What is Azure Confidential Ledger?
Azure Confidential Ledger is a customer-managed, append-only ledger that you create in your own subscription and write records to directly. The service is a workload of the broader Confidential Computing Ledger platform and combines cryptographic techniques with the Confidential Consortium Framework (CCF) to provide immutability, tamper evidence, and append-only behavior. A ledger consists of at least three identical instances, each running in a dedicated, hardware-protected enclave, with integrity maintained through a consensus-based blockchain.
Core Features
- REST interface with SDKs for .NET, Java, Python, and JavaScript
- Cryptographically verifiable transaction receipts based on a Merkle tree
- Grouping of data via collection IDs for structured management and queries
- Runs exclusively in hardware-backed, attested enclaves (Intel SGX)
- Encrypted (private) or plaintext storage (public ledger type), depending on use case
- Distribution across Availability Zones plus automatic replication to a secondary storage region for disaster recovery
Typical Use Cases
Organizations use Confidential Ledger to provide integrity proofs for critical metadata, for example as an external ledger for Azure SQL Database’s ledger feature or to secure Blob Storage operations. Other use cases include logging administrative changes, security-relevant events (such as Microsoft Defender alerts), and confidential transaction data that needs to be selectively shared with auditors.
Benefits
- Provably immutable, tamper-evident records for audits and compliance
- Hardware-based trust foundation with a minimal trusted computing base
- Managed service without custom infrastructure or blockchain operations
- Can be integrated as an additional integrity layer for existing SQL and storage systems
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Confidential Ledger: use case analysis, integration into compliance and audit workflows, and architecture consulting for tamper-proof data storage.
Frequently Asked Questions
What is Azure Confidential Ledger?
Azure Confidential Ledger is a customer-managed, append-only ledger service for tamper-evident records. It is a workload of the Confidential Computing Ledger platform and runs entirely in hardware-protected enclaves.
What is the difference from classical blockchain?
Confidential Ledger uses the Confidential Consortium Framework and combines cryptographic techniques with a consensus-based blockchain across at least three instances, but has no mining and is designed for enterprise integration rather than public decentralization.
Can Microsoft read the data in Confidential Ledger?
The service runs exclusively in hardware-backed, attested enclaves with a minimal trusted computing base, so according to Microsoft no one, including Microsoft itself, is above the ledger. Access is only possible through authenticated users and roles managed within the ledger itself.
Which use cases is Confidential Ledger suitable for?
The service suits use cases that require provably immutable records, such as audit trails, integrity proofs for SQL or blob data, logging of permission changes, or security-relevant events.
What does Azure Confidential Ledger cost?
Billing is based on ledger instance and usage duration, not per transaction. Specific rates are published by Microsoft on the official pricing page and can change.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
