What is Azure Payment HSM?
Azure Payment HSM is a BareMetal service built on Thales payShield 10K payment hardware security modules. These physical devices perform cryptographic key operations for real-time, critical payment transactions in the Azure cloud. The service targets payment service providers and financial institutions that want to move payment systems to the public cloud without giving up the Payment Card Industry (PCI) requirements for security, audit compliance, low latency and high performance.
HSMs are provisioned and connected directly to the customer’s virtual network, and administrative control rests entirely with the customer. HSMs can be provisioned as a pair and configured for high availability. Microsoft notes that this is a highly specialized service and recommends reviewing the pricing and getting-started documentation before committing.
Core Features
Single-tenant HSM with sole control: The HSM is allocated exclusively to one customer. Once allocated, Microsoft states it has no access to customer data; when the device is released, data is zeroized and erased.
Native network integration: Provisioning creates two host network interfaces and one management interface, visible as resources in an Azure resource group.
Remote management via payShield Manager: Administration and key ceremonies run through Thales payShield Manager and the payShield Trusted Management Device (TMD).
Certified hardware: The payShield 10K HSMs used are certified to FIPS 140-2 Level 3 and PCI HSM v3 according to the vendor.
Scalable subscription tiers: Multiple subscription options cover different performance and application requirements; the highest performance level of the service is 2,500 CPS.
Typical Use Cases
Payment processing and authorization: Card and mobile payment authorization, PIN and EMV cryptogram validation, and 3-D Secure authentication.
Issuing payment credentials: Personalization of cards, mobile secure elements, wearables, connected devices and host card emulation applications.
Protecting keys and authentication data: Key management for POS, mPOS and SPOC, remote key loading for ATM and POS devices, and PIN generation, printing and routing.
Sensitive data protection: Point-to-point encryption (P2PE), security tokenization for PCI DSS compliance, and EMV payment tokenization.
Benefits
- Migrate existing payShield workloads without modifying payment applications or HSM software
- Reduce the physical HSM footprint in your own datacenters while keeping the same certification basis
- Deploy as part of validated PCI P2PE or PCI PIN components and solutions
- Subscription model instead of purchasing physical hardware, lowering upfront investment for new market entrants
- More flexible HSM utilization and simpler sharing across geographically dispersed teams
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you in evaluating, planning and connecting Azure Payment HSM: network design for virtual network integration, operations and high availability concepts, and embedding the service into existing payment and compliance processes.
Contact us for a no-obligation consultation on Azure Payment HSM.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
How does Azure Payment HSM differ from Azure Dedicated HSM?
Azure Payment HSM is purpose-built for payments and uses Thales payShield 10K payment HSMs certified to PCI HSM v3. It supports payment use cases such as PIN and EMV cryptogram validation, 3-D Secure and remote key loading. For non-payment key operations, Microsoft offers Azure Dedicated HSM and Managed HSM.
Does Microsoft have access to the keys in the Payment HSM?
According to Microsoft, once an HSM is allocated to a customer, Microsoft has no access to customer data. When the HSM is no longer required, customer data is zeroized and erased as soon as the HSM is released.
Do existing payment applications need to be modified?
The documentation states that migrating existing applications to the Azure solution requires no modifications to payment applications or HSM software, because the same payShield hardware is used.
How are the HSMs managed?
Management is performed remotely through Thales payShield Manager and the payShield Trusted Management Device (TMD) together with the associated smart card readers and smart cards. Existing Thales customers can continue to use their remote management solutions; new customers source the accessories from Thales or a partner.
Which compliance requirements does the service address?
Microsoft maintains PCI DSS and PCI 3DS compliant Azure datacenters, including those housing Azure Payment HSM solutions. The payShield 10K HSMs used are certified to FIPS 140-2 Level 3 and PCI HSM v3. Your own certification depends on the specific design of your solution.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
