--- title: "Fortanix DSM with Azure Key Vault Managed HSM External Key Management" slug: "fortanix-dsm-with-azure-key-vault-managed-hsm-external-key-management" updated: 2026-07-24T17:39:40Z published: 2026-07-24T17:39:40Z canonical: "support.fortanix.com/fortanix-dsm-with-azure-key-vault-managed-hsm-external-key-management" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Fortanix DSM with Azure Key Vault Managed HSM External Key Management ## 1.0 Introduction This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Azure Key Vault Managed HSM external key management** to protect Azure data using encryption keys stored and managed exclusively within Fortanix DSM. With this integration, Azure Managed HSM delegates all cryptographic operations such as, key wrapping and unwrapping to Fortanix DSM acting as an EKM proxy. Keys never leave the Fortanix DSM boundary; Azure holds only a reference to the external key identifier, while all cryptographic operations are performed inside Fortanix DSM. ## 2.0 Why Use Fortanix DSM with Azure Key Vault Managed HSM External Key Management? Azure Key Vault Managed HSM external key management allows Azure services starting with Azure Blob Storage to use encryption keys managed entirely outside of Azure. Fortanix DSM acts as the external key manager and performs cryptographic operations on these keys. Managed HSM interacts with Fortanix DSM through key references without accessing the underlying key material. ## 3.0 Prerequisites Ensure the following: - Fortanix DSM endpoint is reachable from Azure Managed HSM over HTTPS (TCP port 443). - Fortanix DSM Fully Qualified Domain name (FQDN) resolves correctly and presents a valid TLS certificate chain. ## 4.0 Set Up Fortanix DSM A Fortanix DSM service must be configured, and the URL must be accessible. ### 4.1 Signing Up To get started with the Fortanix DSM cloud service, you must register an account at . For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region. *For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.* ### 4.2 Creating an Account Access in a web browser and enter your credentials to log in to Fortanix DSM. ![A screenshot of a login screen AI-generated content may be incorrect., Picture](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager-image-gl94ehd2.png) **Figure 1: Logging in** *For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ## 5.0 Set Up Azure CLI Environment This section describes how to prepare the client environment required to manage Azure Managed HSM external key management resources. ### 5.1 Installing Azure CLI Perform the following steps: 1. Install the latest Azure CLI (version 2.x) if it is not already installed. *For more information, refer to the* [*Microsoft official documentation*](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)*.* 2. Run the following command to install the Azure Key Vault extension: ```bash az extension add --name keyvault ``` If the extension is already installed, run the following command to update it to the latest version: ```bash az extension update --name keyvault ``` 3. Run the following command to sign in to Azure: ```bash az login ``` 4. If you have multiple subscriptions, run the following command to select the subscription containing your Managed HSM: ```bash az account set --subscription "" ``` > [!NOTE] > NOTE > > This article uses the Azure CLI with the Azure Managed HSM EKM preview extension. All commands are executed using the standard `az <command>` syntax. ## 6.0 Configure Azure Managed HSM ### 6.1 Creating and Activating Azure Managed HSM Perform the following steps: > [!NOTE] > NOTE > > - If the Managed HSM instance is already set up and activated, skip to *Step 3*. > - Azure Managed HSM external key management is currently in public preview. After creating your Managed HSM instance, contact Microsoft to enable this feature for your Managed HSM instance before proceeding with the remaining steps in this document. 1. In the Azure Portal, create a new Managed HSM instance. - Use the default retention period of **7 days**. - Enable **Purge Protection**. 2. The provisioned Managed HSM instance must be activated before it can be used. To activate it, generate three self-signed certificates and download the security domain. Run the following commands to generate the certificates. ```bash openssl req -newkey rsa:2048 -nodes -keyout cert_0.key -x509 -days 365 -out cert_0.cer openssl req -newkey rsa:2048 -nodes -keyout cert_1.key -x509 -days 365 -out cert_1.ce openssl req -newkey rsa:2048 -nodes -keyout cert_2.key -x509 -days 365 -out cert_2.cer ``` These certificates are used to encrypt the security domain during HSM activation. A quorum of two certificates is required to unlock and restore the security domain. > [!NOTE] > NOTE > > Store the generated certificate key files (`cert_0.key`, `cert_1.key`, `cert_2.key`) and the downloaded security domain file in a secure location. These are required for HSM recovery and cannot be regenerated. 