Confidential Computing: Azure Secures AI via Intel TDX

On February 26, 2026, Microsoft released four new VM series on Azure based on Intel Trust Domain Extensions (TDX). For the first time, companies can operate AI workloads in such a way that even the cloud operator has no access to the data in the RAM. For financial service providers, healthcare companies, and all those processing sensitive data in the cloud, this fundamentally shifts the trust question in cloud architecture.

Key Takeaways

What Intel TDX is and why it’s different from encryption at rest

Encryption has three states: data at rest (on the hard drive), data in transit (on the network), and data in use (in RAM). The first two states have been standard for years. AES-256 for hard drives, TLS for network traffic. The third state was previously the gap.

Intel Trust Domain Extensions (TDX) close this gap at the hardware level. TDX creates isolated execution environments, so-called trust domains, that are shielded from the rest of the system. Even the hypervisor managing the virtual machine has no access to the RAM of the trust domain. This means: Even Microsoft as the cloud operator cannot view the data processed in a TDX-protected VM.

The difference to existing approaches like Intel SGX (Software Guard Extensions) is granularity. SGX protects individual enclaves within an application. TDX protects the entire VM. For companies, this means: Existing applications can run in a TDX-VM without modification and automatically benefit from hardware protection.

What the new Azure VM series can do

The four new VM series are based on fourth-generation Intel Xeon Scalable processors (Sapphire Rapids) with enabled TDX extensions. According to Microsoft, the NVMe SSD variants (DCedsv6, ECedsv6) offer almost five times more throughput than the previous SCSI generation. Latency drops by around 16 percent. Maximum specification: 205,000 IOPS and 4 GB/s network throughput.

For AI workloads, one integration is particularly relevant: Intel AMX (Advanced Matrix Extensions) is available within the TDX-protected environment. AMX accelerates matrix operations that form the backbone of AI inference. Companies can run AI models within the protected VM without sacrificing performance due to encryption.

Why regulated industries should take notice now

Confidential Computing was once a niche topic for intelligence agencies and the military. The general availability of Azure TDX VMs makes it a mainstream offering for companies.

Financial services. Banks and insurers that use AI models for credit decisions, fraud detection, or risk assessment process highly sensitive customer data. With TDX VMs, they can run these models in the cloud without the cloud provider having access to the data. This significantly simplifies the argumentation towards BaFin and DORA requirements.

Healthcare. Hospitals and pharmaceutical companies analyzing patient data with AI face a dilemma: cloud scalability versus data protection. TDX resolves this dilemma by keeping data encrypted even during processing. No single administrator, hypervisor, or cloud provider can access patient data.

Law firms and consultancies. Law firms using AI for contract analysis or due diligence process client-confidential documents. Client confidentiality prohibits processing by third parties in many jurisdictions. TDX VMs eliminate the cloud provider as a third party in the technical sense.

Concrete Use Cases: Where TDX VMs Deliver Value Immediately

Beyond the obvious scenarios in regulated industries, there are practical use cases that IT teams can implement right away.

Multi-Party Data Analytics. Two companies want to analyze data together without revealing it to each other. In a TDX VM, both datasets can be combined and analyzed without either party or the cloud operator seeing the raw data. This enables new collaboration models in research, marketing, and supply chain management.

AI Model Protection. Companies that have trained their own AI models want to deploy them in the cloud without exposing the model itself. TDX protects not only the input data but also the model weights in memory. For innovative AI startups that consider their model a competitive advantage, this is crucial protection.

Secure Key Management. Hardware Security Modules (HSMs) are expensive and complex. TDX VMs offer a software-based alternative for key management, where cryptographic keys are never stored unencrypted in memory accessible by the hypervisor.

Compliance Documentation. Azure’s Attestation Service provides cryptographic proof that a workload ran in a TDX-protected environment. This proof can be directly incorporated into audit reports. For companies that regularly undergo external audits, this significantly reduces documentation effort.

Getting Started: How IT Teams Can Evaluate TDX VMs

The entry barrier is low. Azure offers TDX VM series in all major regions, including West Europe (Netherlands) and Germany West Central (Frankfurt). Provisioning is done via the Azure Portal or CLI, just like any other VM.

Three steps for evaluation:

1. Identify Workloads. Which workloads process the most sensitive data? AI inference with customer data, database queries on personal data, and key management are typical candidates.

2. Measure Baseline. Run the same workload on a regular VM and a TDX VM. Document the performance delta. In most cases, the overhead is less than 5 percent.

3. Integrate Attestation. Incorporate the Azure Attestation Service and check if the cryptographic proofs can be integrated into existing compliance workflows.

Limits and Open Questions

TDX is not a silver bullet. Hardware isolation protects against the cloud operator, but not against vulnerabilities within the VM itself. A compromised application within the trust domain has full access to the data. Classic and proven security measures like regular patching, access controls, and monitoring remain necessary.

Attestation is also a topic. Companies must be able to verify that their VM is actually running in a TDX-protected environment and not in a regular VM. Azure offers an Attestation Service that cryptographically proves that hardware isolation is active. However, integrating it into existing compliance workflows requires engineering effort.

Another point: performance costs. Although Intel emphasizes that TDX causes minimal overhead, independent benchmarks typically show a 2 to 5 percent performance loss compared to unprotected VMs. For most workloads, this is acceptable, but for latency-critical real-time applications, it can become relevant.

AWS and Google Cloud: Where Does the Competition Stand?

Microsoft is not alone. AWS offers Nitro Enclaves, which pursue a similar approach but are based on proprietary hardware instead of Intel TDX. Google Cloud has Confidential VMs based on AMD SEV-SNP (Secure Encrypted Virtualization) available.

The advantage of the Intel TDX variant: TDX is an open standard not tied to a single cloud provider. Theoretically, companies can migrate their TDX-protected workloads between Azure, Google Cloud, and other TDX-capable platforms. In practice, this portability is still limited because each cloud provider brings its own attestation infrastructure and VM configuration. In the medium term, however, TDX as an open standard could become a strong argument against vendor lock-in, especially for companies with multi-cloud strategies.

Conclusion

The general availability of Azure Intel TDX Confidential VMs marks the point at which Confidential Computing evolves from a niche topic to a cloud standard. For companies in regulated industries, the equation changes: the cloud is no longer automatically a data protection risk if data remains encrypted during processing. The logical next step is integrating it into existing AI pipelines. Companies evaluating TDX VMs for sensitive workloads today will gain a compliance edge that will become standard in 12 months. IT leaders in regulated industries should start evaluating now: identify a sensitive workload, benchmark its performance on a TDX VM, and integrate attestation proofs into their compliance documentation. The effort is manageable, and the insights gained are significant.

Frequently Asked Questions

Related Articles

• Sovereignty-Washing – Why an EU data center doesn’t necessarily mean data sovereignty (cloudmagazin)
• Private Cloud for AI – Why regulated industries rely on on-premises solutions (cloudmagazin)
• NIS2 and SaaS – Why the supply chain becomes a compliance gap (cloudmagazin)

Source title image: Firmbee.com / Pexels