Microsoft Azure Key Vault Post-Quantum Cryptography Advances with Project Tessera

On October 13, 2026, Microsoft introduced Project Tessera at the OCP Global Summit as an open-source evolution of its Azure Integrated HSM. The project adds post-quantum cryptography to HSM-to-HSM communication protocols while preserving FIPS 140-3 Level 3 certification.

Azure Key Vault and Managed HSM currently support classical RSA, elliptic curve, and 256-bit AES keys. The 256-bit AES keys are described as quantum-resistant because Grover’s algorithm reduces their effective strength by half. In August 2026, Key Vault Premium added support for post-quantum resistant AES key wrapping using these symmetric keys.

Current capabilities in Azure Key Vault and Managed HSM

Microsoft documentation lists no native support for asymmetric post-quantum algorithms such as ML-KEM or ML-DSA as generally available in Key Vault as of October 2026. The company’s SymCrypt library incorporated ML-KEM and ML-DSA in late 2024, and Key Vault features are described as tracking through 2026 with progressive rollouts expected into 2027.

Customers can already use 256-bit AES keys for key wrapping workflows that resist quantum attacks on symmetric operations. Project Tessera extends this protection to internal HSM communication channels, addressing risks from harvest-now-decrypt-later tactics on long-lived keys.

Broader Microsoft efforts include hybrid TLS pilots using ML-DSA that began in August 2026 and platform APIs in Windows and .NET. These changes do not yet extend to native post-quantum key generation inside Key Vault or Managed HSM.

Background and next steps for organizations

NIST published FIPS 203, 204, and 205 in August 2024, standardizing ML-KEM, ML-DSA, and SLH-DSA. Microsoft’s Quantum-Safe Program targets phased integration across services with internal milestones around 2033. Azure documentation advises organizations to inventory classical keys and prepare migration plans, especially for HSM-backed signing operations.

Project Tessera aims to support quantum-resilient operations in open-source HSM components without reducing existing security certifications. Continued phased updates to Key Vault and Managed HSM are expected in late 2026 and 2027, with monitoring recommended through Microsoft Learn documentation and Azure service updates.

Organizations using long-lived certificates or keys in Azure services should track these changes to align with evolving post-quantum standards and avoid future compatibility issues during migration.