azure-keyvault-securitydomain

What it is and what it does

This library provides a Python client for managing security domains in Azure Key Vault Managed HSM. A security domain is an encrypted blob containing HSM backup artifacts, user credentials, signing keys, and encryption keys unique to each managed HSM. The SecurityDomainClient lets you download a security domain from one HSM (to activate it or prepare for disaster recovery), get transfer keys for encrypting domains before upload, and upload a security domain to restore or migrate an HSM.

The package is part of the Azure SDK for Python and integrates with azure-core for HTTP transport and typing-extensions for type support. It supports both synchronous and asynchronous clients, and is actively maintained. The library is currently in Beta, so its API may evolve; it requires Python 3.9 or later and an existing Managed HSM instance in Azure.

Use it for:

• Activate a provisioned Managed HSM by downloading its security domain after initial setup.
• Prepare a managed HSM for disaster recovery by downloading and securely storing its security domain.
• Restore a managed HSM from a previously downloaded security domain after a failure or migration.
• Migrate security domains between managed HSMs in different Azure regions or subscriptions.
• Obtain transfer keys to encrypt security domains before uploading them to a different HSM.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Manages security domains for Azure Key Vault Managed HSM—download, upload, and transfer security domain artifacts for HSM activation and disaster recovery.

Yes, if you operate Azure Key Vault Managed HSM and need to manage security domains programmatically. The package has low install friction, active maintenance, no known vulnerabilities, and a permissive license. The Beta status means the API may change, so pin the version in production. If you only use standard Key Vault (not Managed HSM), this library is not relevant.

Install

azure-keyvault-securitydomain on PyPI

pip install azure-keyvault-securitydomain

uv add azure-keyvault-securitydomain

poetry add azure-keyvault-securitydomain

Installing azure-keyvault-securitydomain

Before you install

Low install friction with three lightweight runtime dependencies (isodate, azure-core, typing-extensions). Active maintenance with recent commits; marked as Beta (Development Status 4) so expect API evolution.

License in practice

MIT License permits commercial and private use with minimal restrictions; suitable for most projects.

Quickstart

pip install azure-keyvault-securitydomain

from azure.keyvault.securitydomain import SecurityDomainClient

client = SecurityDomainClient(vault_url=VAULT_URL, credential=credential)
security_domain = client.begin_download(certificate_info=certs).result()

Requires Python 3.9 or later; requires an existing Azure Key Vault Managed HSM and valid credentials configured externally.

Verify before relying

• Whether async support (aio module) is fully documented and tested in production scenarios.
• Performance characteristics and latency for large security domain transfers.
• Specific error handling and retry behavior for network failures during long-running operations.

Package facts

Evidence: azure_keyvault_securitydomain-1.0.0b1-py3-none-any.whl

Keywords: azure, azure sdk

Tags

More Cryptography packages