault with all its versions.

> [!NOTE]
> NOTE
> 
> - When the retention period ends, the new key state will be reflected in the virtual key only after clicking **SYNC KEYS**.
> - When the retention period ends, the key cannot be recovered from the soft-deleted state and can only be purged.
> - In the Azure Key Vault, when a key is deleted, all its versions get deleted along with it and when restored, all its versions are restored together.

### 5.9 Purge a Key in Azure Key Vault

Purging a key permanently removes a key from an Azure Key Vault, with an option to restore it. The key restoration period is configurable when creating the Azure Key Vault in Azure. You can set it to any value between 7 and 90 days, with 90 days as the default. Once the 90-day period is reached, the key can no longer be restored from the purged state.

When you click **PURGE DELETED KEYS** in Fortanix DSM:

- The status of the key in the Azure CDC group changes to “**purged**”.
- The key can only be restored for a retention period set in the key vault.
- If you want to recover this key, both the virtual key in Fortanix DSM and the actual key in Azure Key Vault become active again.
- If you do not want to recover the key within the retention period, the Azure key vault will automatically purge and permanently delete.

Perform the following steps to purge a key from Azure Key Vault:

1. Navigate to the detailed view of an Azure virtual key and click the **AZURE KEY DETAILS** tab.
2. Click **PURGE DELETED KEY**.
3. In the **Purge deleted key in Azure key vault window**, select the confirmation “**I understand that purging the key makes all data encrypted with it unrecoverable unless you later import the same key material from Fortanix DSM into the Azure key. The DSM source key is not affected by this operation.**” check box.
4. Click **PURGE KEY** to confirm the key for deletion.

You can restore the purged key any time before the retention period ends using **RESTORE PURGED KEY** at the top of the screen in the detailed view of the virtual key. When **Restore Key** is clicked, the key will be restored in Azure Key Vault with all its versions.

> [!NOTE]
> NOTE
> 
> - When the retention period ends, the new key state will be reflected in the virtual key only after clicking **SYNC KEYS**.
> - When the retention period ends, the key cannot be restored from the purged state and will be permanently deleted.
> - If the key is purged in Azure Key Vault, if the key was imported from Fortanix DSM, then the same key material can be re-imported into Azure Key Vault from the backup blob using the **RESTORE PURGED KEY** option. The backup blob will be available only if the **SYNC KEYS** operation was performed after creating the key.
> - In the Azure Key Vault, when a key is deleted, all its versions get deleted along with it and when restored, all its versions are restored together.

### 5.10 Delete a Key in Azure CDC Group

**DELETE KEY** will be enabled when the key can no longer be restored from the purged state. When you click **DELETE KEY**, Fortanix DSM will remove the virtual key permanently.

Perform the following steps to delete a virtual key:

1. Select the Azure key that you want to delete.
2. In the detailed view of the key, scroll down and click **DELETE KEY**.

## 6.0 Rotate a Key In Azure CDC Group

The following section explains the key rotation in the Azure CDC group. A key is rotated when you want to retire an encryption key and replace that old key by generating a new cryptographic key.

> [!NOTE]
> NOTE
> 
> When performing key rotation in Azure Key Vault, including normal rotation, linked key rotation, or rotating to a DSM key, specifying the Azure key name is no longer required. The rotated key automatically inherits the following details from the previous key version:
> 
> - Azure Key Name
> - Azure Key Resource ID
> - Azure Key Version Number
> - Key Backup Information

### 6.1 Rotating Keys in Fortanix DSM Source Group

**Prerequisites**: Create a regular Fortanix DSM group with source keys copied to the Azure CDC group.

When a key is rotated that belongs to a Fortanix DSM source group and has linked keys that are copies of the Fortanix DSM source key with the same key material as the source key, then you are given the option to select the linked keys for the key rotation. If these linked keys are part of an Azure CDC group, rotating the linked keys also rotates the keys in Azure Key Vault by making nested copies of the keys in the configured Azure Key Vault.

> [!WARNING]
> WARNING
> 
> If the new rotated key in the Azure CDC group is soft-deleted, then after performing a sync keys operation, the older version of the Azure key transitions to the destroyed state. It is recommended not to permanently delete this destroyed key as it may break its link with the original key and cause issues.

Perform the following steps to rotate a key in Azure Key Vault:

1. Navigate to the **Security Objects** menu item in the DSM left navigation panel to go to the detailed view of a Fortanix DSM Source Key and click **ROTATE KEY**.
2. In the **KEY ROTATION** window, select the **Rotate linked keys** check box. *For more information on the key rotation policy, refer to* [*Fortanix DSM Key Lifecycle Management*](/v1/docs/fortanix-data-security-manager-key-lifecycle-management).
3. Select the Azure Virtual Keys to rotate with the Fortanix DSM source key and click **ROTATE KEY**.
4. On the **Rotate key** window, select both the check boxes to confirm your understanding of the action. Click **PROCEED**.
5. After the keys are rotated, click **OK**.

