Announcing the public preview of Azure confidential VMs with Intel TDX

Microsoft is excited to announce the public preview of DCesv5 and ECesv5-series confidential VMs, coming December 2023. These VMs are powered by 4th Gen Intel® Xeon® Scalable processors with Intel® Trust Domain Extensions (Intel® TDX) and enable organizations to bring confidential workloads to the cloud without code changes to applications.

 

Confidential VMs are designed for tenants with high security and confidentiality requirements, providing a strong, hardware-enforced boundary. They ensure that your data and applications stay private and encrypted even while in use, keeping your sensitive code and other data encrypted in memory during processing.

 

 

With this release, we’ve integrated support for integrity features such as boot-time attestation and confidential disk encryption with enterprise key management options for PMK (platform-managed key) and CMK (customer-managed key) using Managed HSM with FIPS 140-2 Level 3 validation. For organizations wanting further separation of duties from the cloud service provider, we’re introducing a new ephemeral vTPM capability and disk integrity tooling which allows third parties to have flexibility and use custom key management, attestation, and disk protection solutions. 

 

Expanding partnerships with confidential computing partners

 

We continue to partner across the Confidential Computing Consortium to offer the best Linux experience. Canonical Ubuntu Server 22.04 LTS is available today with support for Full Disk Encryption, both SUSE Linux Enterprise Server and Red Hat Enterprise Linux are coming soon. We’ve also released Windows support for these VMs starting with Windows Server 2019, 2022 and Windows 11. This offering provides the broadest support for remote attestation solutions with native integration of Microsoft Azure Attestation, and support of Intel® Trust Authority for enterprises seeking operator independent attestation.

 

 

Enabling confidentiality across a broad range of compute and memory optimized workloads

 

Through the gated preview, we continued to enhance performance with our Intel partnership. These new virtual machines are up to 20% faster than 3^rd Gen Intel Xeon virtual machines, and we expect performance for I/O intensive workloads to continue to improve as the technology matures.

 

The DCesv5 and DCedsv5-series VMs are designed to offer a balance of memory to vCPU ratio, with up to 96 vCPUs and 384 GiB of memory. The ECesv5 and ECedsv5-series VMs are designed to offer an even higher memory to vCPU ratio, with up to 128 vCPUs and 768 GiB of memory. Both families support remote disks and up to 2.8 TB of local disk storage.

 

These VM families are designed to support a wide range of general computing workloads, such as load balancers, e-commerce systems, web front ends and desktop virtualization solutions. They’re also ideal for memory-intensive, large relational database servers, business intelligence systems, and other critical applications that process sensitive data.

 

Getting Started

• You can start deployments from December 1st in Europe West, Europe North, Central US, and East US 2.

 

Helpful Links

• DCesv5 and DCedsv5-series confidential VMs specifications
• ECesv5 and ECedsv5-series confidential VMs specifications
• Azure Confidential Computing – Protect Data in Use
• Azure Confidential Computing – Microsoft Tech Community Blog
• Learn more about Intel Confidential Computing