Azure Managed HSM vs KeyRack

Azure Managed HSM is a cloud service for managing cryptographic keys backed by hardware security modules. It supports customer-managed keys, automatic key rotation, audit logs and key import through a web-accessed service. Both listed key types are supported. The Standard B1 plan is a Managed HSM pool billed by hourly usage fee per HSM pool; no price is provided. Azure lists no free plan. The cloud deployment model suits organisations that want managed HSM capabilities rather than a self-hosted installation. Key import allows existing keys to be brought into the service, while automatic rotation handles scheduled key changes. Audit logs provide activity records for review. Teams evaluating the service can focus on whether HSM-backed protection, customer control, import, rotation and logging meet their key-management needs, and whether hourly pool billing fits their usage.

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.