> [!NOTE]
> NOTE
> 
> Once the source and linked keys are rotated, perform the **SYNC KEYS** operation to ensure a backup blob for the newly created keys (along with their key versions) will be downloaded from Azure and escrowed into Fortanix DSM. *For steps to sync keys, refer to* [*Section 5.3: Sync Keys*](/v1/docs/fortanix-dsm-azure-key-vault-byok-bring-your-own-key#53-sync-keys).

You can schedule a key rotation policy for the Fortanix DSM source key to automatically and periodically rotate linked Azure keys that are copies of the source key.

Perform the following steps to schedule a key rotation policy for the source key:

1. Navigate to the **Security Objects** menu item in the DSM left navigation panel to go to the detailed view of a Fortanix DSM Source Key.
2. In the detailed view, click the **KEY ROTATION** tab and click **ADD POLICY**.
3. Enter the key rotation schedule by specifying the rotation frequency, start date, and time.
4. To deactivate the old key after key rotation, select the **Deactivate original key after the rotation** check box.
5. Click **SAVE POLICY** to save the policy.
6. On the next screen, select both the check boxes to confirm your understanding of the action. Click **PROCEED**.

*For more information on the key rotation policy, refer to* [*Fortanix DSM Key Lifecycle Management*](/v1/docs/fortanix-data-security-manager-key-lifecycle-management)*.*

### 6.2 Rotate Azure Native Key to Fortanix DSM Owned Key

When an Azure KMS virtual key whose key material is owned by Azure KMS is rotated, you are given an option to rotate the virtual key with a Fortanix DSM-backed key. When you select this option and perform the rotation, a new virtual key is created, with the corresponding key in Azure KMS, which has the key material of the Fortanix DSM-backed key. As a result, the Azure KMS virtual key is backed by a Fortanix DSM source key and becomes a BYOK key. This scenario is used when you want to convert your Azure native keys to BYOK keys.

Perform the following steps to rotate a virtual key with a Fortanix DSM-backed key:

1. Navigate to the **Security Objects** menu item in the DSM left navigation panel to go to the detailed view of an Azure virtual key and click **ROTATE KEY**.
2. In the **Key Rotation** window, **Generate new key** is selected by default.
3. Select the **Rotate to DSM** key check box.
4. Select the Fortanix DSM group that contains the source key and then select the required source key from the respective drop down menus.
5. Click **ROTATE KEY**.
6. On the next screen, select both the check boxes to confirm your understanding of the action. Click **PROCEED**.

The virtual key has been rotated and is now backed by the source key. To confirm, go to the detailed view of the newly rotated Azure virtual key and click the **AZURE KEY DETAILS** tab. You will notice that the **SOURCE** field now shows **FortanixHSM** instead of *External*.

> [!NOTE]
> NOTE
> 
> Once the Azure virtual key is rotated, perform the **SYNC KEYS** operation to ensure a backup blob for the newly created key (along with its key versions) will be downloaded from Azure and escrowed into Fortanix DSM. *For steps to sync keys, refer to* [*Section 5.3: Sync Keys*](/v1/docs/fortanix-dsm-azure-key-vault-byok-bring-your-own-key#53-sync-keys).

Fortanix DSM’s BYOK feature generates Linked or Copied virtual keys from a source key enabling backup and key replication to other CSP accounts/subscriptions, regional instances, key repositories, and, most importantly, to multiple cloud providers, including private clouds. This includes seamless movement between private clouds (on-premises) and public clouds. BYOK keys also allow tracking of key activities across multiple CSP repositories for easier restoration if keys are deleted or disabled.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Virtual keys are keys for which Fortanix has the key metadata but not the key material itself in a specific group. Virtual keys are created when Fortanix inventories, generate local CSP keys or “CNKM Keys” (Cloud Native Key Management) or have a linked key to a CDC group. You can tell if a key is a virtual key or linked key by the color of the icon![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Glossary/image-1716981258616.png)in Fortanix DSM.

## Related

- [Azure Key Vault Group Setup](/fortanix-dsm-azure-key-vault-cdc-group-setup.md)
- [Azure Key Vault Cloud Native Key Management](/fortanix-dsm-azure-key-vault-cloud-native-key-management.md)
- [Custom Role](/fortanix-dsm-custom-role.md)
- [Key Lifecycle Management](/fortanix-data-security-manager-key-lifecycle-management.md)
- [Fortanix CCM - Quickstart](/fortanix-ccm-quickstart-guide.md)