Price reduction and upcoming features for Azure confidential ledger!
Effective March 1, 2025, you can keep your records in Azure confidential ledger (ACL) at the reduced price of ~$3/day per instance! The reduced price is for the computation and the ledger use. The price of any additional storage used will remain unchanged. To tamper protect your records: Automatically create hash (e.g. MD5 or SHA256) of your blob storage data and keep those in Azure confidential ledger. For forensics, you can verify the integrity of the data against the signature in ACL. Imagine doing this as you are migrating data from one system to another, or when you restore archived records from cold storage. It is also valuable when there is a need to protect from insider/administrator risks and confidently report to authorities. If you keep your data in Azure SQL database, you can use their security ledger feature to auto generate record digests and store them in confidential ledger for integrity protection and safeguarding. You can use the SQL stored procedure to verify that no tampering or administrator modifications occurred to your SQL data! In addition, we are announcing the preview of User Defined Functions for Azure confidential ledger. Imagine doing a schema validation before writing data to the Ledger or using pattern matching to identify sensitive information in log messages and perform data massaging to mask it. To increase your awareness, request access for this preview via the sign-up form. Get started by reading our documentation and trying out confidential ledger yourself! _____________________________________________________________________________________________________ What is Azure confidential ledger and what is the change? It is a tamper protected and auditable data store backed by a Merkle tree blockchain structure for sensitive records that require high levels of integrity protection and/or confidentiality. While customers from AI, financial services, healthcare, and supply chain continue to use the ledger for their business transaction’s archival needs and confidential data’s unique identifiers for audit purposes, we are acting on their feedback for scaling ledgers to more of their workloads with a more competitive price! How can I use Azure confidential ledger? - Azure SQL database ledger customers can enable confidential ledger as its trusted digest store to uplevel integrity and security protection posture - Azure customers who use blob storage have found value in migrating their workloads to Azure with a tamper protection check via the Azure confidential ledger Marketplace App. - Azure customers who use data stores and databases (e.g. Kusto, Cosmos, and Log Analytics) may benefit from auditability and traceability of logs being kept in the confidential ledger with new compliance certifications in SOC 2 Type 2 and ISO27001. How much does Azure confidential ledger cost? - Approximately $3/day/ledger _____________________________________________________________________________________________________ Resources Explore the Azure confidential ledger documentation Read the blog post on: Integrity protect blob storage Read the blog post on: How to choose between ledger in Azure SQL Database and Azure Confidential Ledger Read the blog post on: Verify integrity of data transactions in Azure confidential ledger View our recent webinar in the Security Community Recent case studies: HB Antwerp & BeekeeperAIPreview: New DCasv6 and ECasv6 confidential VMs based on 4th Generation AMD EPYC™ processors
You can get started deploying your software on these confidential VMs by signing up here. Additional security enhancements With the launch of the DCasv6 and ECasv6 confidential VM family – we support AES-256 memory encryption enabled by default. Additionally, we now offer our customers the capability to leverage key protection with Virtualization-based Security (VBS) in Windows. By enabling key protection in Windows CVMs, customers can protect keys in-use from Guest OS and applications. This key protection is enforced by CPU hardware. Faster performance for confidential workloads These new CVMs have demonstrated up to 25% improvement in various benchmarks compared to our previous generation of AMD-based confidential VMs. KT is leveraging Azure confidential computing to secure sensitive and regulated data from its telco business in the cloud. With new V6 CVM offerings in Korea Central Region, KT extends its use to help Korean customers with enhanced security requirements, including regulated industries, benefit from the highest data protection as well as the fastest performance by the latest AMD SEV-SNP technology through its Secure Public Cloud built with Azure confidential computing. - Woojin Jung, EVP, KT Corporation Worldwide Region Availability These CVMs will be gradually made available across all supported Azure regions and availability zones. Please use the sign-up form to indicate interest in participating in the gated preview and regional requirements. General purpose & Memory-intensive workloads Featuring general purpose optimized memory-to-vCPU ratios and support up to 96 vCPUs and 384 GiB RAM, the DCasv6-series delivers enterprise-grade performance. The DCasv6-series enables organizations to run sensitive workloads with hardware-based security guarantees, making them ideal for applications processing regulated or confidential data. For more memory demanding workloads, the new ECasv6-series offer high memory-to-vCPU ratios with increased scalability up to 96 vCPUs and 672 GiB of RAM. The ECasv6-series is ideal for memory-intensive enterprise applications offering nearly double the memory capacity of DCasv6. The ECasv6-series scales 672 GiB RAM with up to 96 vCPUs, making them ideal for memory intensive applications that exceed even the capabilities of the DCasv6 series. DCasv6 DCadsv6 ECasv6 ECadsv6 vCPU 2 - 96 2 - 96 2 - 96 2 - 96 Memory 8 - 384 8 - 384 16 - 672 16 - 672 Max local disk NA 75-600GiB NA 75-600GiB OS Support These CVMs support the following guest operating systems: Windows Server 2019, 2022, 2025, Windows 11, Ubuntu 22.04, Ubuntu 24.04, and RHEL 9.4. Endorsements from our customers The BMW Group relies on Azure confidential VMs powered by AMD EPYC processors to enable a Zero Trust environment with end-to-end encryption for our identity authentication system, allowing over 200,000 associates to collaborate on building the future of individual mobility. The solution was made possible in part due to the fact that AMD EPYC processor based confidential VMs do not require code changes to protect data in memory. Further, our testing of the newest generation of DCasv6 VMs has shown significant improvements in performance, and we look forward to seeing them go live on Azure. - BMW Group Having early access to Microsoft’s latest confidential VMs is a game-changer, offering enhanced security and performance. Our customers are pleased that they won’t have to adapt existing algorithms to take advantage of computing within the optimal CVM environment available in their computing region and selected within the EscrowAI platform. - Mary Beth Chalk, Co-founder & Chief Commercial Officer, BeeKeeperAI Anjuna is thrilled to be among the first to access Microsoft’s latest confidential VMs, powered by the newest version of the AMD SEV-SNP technology. Our ongoing partnership with Microsoft Azure provides us with early access to explore advanced security and performance features. This collaboration empowers joint Azure and Anjuna customers to leverage the newest Azure technologies from day one, enhanced by the capabilities of the Anjuna Seaglass platform. - Ofir Azoulay-Rozanes, Director of Product Management, Anjuna Security Sign up now for exclusive access Joining our exclusive preview program gives you an opportunity to work with the product team. To get started deploying your software on the latest confidential VMs sign up here.Aligning with Kata Confidential Containers to achieve zero trust operator deployments with AKS
Confidential containers on Azure Kubernetes Service (AKS) leveraging Kata confidential containers open-source project are coming soon to Azure. If you would like to be part of the preview, please express your interest here https://aka.ms/cocoakspreviewNavigating confidential computing across Azure
Confidential computing is the protection of data in use by performing computation in a hardware-based Trusted Execution Environment. This article describes the latest offering for confidential computing in Azure, typical use cases of adoption of confidential computing, and a few customers that are using Azure confidential computing today to protect their confidential data.
