Azure Confidential Computing

Confidential computing is the third pillar of data protection — data in use — complementing encryption at rest and in transit. Azure Confidential Computing uses hardware-based Trusted Execution Environments (TEEs) so workloads run on encrypted memory the host (and Microsoft) cannot inspect, with cryptographic attestation to prove the TEE state to a remote relying party before secrets are released.

When to use

• Multi-party data collaboration where parties must compute on each other's data without seeing it (clean rooms, fraud consortia, joint analytics).
• Regulated workloads requiring isolation from cloud operator access (defense, certain financial / healthcare scenarios).
• Sensitive AI training/inference where model weights or training data are crown jewels.
• Cryptographic operations that must be hardware-rooted with attestation evidence.

Do not use this skill for ordinary data-at-rest CMK (azure-key-vault), generic app encryption, or non-Azure TEE / Intel SGX-only designs.