page_type	sample
languages	yaml python shell C++ PowerShell AzureCLI javascript
products	azure-confidential-computing azure-kubernetes-service azure-attestation-service azure-container-instances azure-container-apps azure-functions azure-service-bus azure-virtual-machines
description	Azure Confidential Computing Samples
urlFragment	confidential-computing-samples

Confidential Computing Samples

Last Updated: November 2026

Heads up — this is the new home for Azure Confidential Computing samples. https://aka.ms/accsamples now redirects here. The previous repository, Azure-Samples/confidential-container-samples, is still available for reference but is no longer actively maintained. New samples and updates land here.

Security is a key driver accelerating the adoption of cloud computing, but it's also a major concern when you're moving extremely sensitive IP and data scenarios to the cloud.

Confidential computing is the protection of data-in-use through isolating computations to a hardware-based trusted execution environment (TEE). While data is traditionally encrypted at rest and in transit, confidential computing protects your data while it's being processed. A TEE provides a protected container by securing a portion of the hardware's processor and memory. You can run software on top of the protected environment to shield portions of your code and data from view or modification from outside of the TEE. read more

📚 Want to learn more? See the official Azure Confidential Computing documentation at https://aka.ms/accdocs.

Start here: choose a sample

Follow the selected guide's prerequisites, deployment, verification, and cleanup steps. Not every sample requires every tool listed below.

I want to...	Start with	What to expect
Deploy a simple web container on confidential managed compute	Container Apps hello world	Public HTML endpoint on a dedicated DC4 workload profile in UAE North; no image build required.
Run an HTTP-triggered function on confidential compute	Native Functions on Container Apps	Node.js 24 JSON API, managed identity, fresh ACR builds, and private Blob host storage; start by deploying the sibling confidential environment.
Check that those Container Apps actually select confidential compute	DC4 placement verification	Read-only PowerShell and portal checks for each app's environment/profile binding and revision health; not independent hardware attestation.
Send and receive messages through a confidential managed service	Service Bus Premium	New confidential-enabled namespace, passwordless messaging, and exact message read-back checks.
Explore attestation in a container	Visual attestation v2 on ACI	Direct Microsoft Azure Attestation calls and a Confidential-versus-Standard comparison.
Deploy a confidential VM or H100 confidential GPU VM	VM samples	AMD SEV-SNP, Intel TDX, and H100 paths with sample-specific attestation and prerequisites.
Run a confidential H100 GPU workload on Kubernetes	AKS confidential H100 worker	Guide-only GPU Operator automation on the latest offered AKS node image, TensorFlow GPU validation, and strict GPU attestation before and after the workload. Compute stops automatically; delete the resource group afterward.
Keep partner datasets separate while computing shared results	Federated multi-party analytics	Each partner processes its own data in its own TEE and returns aggregates.
Explore confidential video processing	Automotive machine vision	Confidential ACI video redaction with HTTPS, CCE policy, and an attestation gate.

For the full catalog, see Sample Categories. To understand validation and CI, see Validation Automation.

Before deploying: check regional support, quota, permissions, and your organization's policies. Samples can create billable resources. Cleanup behavior varies: the Container Apps examples retain resources until you explicitly remove them, whereas some other demos automatically clean up. Public demo endpoints must not be used to send sensitive data.

⚠️ Disclaimer

IMPORTANT: This repository contains sample code for educational and demonstration purposes only.

• No Warranty: This code is provided "AS IS" without warranty of any kind, express or implied
• Not Production-Ready: These samples are not intended for production use without thorough review and modification
• User Responsibility: Users are solely responsible for:
  • Reviewing and testing all code before deployment
  • Ensuring compliance with their organization's security policies
  • Validating cryptographic implementations meet their security requirements
  • Proper key management and secret handling
  • Any data processed using these samples
• AI-Assisted Content: Several samples in this repository were created with significant assistance from AI coding tools, primarily GitHub Copilot inside Visual Studio Code, to showcase modern AI-assisted development. While functional, AI-assisted code should always be reviewed by qualified security professionals before use in sensitive scenarios.

