Microsoft adds hardware-originated audit logging to Azure Cloud HSM

Microsoft is rolling out Hardware Audit Logging for Azure Cloud HSM, the company said, adding records generated by the hardware security module itself for supported management operations.

The feature pairs readable operation records with HSM-signed binary evidence that customers can retain and verify. Microsoft said this verification path can support monitoring, compliance reporting and forensic investigations.

An HSM is a dedicated device used to protect cryptographic keys and perform operations with them. Azure Cloud HSM’s HsmOperations log category draws tamper-evident records from HSM firmware instead of relying only on platform or application logs. The technical documentation says covered activity includes sign-ins and sessions, user administration, policy and configuration changes, key creation and deletion, key import and export, and backup and restore. Read-only queries and operations not listed in Microsoft’s glossary are not captured in that category.

The service retrieves records from each HSM partition in batches. Every record in a batch shares a CorrelationId. Exported batch-signature and certificate records allow customers to check whether the batch is authentic and intact. Microsoft Learn says the BATCH_BINARY_SIGNATURE record contains an HSM-generated signature and SHA-256 hash, backed by a certificate chain for verification.

According to Microsoft, audit logging is enabled as an immutable HSM partition policy. The company said this is intended to keep routine HSM administration from disabling coverage for supported operations, but it does not eliminate customer responsibilities for exported data.

Customers configure Azure Monitor diagnostic settings to send HsmOperations records to a Log Analytics workspace, a storage account, or both. In Log Analytics, the records appear in the CloudHsmHardwareOperationAuditLogs table. Microsoft recommends restricting access to those destinations because records can include operational identifiers such as user IDs, session handles and key handles.

The delivery path has timing and history limits. Microsoft Learn says Azure resource-log ingestion can take about 20 minutes under normal conditions. Initial activation of a diagnostic setting can occasionally take up to 90 minutes, and settings do not backfill logs created before they were configured.

Microsoft has separately broadened Sovereign Cloud controls across three deployment models. Hardware Audit Logging is a distinct Azure Cloud HSM feature.

Microsoft said customers remain responsible for destination access controls, retention, alerting, review processes and deciding how the evidence fits their control framework. The feature is rolling out across Azure Cloud HSM public regions and is automatically enabled for newly provisioned resources where available, according to the company. Microsoft did not identify the exact regions available at announcement time or say whether existing resources receive automatic enablement.