Configure Azure Managed HSM networking settings with IP Network Firewall (preview)

Here's how to configure Managed HSM firewalls by using the Azure portal:

1. Browse to the Managed HSM you want to secure.
2. Select Networking, then select the Public access tab.
3. Under Public network access, select Manage.
4. To add IP addresses to firewalls, next to Public network access, select Enable and next to Default action, select Enable from selected networks.
5. Under IP Networks, add IPv4 address ranges by typing IPv4 address ranges in CIDR (Classless Inter-domain Routing) notation or individual IP addresses.
6. If you want to allow Microsoft Trusted Services to bypass the Managed HSM Firewall, select Yes. For a full list of the current Managed HSM Trusted Services, see Azure Key Vault Trusted Services.
7. Select Save.

Here's how to configure Managed HSM firewalls by using the Azure CLI:

1. Install Azure CLI and sign in.

2. Use the az keyvault update-hsm command to set the default action to Deny before creating a firewall.

   az keyvault update-hsm --resource-group "myresourcegroup" --hsm-name "mymanagedhsm" --default-action Deny
   

3. Use the az keyvault network-rule add command to add an IP address range to allow traffic.

   az keyvault network-rule add --resource-group "myresourcegroup" --hsm-name "mymanagedhsm" --ip-address "191.10.18.0/24"
   

4. If this key vault should be accessible by any trusted services, use the az keyvault update command to set bypass to AzureServices.

   az keyvault update --resource-group "myresourcegroup" --hsm-name "mymanagedhsm" --bypass AzureServices
   

Here's how to configure Managed HSM firewalls by using PowerShell:

1. Install the latest Azure PowerShell, and sign in.

2. Use the Update-AzKeyVaultManagedHsmNetworkRuleSet cmdlet to set default action to Deny and add an IP address range to allow traffic.

   Update-AzKeyVaultManagedHsmNetworkRuleSet -Name "mymanagedhsm" -ResourceGroupName "myresourcegroup" -DefaultAction Deny -IpAddressRange @('16.17.18.0/24') -PassThru 
   

   Include –ReplaceAllRules to overwrite IP Lists. Otherwise, the command merges the newly included rules.

3. If this managed HSM should be accessible by any trusted services, use the Update-AzKeyVaultManagedHsmNetworkRuleSet cmdlet to set bypass to AzureServices.

   Update-AzKeyVaultManagedHsmNetworkRuleSet -Name "mymanagedhsm" -Bypass AzureServices