What's New (November 2026)

Addition	Description
Confidential H100 AKS worker	Deploy a single confidential H100 worker using the Azure onboarding guide's GPU Operator path and latest offered AKS image. Includes strict GPU attestation, a GPU-verified TensorFlow workload, redacted example output, and automatic compute shutdown. Revalidated in West Europe; successful execution on a newer image is not vendor-support certification.
Confidential Container Apps hello world	Deploy Microsoft's HTML quickstart using ARM and PowerShell, explicitly bound to a dedicated DC4 confidential workload profile in UAE North.
Native Azure Functions on confidential Container Apps	Tested Node.js 24 GET /api/hello JSON endpoint with fresh ACR builds, immutable image deployment, managed identity, and private Blob host storage. Includes local Azurite testing, host-health checks, and portal/API access instructions.
Explicit confidential-compute validation	Read live app/environment resources, match the selected profile to DC4, and check active/healthy revisions. Includes expected output and portal cross-checks, with a clear distinction from cryptographic attestation.

Previously (October 2026)

Addition	Description
Confidential Service Bus Premium	Deploy a new confidential-enabled Premium namespace and queue, assign scoped Sender/Receiver roles, and verify three JSON messages using passwordless Entra authentication. The guide covers Korea Central/UAE North availability, configuration evidence, and cleanup.

Previously (September 2026)

Addition

Description

NVIDIA H100 Confidential GPU VMs 🆕

BuildRandomCVM.ps1 now deploys Standard_NCC40ads_H100_v5 confidential GPU VMs with the checksum-pinned Azure CGPU onboarding V4.3.3 flow. It verifies production CC mode, requires successful NVIDIA H100 attestation, and then requires AMD SEV-SNP compliance from Microsoft Azure Attestation. The private, NAT-enabled flow was validated end to end in West Europe with NVIDIA driver 595.71.05, Secure Boot, vTPM, a CMK-backed confidential OS disk, and automatic smoke-test cleanup.

Previously (June 2026)

Addition	Description
Visual Attestation Demo v2 (ACI) 🆕	Simplified ACI port of the AKS visual attestation sample. Flask app calls Microsoft Azure Attestation directly via the upstream get-snp-report tool — no SKR sidecar, single container. Side-by-side Confidential vs Standard SKU deployment demonstrates falsifiability: the same image fails deterministically on Standard (no /dev/sev-guest), proving the success case really came from AMD silicon.
Sealed Container (ACI) — updated 🆕	New sealed-container guidance and features: -WelcomeSecret encryption/decryption flow, artifact integrity verification walkthrough (checksums vs signatures), clearer UI section highlighting, and updated deployment defaults/documentation.
Federated Multi-Party Demo ⭐	New 4-party (Contoso, Fabrikam, Wingtip Toys, Woodgrove Bank) federated analytics demo. Each partner decrypts its own data inside its own AMD SEV-SNP TEE and returns only aggregates — no raw PII ever crosses the trust boundary. Includes a 3-minute DEMO-SCRIPT.md.
CVM samples now support Intel TDX	BuildRandomCVM.ps1 auto-detects AMD SEV-SNP (DCa*/ECa*) vs Intel TDX (DCe*/ECe*, e.g. Standard_DC2es_v6) from the chosen VM SKU and runs the matching attestation config. It also now supports an optional -GPU mode for NVIDIA H100 confidential GPU VMs (Standard_NCC40ads_H100_v5) with NVIDIA driver install + GPU CC-mode attestation. The script now also enables outbound internet on the private VM subnet via NAT Gateway by default, with -NoInternetAccess available for fully isolated deployments. The June 2026 validation matrix now includes all four combinations: AMD v6 Windows, AMD v6 Linux, TDX v6 Windows, and TDX v6 Linux. See the Intel TDX examples in the VM samples README.
Validation workflow update 🆕	Local pre-push performs validation only (no PR commenting). Use ./scripts/post-validation-comment.ps1 to run the 4-way CVM matrix and auto-post results as a comment on the active PR (use -NoPostToPr to skip posting). Commit-message annotation is removed. GitHub Actions is temporarily running secret scan + syntax/parameter validation only until service principal secrets are available. See Validation Automation.
Updated in-VM attestation tooling	The CVM build script now runs the latest pre-built attest binary from Azure/cvm-attestation-tools inside the VM (Linux + Windows), then decodes the returned MAA JWT (header, payload and key claims like x-ms-attestation-type and x-ms-compliance-status) using jq on Linux and built-in ConvertFrom-Json on Windows. Linux extraction now supports unzip, python3, or bsdtar fallback paths to avoid image-specific package gaps. When -NoInternetAccess is used, this attestation step is skipped because the VM cannot reach GitHub to download the tooling. The legacy WindowsAttest.ps1 is kept for reference but is no longer recommended.
Repo redirect	https://aka.ms/accsamples now points to this repo. The legacy confidential-container-samples repo remains read-only / archived for reference.

