Encryption keys: service-managed vs customer-managed vs Managed HSM
This sheet compares Service-managed keys, Customer-managed keys (Key Vault), Managed HSM (customer-owned security domain).
| Criterion | Service-managed keys | Customer-managed keys (Key Vault) | Managed HSM (customer-owned security domain) |
|---|---|---|---|
| Key control | Microsoft controls generation and rotation | Organization controls generation, rotation and revocation | Organization owns the security domain end to end |
The verdict, the full comparison, 6 rules and 4 traps are part of SC-100 access. Unlock SC-100.