3. Run the following command to download the security domain and activate the Managed HSM instance: ```bash az keyvault security-domain download \  --hsm-name \  --sd-wrapping-keys ./cert_0.cer ./cert_1.cer ./cert_2.cer \  --sd-quorum 2 \  --security-domain-file -SD.json ``` 4. Verify that the command returns the following output confirming successful activation: ```bash {  "status": "Success",  "statusDetails": "The resource is active." } ``` > [!NOTE] > NOTE > > You can also configure Azure Managed HSM using the Azure portal instead of the Azure CLI. *For detailed instructions, refer to the* [*Microsoft Official documentation*](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-quickstart-portal). If you use the Azure portal-based workflow, continue with the remaining Fortanix configuration steps in this guide after completing the Microsoft procedure. ### 6.2 Assigning Required Roles Perform the following steps to assign the required roles to the Azure user: 1. Run the following command to sign in to the Azure CLI: ```bash az login ``` 2. Authenticate using the browser. When prompted to select a subscription and tenant, press **Enter** to retain the current selection. 3. You can retrieve your user object ID from the Azure Portal or by running the following command in a new terminal tab: ```bash az ad user show --id --query id -o tsv ``` Where, `<USER_PRINCIPAL_NAME>` is the Microsoft Entra ID user principal name. For example, `user@contoso.com`. Ensure to save the returned object ID value to be used in later steps. 4. Run the following command to assign the Managed HSM Crypto User role: ```bash az keyvault role assignment create \  --hsm-name \  --role "Managed HSM Crypto User" \  --assignee \  --scope "/" ``` A successful assignment returns a JSON object containing the role assignment details. 5. Run the following command to assign the Managed HSM EKM Administrator role: ```bash az keyvault role assignment create \  --hsm-name \  --role "Managed HSM EKM Administrator" \  --assignee \  --scope "/" ``` A successful assignment returns a JSON object containing the role assignment details. > [!NOTE] > NOTE > > If the role assignment already exists, Azure returns a `MatchingRoleAssignmentExists` error message. No further action is required as the role is already assigned and active. ### 6.3 Enabling the External Key Management Feature on the Managed HSM Instance Verify that the external key management feature is enabled for your Managed HSM instance. If the required Azure CLI commands are available and the Managed HSM is deployed in a supported region, proceed with [*Section 6.4: Configuring Diagnostic Logging*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#64-configuring-diagnostic-logging). ### 6.4 Configuring Diagnostic Logging Perform the following steps to configure audit logging for the Azure Managed HSM instance. *For more information, refer to the* [*Microsoft official documentation*](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/logging?tabs=azure-cli)*.* 1. Create a Log Analytics Workspace in the same Azure subscription as the Managed HSM instance. 2. Run the following command to retrieve the Managed HSM resource ID: ```bash az keyvault show --hsm-name --query id -o tsv ``` Ensure to save the returned resource ID value to use it in *Step 4*. 3. Run the following command to retrieve the Log Analytics Workspace resource ID: ```bash az monitor log-analytics workspace show \  --resource-group \  --workspace-name \  --query id -o tsv ``` Ensure to save the returned workspace resource ID value to use it in *Step 4*. 4. Run the following command to configure diagnostic settings and link the Log Analytics Workspace to the Managed HSM instance: ```bash az monitor diagnostic-settings create \  --name "-Diagnostics" \  --resource "" \  --logs '[{"category": "AuditEvent","enabled": true}]' \  --workspace "" ``` > [!NOTE] > NOTE > > Alternatively, you can configure Diagnostic Settings through the Azure portal by navigating to **Managed HSM → Monitoring → Diagnostic settings**. After the diagnostic settings are configured, audit events generated by Azure Key Vault Managed HSM are forwarded to the Log Analytics Workspace. ### 6.5 Retrieving the Managed HSM Client Certificate Azure Key Vault Managed HSM presents a client certificate to Fortanix DSM during mutual TLS authentication. Perform the following steps to retrieve the