Previously (May 2026)

Addition	Description
Citizen Registry (Sovereign Example)	End-to-end data-sovereignty demo: Confidential ACI → Private VNet → App Gateway → SQL Server on CVM. Features IPv6-only CVMs, ephemeral credentials, and API-based data seeding.
Finance + OpenAI Multi-Party Demo	3-company financial analytics with Azure OpenAI (GPT-4o-mini) chat integration. AI assistant answers questions about decrypted partner transaction data inside the TEE.
ACI + PostgreSQL Demo	Confidential ACI with DCa/ECa AMD PostgreSQL Flexible Server, 5,000 financial transactions, and 9 documented threat scenarios.
CVM with Azure Backup	Windows Confidential VM with Recovery Services Vault backup, Customer Managed Keys, and 4-hourly backup policy.
Deploy script hardening	All multi-party deploy scripts now use az rest with preview API (2025-01-31-preview) for managed identity creation, working around Azure subscription policies requiring regional isolation scope.
Pre-commit secret scanning	Repository-wide pre-commit hook and GitHub Actions workflow to block credentials, SAS tokens, and sensitive parameter files from being committed.

Prerequisites

Requirements vary by sample; follow the selected guide rather than installing every tool below. The Container Apps quickstart uses PowerShell and Az modules without Docker, Python or confcom. The Functions walkthrough adds Azure CLI and role-assignment permissions; local development uses Node.js 24 and Azurite, and remote ACR builds avoid a local Docker requirement.

• Azure subscription
• Azure CLI (v2.60+) with confcom extension
• Azure PowerShell (Az module 12.0+)
• Docker Desktop (for confidential container policy generation)
• Python 3.11+ (for local development/testing)

ACI policy tooling setup

Only follow this setup if your selected sample requires the Azure CLI confcom extension for confidential container policy generation. It is not a prerequisite for the Container Apps or Service Bus examples.

# Install required Azure CLI extension
az extension add --name confcom --upgrade

# Verify installation
az confcom --version

Sample Categories

This repository is organized by Azure service type and deployment method:

Azure Container Apps Samples

• Confidential hello world - Deploy a public quickstart container on a dedicated DC4 confidential workload profile in UAE North.
• Functions on confidential Container Apps - End-to-end native Functions HTTP sample, including local testing, identity/scoped roles, private host-storage networking, fresh Node.js 24 image builds, ARM deployment, verification, portal/API links, and cleanup.

Start with the HTML quickstart, then optionally add Functions to the same confidential environment and dedicated group. Both were tested in UAE North on 9 November 2026; check current regional availability, quota and organizational policy before deployment. Both expose anonymous public endpoints and retain billable resources until explicitly cleaned up. Functions additionally verifies private host-storage connectivity; HTTP 200 alone is not proof of host health. These are configuration/functional checks, not independent hardware attestation. No Azure App Service deployment is included.

For explicit evidence, use the confidential-compute validation steps for each app. They show the app-to-environment-to-DC4 binding, check revision running/health states, provide portal cross-checks, and distinguish Azure-reported configuration from independent cryptographic attestation.

