Share via

Obtaining hardware and firmware version of HSM used with Key Vault Managed HSM

Harry, Christopher 20 Reputation points
2025-06-23T13:04:11.2033333+00:00

Per the article here: https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview Managed HSM is using FIPS 140-3 Level 3 HSMs for security.

Our regulatory requirements require a method to retrieve the hardware and firmware version of the actual HSM used to generate the keys, etc. That information is necessary to prove that the HSM hardware involved is covered under a NIST certification (in the case of your latest HSMs, I believe it is this one: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4700)

Is there a method available to retrieve this information?

Thanks.

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amira Bedhiafi 41,111 Reputation points Volunteer Moderator
    2025-11-04T18:46:52.5066667+00:00

    Hello Harry !

    Thank you for posting on Microsoft Learn Q&A.

    Azure doesn’t expose the underlying HSM make a version of your individual managed HSM instance via any API, CLI, or portal surface and that information is managed by Microsoft and validated centrally and not per tenant.

    https://learn.microsoft.com/en-us/rest/api/keyvault/managedhsm/managed-hsms/get?view=rest-keyvault-managedhsm-2024-11-01

    Microsoft publicly states that Azure Key Vault Managed HSM uses Marvell LiquidSecurity hardware and is validated to FIPS 140-3 Level 3. NIST CMVP certificate #4700 covers the Marvell NITROXIII/CNN35XX family.

    https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/firmware-update

    The managed HSM overview (and the 2025 firmware update note) are the official statements you can reference in compliance packages.

    https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview

    Microsoft owns firmware lifecycle and publishes the compliance posture for the service as a whole. The managed HSM REST Get surface only returns a pool or a service metadata not hardware or firmware identifiers.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.