New-AzKeyVaultManagedHsm

Module:

Az.KeyVault Module

Creates a managed HSM.

New-AzKeyVaultManagedHsm
 [-Name] <String>
 [-ResourceGroupName] <String>
 [-Location] <String>
 [-Administrator] <String[]>
 [-Sku <String>]
 -SoftDeleteRetentionInDays <Int32>
 [-PublicNetworkAccess <String>]
 [-EnablePurgeProtection]
 [-UserAssignedIdentity <String[]>]
 [-Tag <Hashtable>]
 [-NetworkRuleSet <PSManagedHsmNetworkRuleSet>]
 [-AsJob]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [-SubscriptionId <String>]
 [<CommonParameters>]

The New-AzKeyVaultManagedHsm cmdlet creates a managed HSM in the specified resource group. To add, remove, or list keys in the managed HSM, user should:

1. grant permissions by adding user ID to Administrator;
2. add role assignment for user like "Managed HSM Crypto User" and so on;
3. back up security domain data of a managed HSM using Export-AzKeyVaultSecurityDomain.

New-AzKeyVaultManagedHsm -Name 'myhsm' -ResourceGroupName 'myrg1' -Location 'eastus2euap' -Administrator "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -SoftDeleteRetentionInDays 70

Name Resource Group Name Location SKU
---- ------------------- -------- ---
myhsm myrg1 eastus2euap StandardB1

This command creates a managed HSM named myhsm in the location eastus2euap. The command adds the managed HSM to the resource group named myrg1. Because the command does not specify a value for the SKU parameter, it creates a Standard_B1 managed HSM.

New-AzKeyVaultManagedHsm -Name 'myhsm' -ResourceGroupName 'myrg1' -Location 'eastus2euap' -Administrator "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -Sku 'CustomB32' -SoftDeleteRetentionInDays 70

Name Resource Group Name Location SKU

---- ------------------- -------- ---
myhsm myrg1 eastus2euap CustomB32

This command creates a managed HSM, just like the previous example. However, it specifies a value of CustomB32 for the SKU parameter to create a CustomB32 managed HSM.

New-AzKeyVaultManagedHsm -Name 'myhsm' -ResourceGroupName 'myrg1' -Location 'eastus2euap' -Administrator "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"-SoftDeleteRetentionInDays 70 -UserAssignedIdentity /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identityName | Format-List

Managed HSM Name : myhsm
Resource Group Name : myrg1
Location : eastus2euap
Resource ID : /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/bez-rg/pro
 viders/Microsoft.KeyVault/managedHSMs/bezmhsm
HSM Pool URI :
Tenant ID : 00001111-aaaa-2222-bbbb-3333cccc4444
Initial Admin Object Ids : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
SKU : StandardB1
Soft Delete Enabled? : True
Enabled Purge Protection? : False
Soft Delete Retention Period (days) : 70
Public Network Access : Enabled
IdentityType : UserAssigned
UserAssignedIdentities : /subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identityName
Provisioning State : Succeeded
Status Message : The Managed HSM is provisioned and ready to use.
Security Domain ActivationStatus : Active
Security Domain ActivationStatusMessage : Your HSM has been activated and can be used for cryptographic operations.
Regions :
Tags

This command creates a managed HSM with an user assigned identity.

$ruleSet = New-AzKeyVaultManagedHsmNetworkRuleSetObject -DefaultAction Deny -Bypass AzureServices -IpAddressRange 203.0.113.0/24,198.51.100.10/32
New-AzKeyVaultManagedHsm -Name 'securehsm' -ResourceGroupName 'myrg1' -Location 'eastus2euap' -Administrator "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -SoftDeleteRetentionInDays 30 -NetworkRuleSet $ruleSet

DefaultAction Bypass IpAddressRanges VirtualNetworkResourceIds
------------- ------ --------------- -------------------------
 Deny AzureServices {203.0.113.0/24, 198.51.100.10/32}



Name Resource Group Name Location SKU ProvisioningState Security Domain ActivationStatus
---- ------------------- -------- --- ----------------- --------------------------------
mhsm1814428918 kv-mhsm-rg eastus StandardB1 Succeeded NotActivated

$h.OriginalManagedHsm.Properties.NetworkAcls
Bypass : AzureServices
DefaultAction : Deny
IPRules : {203.0.113.0/24, 198.51.100.10/32}
ServiceTags : {}
VirtualNetworkRules : {}

This pattern enables the firewall at creation time (DefaultAction Deny) while allowing two specific IP ranges plus trusted Azure services. Additional IPs can later be appended with Add-AzKeyVaultManagedHsmNetworkRule.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.