certificate details: 1. Run the following command to retrieve the Managed HSM client certificate and issuing Certificate Authority (CA) information: ```bash az keyvault ekm-connection certificate show --hsm-name ``` A successful response returns the following output: ```bash {  "caCertificates": [    ""  ],  "subjectCommonName": ".managedhsmclient.azure.net" } ``` Where, Ensure to save both values to configure the Trusted CA application in Fortanix DSM in [*Section 6.9: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#69-creating-an-application). - `subjectCommonName`: The DNS name used in the Managed HSM client certificate. For example, `<MANAGED_HSM_NAME>.managedhsmclient.azure.net`. - `caCertificates`: The Base64-encoded CA certificate presented by the Managed HSM to Fortanix DSM. ### 6.6 Verifying Fortanix DSM Client Certificate Before creating the external key management connection, verify that the Fortanix DSM instance is configured to request client certificates from connecting clients. Perform the following steps: 1. Log in to Fortanix DSM as a System Administrator. 2. Navigate to **System Administration** → **Settings** → **INTERFACES**. 3. Confirm that the check box under the **REQUEST CLIENT CERTIFICATE** column is enabled for that host. If it is not enabled, perform the following steps: 1. Click the check box under **REQUEST CLIENT CERTIFICATE** for the relevant host to enable it. 2. Click **SAVE CHANGES** to apply. ### 6.7 Retrieving the Fortanix DSM Server CA Certificate The Fortanix DSM server CA certificate chain is required when creating the external key management connection in [*Section 7.0: Create an External Key Management Connection*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#70-create-an-external-key-management-connection). Perform the following steps to retrieve the server CA certificate: 1. Open the Fortanix DSM URL in a browser. 2. Click the lock icon in the address bar and select **Connection is secure**, then **More information**. 3. View and download the full server certificate chain. > [!NOTE] > NOTE > > Download the complete certificate chain, including any intermediate CA certificates. Do not provide only the leaf certificate. 4. Save the CA certificate chain to a local PEM file (for example, `server-ca.pem`) to use it later in [*Section 7.0: Create an External Key Management Connection*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#70-create-an-external-key-management-connection). ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1782979876759.png) **Figure 2: Certificate details** ### 6.8 Creating a Group Perform the following steps to create a group in the Fortanix DSM: 1. In the DSM UI left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager-image-ymrjrdcb.png) **Figure 3: Add groups** 2. On the **Adding new group** page: 1. **Title**: Enter a name for your group. 2. **Description** (optional): Enter a short description of the group. 3. Click **SAVE** to create the new group. *For more information about groups, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#40-groups)*.* ### 6.9 Creating an Application Perform the following steps to create a Trusted CA app in the Fortanix DSM: 1. In the DSM UI left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager-image-5p533y74.png) **Figure 4: Add application** 2. On the **Adding new app** page: 1. **App name:** Enter the name for your application. 2. **ADD DESCRIPTION** (optional)**:** Enter a short description of the application. 3. **Authentication method:** Select **Trusted CA** as the authentication method from the drop-down menu. *For more information on this authentication method, refer to* [*Authentication*](https://support.fortanix.com/docs/users-guide-authentication#40-application-authentication)*.* 4. In the **Configure Subject Alternative Name (SAN)** section: 1. **DNS Name**: Enter the `subjectCommonName` value retrieved from Azure Managed HSM in [*Section 6.5: Retrieving the Managed HSM Client Certificate*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#65-retrieving-the-managed-hsm-client-certificate). 2. **UPLOAD TRUSTED CA CERT**: Upload or paste the `caCertificates` value retrieved from Azure Managed HSM in [*Section 6.5: Retrieving the Managed HSM Client Certificate*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#65-retrieving-the-managed-hsm-client-certificate). 5. **Assigning the new app to groups:** Select the group created in [*Section 6.8: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#68-creating-a-group)from the list. 3. Click **SAVE** to add the new application. *For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.