---
id: azure-keyvault-securitydomain
version: "1.0.0b1"
license: MIT License
license_treatment: permissive
maintenance: active
---

# azure-keyvault-securitydomain — Microsoft Corporation Azure Keyvault Securitydomain Client Library for Python

License: permissive · Maintenance: active · Downloads: 4.7M/mo

## What it is and what it does

This library provides a Python client for managing security domains in Azure Key Vault Managed HSM. A security domain is an encrypted blob containing HSM backup artifacts, user credentials, signing keys, and encryption keys unique to each managed HSM. The SecurityDomainClient lets you download a security domain from one HSM (to activate it or prepare for disaster recovery), get transfer keys for encrypting domains before upload, and upload a security domain to restore or migrate an HSM.

The package is part of the Azure SDK for Python and integrates with azure-core for HTTP transport and typing-extensions for type support. It supports both synchronous and asynchronous clients, and is actively maintained. The library is currently in Beta, so its API may evolve; it requires Python 3.9 or later and an existing Managed HSM instance in Azure.

Use it for:

- Activate a provisioned Managed HSM by downloading its security domain after initial setup.
- Prepare a managed HSM for disaster recovery by downloading and securely storing its security domain.
- Restore a managed HSM from a previously downloaded security domain after a failure or migration.
- Migrate security domains between managed HSMs in different Azure regions or subscriptions.
- Obtain transfer keys to encrypt security domains before uploading them to a different HSM.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Manages security domains for Azure Key Vault Managed HSM—download, upload, and transfer security domain artifacts for HSM activation and disaster recovery.

Yes, if you operate Azure Key Vault Managed HSM and need to manage security domains programmatically. The package has low install friction, active maintenance, no known vulnerabilities, and a permissive license. The Beta status means the API may change, so pin the version in production. If you only use standard Key Vault (not Managed HSM), this library is not relevant.

## Install

pip install azure-keyvault-securitydomain
uv add azure-keyvault-securitydomain
poetry add azure-keyvault-securitydomain

## Installing azure-keyvault-securitydomain

Before you install: Low install friction with three lightweight runtime dependencies (isodate, azure-core, typing-extensions). Active maintenance with recent commits; marked as Beta (Development Status 4) so expect API evolution.

License in practice: MIT License permits commercial and private use with minimal restrictions; suitable for most projects.

Quickstart:

pip install azure-keyvault-securitydomain

from azure.keyvault.securitydomain import SecurityDomainClient

client = SecurityDomainClient(vault_url=VAULT_URL, credential=credential)
security_domain = client.begin_download(certificate_info=certs).result()

Requires Python 3.9 or later; requires an existing Azure Key Vault Managed HSM and valid credentials configured externally.

Verify before relying:

- Whether async support (aio module) is fully documented and tested in production scenarios.
- Performance characteristics and latency for large security domain transfers.
- Specific error handling and retry behavior for network failures during long-running operations.

## Package facts

- License: MIT License (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 4.7M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

azure key vault managed hsm, security domain management, hsm backup restore, azure disaster recovery, managed hsm activation, security domain download upload, azure key vault sdk, azure-sdk, hsm-management, disaster-recovery

[View on SkillFed](https://skillfed.io/packages/azure-keyvault-securitydomain) · [View on PyPI](https://pypi.org/project/azure-keyvault-securitydomain/)