← Back to Blog Comparison

Azure Key Vault and Post Quantum Cryptography: 2026 Status

8 min read

Microsoft's PQC Position

Microsoft has delivered Post Quantum Cryptography across its platform stack through 2024-2026 via the SymCrypt cryptographic library. As of April 2026:

  • SymCrypt: ML-KEM, LMS, XMSS, ML-DSA shipped through 2024.
  • Windows Server 2025: PQC APIs GA.
  • Windows 11 24H2 and 25H2: PQC APIs GA.
  • .NET 10: PQC APIs GA.
  • Azure Key Vault: PQC features rolling out through 2026-2027.
  • Internal migration target: 2033.

Azure Key Vault Specifics

Azure Key Vault stores cryptographic keys, secrets, and certificates. As of April 2026:

  • Key types supported for PQC: ML-KEM and ML-DSA via SymCrypt; availability depends on the specific Key Vault tier and region.
  • HSM-backed keys: classical only in general availability; PQC HSM support through vendors like Thales.
  • TLS to/from Azure Key Vault: progressively hybrid ML-KEM.
  • Managed HSM: PQC support tracking but not GA for all scenarios.

What's Still Classical

Azure AD (now Entra ID) token signing, most Azure service-to-service TLS internally, and certificate chains from Azure-managed CAs are still mostly classical. Expect progressive migration through 2027-2030.

Migration Path for Azure Customers

  1. Use SymCrypt PQC APIs in new application code.
  2. Migrate Key Vault keys to ML-KEM/ML-DSA where supported.
  3. Deploy hybrid ML-KEM in Azure Front Door and Azure Application Gateway.
  4. Align with Microsoft's 2033 internal target.

Frequently Asked Questions

Does Azure Key Vault support ML-KEM?

ML-KEM and ML-DSA key types are supported via SymCrypt. Specific Azure Key Vault tier and region availability varies through 2026-2027.

Does Entra ID use PQC?

Not yet as of April 2026. Token signing remains classical. Microsoft has communicated a 2033 internal migration target.

Where is Microsoft's PQC commitment documented?

Microsoft Security Blog post 'Post-Quantum Cryptography APIs Now Generally Available on Microsoft Platforms' (2024). SymCrypt is open source on GitHub.

Is Azure PQC compatible with AWS PQC?

Both support NIST-standardized ML-KEM via hybrid TLS. Interoperability is good for standard protocols (TLS 1.3); internal service-to-service differences exist.

Sources

  1. Microsoft PQC APIs

Related Articles

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/azure-key-vault-post-quantum.