* ### 6.10 Copying the App UUID Perform the following steps to copy the app UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 6.9: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#69-creating-an-application) to go to the detailed view of the app. 2. From the top of the app’s page, click the copy icon next to the app UUID to copy it to use it later in [*Section 7.0: Create an External Key Management Connection*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#70-create-an-external-key-management-connection). ### 6.11 Creating a Security Object Perform the following steps to generate an RSA key in the Fortanix DSM: 1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object. ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager-image-fx1z4rd3.png) **Figure 5: Adding security object** 2. On the **Add new Security Object** page: 1. **Security Object Name**: Enter the name of your security object. 2. **Group**: Select the group as created in [*Section 6.8: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#68-creating-a-group). 3. Select **GENERATE**. 4. In the **Choose a type** section, select the **RSA** key type to generate. 5. In the **Key Size** section, select the size of the key in bits. 6. In the **Exponent** section, select the value as required. 7. In the **Key operations permitted** section, select the **Encrypt** and **Decrypt** key operations. 3. Click **GENERATE** to create the new security object. *For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.* ### 6.12 Copying the Security Object UUID (External Key ID) Perform the following steps to copy the security object UUID from the Fortanix DSM: 1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click the security object created in [*Section 6.11: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#611-creating-a-security-object) to go to the detailed view of the security object. 2. From the top of the security object’s page, click the copy icon next to the UUID to copy it to use it later in [*Section 8.0: Create an External RSA Key Reference*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#80-create-an-external-rsa-key-reference). ## 7.0 Create an External Key Management Connection Perform the following steps to establish an external key management connection between Azure Key Vault Managed HSM and Fortanix DSM: 1. Run the following command to create the external key management connection: ```bash az keyvault ekm-connection create V\  --hsm-name \  --host \  --server-ca-certificate .pem \  --path-prefix /crypto/v1/apps//azure/ekm ``` Where, > [!NOTE] > NOTE > > You must provide the full certificate chain instead of only the leaf certificate. - `<MANAGED_HSM_NAME>`: The name of your Azure Managed HSM instance. - `<DSM_HOSTNAME>`: The Fortanix DSM hostname. For example, `amer.smartkey.io`. - `<PATH_TO_DSM_CA_CHAIN>.pem`: The file path to the Fortanix DSM CA certificate chain saved in [*Section 6.7: Retrieving the Fortanix DSM Server CA Certificate*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#67-retrieving-the-fortanix-dsm-server-ca-certificate). - `<TRUSTED_CA_APP_UUID>`: The UUID of the Trusted CA application copied in [*Section 6.10: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#610-copying-the-app-uuid). 2. Verify that the command returns the following output confirming a successful external key management connection: ```bash {  "apiVersion": "0.1-preview",  "ekmProduct": "Fortanix Data Security Manager",  "ekmVendor": "Fortanix, Inc.",  "proxyName": "Fortanix Data Security Manager",  "proxyVendor": "Fortanix, Inc." } ``` > [!NOTE] > NOTE > > If the external key management connection has already been established, the command returns a `NotSupported: EKM connection is already setup` error. This indicates the connection is active and no further action is required. ### 7.1 Verifying the Connection Perform the following step to verify that Azure Managed HSM can reach the Fortanix DSM proxy: 1. Run the following command to verify the external key management connection: ```bash az keyvault ekm-connection check --hsm-name ``` A successful response returns the following output: ```bash {  "status": "Connected",  "proxyVersion": "1.0.0",  "vendor": "Contoso HSM" } ``` ## 8.0 Create an External RSA Key Reference Perform the following steps to create an external RSA key reference in Azure Managed HSM that points to the Fortanix DSM security object created in [*Section 6.11: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#611-creating-a-security-object). 