Every enterprise security review covers the same two states of data. Encrypted at rest, encrypted in transit, tick and move on. The third state rarely gets the same scrutiny, and it is the one that matters most: data in use. The moment a workload decrypts a record to actually compute on it, that plaintext sits in memory, visible in principle to the hypervisor, the host operating system, and anyone with sufficient privilege on the underlying infrastructure. For most workloads that residual risk is accepted quietly. For regulated data it is often the reason a migration stalls.
Azure Confidential Computing addresses that gap with hardware based trusted execution environments. On AMD SEV-SNP and Intel TDX backed virtual machines, memory is encrypted by the CPU itself using keys the host cannot access. The cloud operator can schedule and run your workload without being able to read what it processes. This is a meaningful shift in the trust model. Instead of trusting Microsoft’s operational controls and contractual commitments, you rely on a silicon enforced boundary that can be cryptographically verified.
Verification is the part enterprise architects should focus on. Remote attestation lets a workload prove to a relying party that it is running inside a genuine trusted execution environment, on patched firmware, with the exact code image you expect. Microsoft Azure Attestation issues a signed token that other services can evaluate before releasing anything sensitive. Wire that into Azure Key Vault Managed HSM with a secure key release policy and decryption keys become available only to an attested environment. The result is a system where access to data is conditional on provable execution state rather than on an identity that could be compromised.
The practical use cases are the ones enterprises have been circling for years. Multi party analytics where two institutions want a joint result without exposing their raw datasets to each other. Confidential inference where a model runs against protected health or financial records with the operator unable to observe either the prompt or the output. Confidential containers on Azure Kubernetes Service, which extend the same guarantees to pod level workloads without a full application rewrite. Each of these turns a data sharing conversation that used to end in a legal impasse into an architectural problem with a real answer.
There are trade offs worth planning for. Confidential VM sizes carry a cost premium, some workloads see modest performance overhead, and attestation adds operational moving parts your platform team needs to own. None of that is disqualifying, but it does mean confidential computing should be applied deliberately to the workloads where the trust boundary genuinely blocks progress rather than switched on everywhere by policy.
If your organization has a data set that never moved to the cloud because someone could not answer “who can see it while it is being processed,” that question now has a technical answer. Worth revisiting the workloads you shelved.
