Announcing the public preview of Azure confidential VMs with Intel TDX

Announcing the public preview of Azure confidential VMs with Intel TDX

Microsoft is excited to announce the public preview of DCesv5 and ECesv5-series confidential VMs, coming December 2023. These VMs are powered by 4th Gen Intel® Xeon® Scalable processors with Intel® Trust Domain Extensions (Intel® TDX) and enable organizations to bring confidential workloads to the cloud without code changes to applications.


Confidential VMs are designed for tenants with high security and confidentiality requirements, providing a strong, hardware-enforced boundary. They ensure that your data and applications stay private and encrypted even while in use, keeping your sensitive code and other data encrypted in memory during processing.



With this release, we’ve integrated support for integrity features such as boot-time attestation and confidential disk encryption with enterprise key management options for PMK (platform-managed key) and CMK (customer-managed key) using Managed HSM with FIPS 140-2 Level 3 validation. For organizations wanting further separation of duties from the cloud service provider, we’re introducing a new ephemeral vTPM capability and disk integrity tooling which allows third parties to have flexibility and use custom key management, attestation, and disk protection solutions. 


Expanding partnerships with confidential computing partners


We continue to partner across the Confidential Computing Consortium to offer the best Linux experience. Canonical Ubuntu Server 22.04 LTS is available today with support for Full Disk Encryption, both SUSE Linux Enterprise Server and Red Hat Enterprise Linux are coming soon. We’ve also released Windows support for these VMs starting with Windows Server 2019, 2022 and Windows 11. This offering provides the broadest support for remote attestation solutions with native integration of Microsoft Azure Attestation, and support of Intel® Trust Authority for enterprises seeking operator independent attestation.




Enabling confidentiality across a broad range of compute and memory optimized workloads


Through the gated preview, we continued to enhance performance with our Intel partnership. These new virtual machines are up to 20% faster than 3rd Gen Intel Xeon virtual machines, and we expect performance for I/O intensive workloads to continue to improve as the technology matures.


The DCesv5 and DCedsv5-series VMs are designed to offer a balance of memory to vCPU ratio, with up to 96 vCPUs and 384 GiB of memory. The ECesv5 and ECedsv5-series VMs are designed to offer an even higher memory to vCPU ratio, with up to 128 vCPUs and 768 GiB of memory. Both families support remote disks and up to 2.8 TB of local disk storage.


These VM families are designed to support a wide range of general computing workloads, such as load balancers, e-commerce systems, web front ends and desktop virtualization solutions. They’re also ideal for memory-intensive, large relational database servers, business intelligence systems, and other critical applications that process sensitive data.


Getting Started

  • You can start deployments from December 1st in Europe West, Europe North, Central US, and East US 2.


Helpful Links

Published on:

Learn more
Azure Confidential Computing Blog articles
Azure Confidential Computing Blog articles

Azure Confidential Computing Blog articles

Share post:

Related posts

Playwright in Action: From Setup to Best Practices | Azure Developers JavaScript Day 2024

  Another excellent session was held during the Azure Developers JavaScript Day 2024 event! This time, the focus was on Playwr...

12 hours ago

What’s new across Azure Governance services, Microsoft Build 2024

Azure Governance Services have been undergoing exciting developments, with exciting new releases available in the past six months, aimed at pr...

1 day ago

Azure SDK Release (May 2024)

Stay up-to-date on the latest improvements and features with this comprehensive overview of Azure SDK's May 2024 release. The monthly release ...

1 day ago

Automatically enable system managed identity for App Service apps with Azure Policy

A common challenge when updating app service apps with the standard App service ARM template is the mandatory "serverFarmId" property. Th...

1 day ago

Automating Azure Remediation for Policy Initiatives with Azure PowerShell

Introduction and Current Challenges: Policy remediation is a critical aspect of Azure Policy, a service in Microsoft Azure used to create, ass...

1 day ago
Stay up to date with latest Microsoft Dynamics 365 and Power Platform news!
* Yes, I agree to the privacy policy