1. Run the following command to create the external key reference: ```bash az keyvault key create \  --external-key-id \  --hsm-name \  --name ``` Where, - `<SOBJECT_UUID>`: The Fortanix DSM security object UUID copied in [*Section 6.12: Copying the Security Object UUID (External Key ID)*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#612-copying-the-security-object-uuid-external-key-id). - `<AZURE_KEY_NAME>`: A name for the key in Azure Managed HSM. The name must conform to Azure key naming guidelines and must not contain underscores. 2. Verify the output: - `kty` must be RSA-HSM. - `keyOps` must include `wrapKey` and `unwrapKey`. - `externalKeyId` must match the Fortanix DSM security object UUID. > [!NOTE] > NOTE > > The External RSA Key Reference creates a reference in Azure Managed HSM to the RSA key stored in Fortanix DSM. The key material remains securely stored in Fortanix DSM. ## 9.0 Configure Azure Blob Storage to Use the External Key This section describes how to configure an Azure Storage Account to use the external RSA key created in Azure Managed HSM for customer-managed encryption. ### 9.1 Creating a Storage Account Perform the following steps: 1. In the Azure Portal, create a new Storage Account in the same region as the Managed HSM. 2. Select **Azure Blob Storage** as the preferred storage type. 3. Optionally, place the Storage Account in the same resource group as the Managed HSM instance. 4. Enable encryption with customer-managed keys stored in the Managed HSM instance. 5. Run the following command to enable a system-assigned managed identity on the Storage Account: ```bash az storage account update \  --name \  --resource-group \  --assign-identity ``` 6. Run the following command to retrieve the Storage Account managed identity principal ID: ```bash az storage account show \  --name \  --resource-group \  --query identity.principalId -o tsv ``` Save the returned principal ID value to be used in [*Section 9.2: Granting Storage Account Access to the External Key*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#91-granting-storage-account-access-to-the-external-key). ### 9.2 Granting Storage Account Access to the External Key Perform the following step to assign the **Managed HSM Crypto Service Encryption User** role to the Storage Account managed identity: 1. Run the following command using the Storage Account principal ID retrieved in [*Section 9.1: Creating a Storage Account*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#91-creating-a-storage-account) and the Azure key name created in [*Section 8.0: Create an External RSA Key Reference*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#80-create-an-external-rsa-key-reference): ```bash az keyvault role assignment create \  --hsm-name \  --role "Managed HSM Crypto Service Encryption User" \  --assignee \  --scope /keys/ ``` A successful response returns a JSON object containing the role assignment details. > [!NOTE] > NOTE > > If a `MatchingRoleAssignmentExists` error is returned, the role assignment already exists, and no further action is required. ### 9.3 Enabling Customer-Managed Key Encryption Ensure the following prerequisites are available before proceeding: - The app UUID from [*Section 6.10: Copying the App UUID*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#610-copying-the-app-uuid). - The Fortanix DSM server CA certificate from [*Section 6.7: Retrieving the Fortanix DSM Server CA Certificate*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#67-retrieving-the-fortanix-dsm-server-ca-certificate). Perform the following steps to configure the Storage Account to use the external RSA key for encryption: 1. Run the following command to retrieve the Managed HSM URI: ```bash az keyvault show --hsm-name --query properties.hsmUri -o tsv ``` The output is in the format `https://<MANAGED_HSM_NAME>.managedhsm.azure.net/`. 2. Run the following command to configure the Storage Account encryption: ```bash az storage account update \  --name \  --resource-group \  --encryption-key-name \  --encryption-key-source Microsoft.Keyvault \  --encryption-key-vault ``` ## 10.0 Verify the Integration Perform the following verification steps to verify end-to-end integration between Azure Managed HSM, Fortanix DSM, and Azure Storage. ### 10.1 Verifying External Key Management Connection Confirm that the `ekm-connection create` command in [*Section 7.0: Create an External Key Management Connection*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#70-create-an-external-key-management-connection) returned a valid proxy metadata containing the Fortanix DSM vendor information. ### 10.2 Verifying Storage Encryption Run the following command to verify Storage Account encryption configuration: ```bash az storage account show \  --name \  --resource-group \  --query "encryption" ``` A successful response returns the following output: ```bash {  "encryptionIdentity": null,  "keySource": "Microsoft.Keyvault",  "keyVaultProperties": {    "currentVersionedKeyExpirationTimestamp": "1970-01-01T00:00:00+00:00",    "currentVersionedKeyIdentifier": "https://.managedhsm.azure.net/keys//",    "keyName": "",    "keyVaultUri": "https://.managedhsm.azure.net/",    "keyVersion": null,    "lastKeyRotationTimestamp": ""  },  "requireInfrastructureEncryption": false } ``` Confirm that the output shows: - `keySource`: "`Microsoft.Keyvault`" - `keyVaultProperties.keyName` matches the Azure key name created in [*Section 8.0: Create an External RSA Key Reference*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#80-create-an-external-rsa-key-reference). - `keyVaultProperties.keyVaultUri` matches the Managed HSM URI. - `keyVaultProperties.currentVersionedKeyIdentifier` contains a valid key version URI. ### 10.3 Verifying Fortanix DSM Audit Logs In the Fortanix DSM UI, navigate to the **Audit Logs** section and confirm that wrap and unwrap operations originating from the Azure Managed HSM are recorded. This confirms that cryptographic operations are being performed inside Fortanix DSM. ### 10.4 Verifying Azure Diagnostic Logs In the Log Analytics Workspace configured in [*Section 6.4: Configuring Diagnostic Logging*](/v1/docs/using-fortanix-data-security-manager-azure-managed-hsm-external-key-manager#64-configuring-diagnostic-logging), query the audit log table and confirm that external key management-related `AuditEvent` entries are present for the Managed HSM instance. The integration is successfully configured when Azure Key Vault Managed HSM can access the Fortanix DSM key through the external key management connection and Azure Storage encryption operations complete successfully using the external key. ## 11.0 Troubleshooting This section describes common errors encountered during the integration of Fortanix DSM with Azure Key Vault Managed HSM external key management and the recommended resolution steps. | **Problem** | **Resolution** | | --- | --- | | **Role Assignment Already Exists** The role assignment already exists for the specified principal in the given scope. `MatchingRoleAssignmentExists) Role assignment '6f8790f4-46f4-4046-847d-efbf6affaf8f' already adds role 'Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/21dbd100-6940-42c2-9190-5d6cb909625b' to principal 'cb5de261-c483-4bf6-b7be-121b2f1fcabe' in scope '/'. (Activity ID: 3859545a-6ae9-11f1-878f-6045bdcb0785)` `Code: MatchingRoleAssignmentExists` | No action is required. The role is already assigned and active. | | **External Key Management Connection Already Exists** An external key management connection has already been established for this Managed HSM instance. `EKM connection is already setup (Activity ID: 3054c882-6aeb-11f1-b8cc-6045bd766cc9)` `Code: NotSupported` `Message: EKM connection is already setup (Activity ID: 3054c882-6aeb-11f1-b8cc-6045bd766cc9)` | No action is required. The connection is already active. | | **Activate Managed HSM** The Managed HSM activation did not complete successfully if this output is not returned. `{` `  "status": "Success",` `  "statusDetails": "The resource is active."` `}` | Verify that all three certificate files (`cert_0.cer`, `cert_1.cer`, `cert_2.cer`) are present and valid. Verify that the `--sd-quorum` value is set to `2`. | | **Unable to Retrieve User Object ID** The user object ID is not retrievable from the Azure Portal. | 1. Run the following command to sign in to the Azure CLI: ```bash az login ``` 2. Enter the credentials in the browser and then close the browser. 3. When prompted to select a subscription and tenant, press **Enter** to retain the current selection. 4. Run the following command to retrieve the user object ID: ```bash az ad signed-in-user show --query id -o tsv ``` | | **Failed to Create EKM Connection** | Verify that the Fortanix DSM hostname is reachable from Azure Managed HSM over HTTPS (TCP port 443) and that the server CA certificate chain provided is correct and complete. | | **Mutual TLS Authentication Failed** | Verify that the Trusted CA application in Fortanix DSM is configured with the correct client CA certificate and that the `subjectCommonName` (DNS name) matches the DNS name presented by Azure Managed HSM client certificate. | | **Failed to Create External Key** | Verify that the RSA security object exists in Fortanix DSM and is in an active state. Verify that the `--external-key-id` value matches the security object UUID. | | **Storage Account Cannot Use the External Key** | Verify that the **Managed HSM Crypto Service Encryption User** role has been assigned to the Storage Account managed identity. | Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.