ACI Samples

Azure Container Instances with AMD SEV-SNP confidential computing:

• BuildRandomACI.ps1 - Create confidential ACI with hello-world container
• Visual Attestation Demo - Interactive web demo with remote attestation via Microsoft Azure Attestation (MAA) using the SKR sidecar
• Visual Attestation Demo v2 🆕 - Simplified single-container port that calls MAA directly (no SKR sidecar) via the upstream get-snp-report tool; -Compare mode deploys Confidential + Standard SKUs side-by-side to demonstrate falsifiability
• App + PostgreSQL Finance Demo 🆕 - Confidential ACI with DCa/ECa AMD PostgreSQL, 5,000 financial transactions, Application Gateway, and 9 documented threat scenarios
  • Side-by-side comparison mode (Confidential vs Standard SKU)
  • Real-time encryption with SKR-released keys
  • Live diagnostics and TEE hardware detection
• Automotive Machine Vision 🆕 - Confidential ACI app with attestation-gated .mp4 upload, HTTPS transport, CCE policy enforcement, and in-container redaction plus rounded overlays for cars, trucks, pedestrians, and street signs
• App + PostgreSQL Demo - Basic confidential container app with hardware-enforced AMD SEV-SNP security and container policy, connected to a DCa/ECa AMD PostgreSQL Flexible Server with confidential compute protections
  • Single-container Flask dashboard with 5,000 financial transactions
  • Application Gateway (L7) → Private VNet → Confidential ACI → PostgreSQL (DCa/ECa AMD)
  • Remote attestation (MAA) with detailed claim explanations and Secure Key Release (SKR)
  • 9 documented threat scenarios with specific mitigations

Multi-Party Samples ⭐ FEATURED

Secure multi-party computation demonstrations with Azure Confidential Containers and Confidential VMs.

Federated Multi-Party Demo ⭐ NEW (June 2026)

4 parties — Contoso, Fabrikam, Wingtip Toys, Woodgrove Bank — each running the same image with their own data, identity, and Key Vault. Woodgrove orchestrates federated analytics where every partner decrypts only its own data inside its own TEE and returns only counts, averages, and percentages. Zero PII crosses the trust boundary. Includes a 3-minute live DEMO-SCRIPT.md, live RSA-OAEP encryption panel, cross-company key-access denial, operator-lockout demo, and a combined demographics dashboard with country/city/generation/blood-type aggregates and a salary world map.

Advanced App - Full-Featured Demo

Comprehensive 3-container demonstration with partner analytics:

• Contoso Corporation - Corporate data provider with encrypted employee records (🏢)
• Fabrikam Fashion - Online retailer with encrypted customer records (👗)
• Woodgrove Bank - Trusted analytics partner with cross-company key access (🏦)

Deployment Modes:

• Direct ACI (default) — Simple single-command deployment to Azure Container Instances
• AKS Virtual Nodes (-AKS flag) — Kubernetes-managed deployment using virtual nodes, where pods run as confidential ACI container groups with full AMD SEV-SNP attestation. This is a more complex setup involving VNet creation, NAT gateway, AKS cluster with Azure CNI, VN2 Helm chart, managed identity plumbing in the MC_ resource group, and an nginx reverse proxy for external access. See the AKS documentation for architecture details.

Key Features:

• 🔐 Hardware-based isolation - AMD SEV-SNP TEE protects data in memory
• 🛡️ Remote attestation - Cryptographic proof of TEE environment via MAA
• 🔑 Secure Key Release (SKR) - HSM keys only released to attested containers
• 🏦 Partner Analytics - Woodgrove Bank analyzes encrypted partner data inside TEE
• 📊 Real-time Progress - SSE streaming with progress bars and time estimates
• 🌍 Demographics Analysis - Top countries, cities, generations by company, salary world map
• 🔓 TEE-only decryption - Data decrypted only inside hardware-protected memory

Encrypted Data Flow: Data remains encrypted in storage and transit; decryption only occurs inside the TEE.

Demo App - Basic Demo

Simpler 2-container demonstration (Contoso, Fabrikam Fashion) without partner analytics.

Finance + OpenAI Demo - AI-Powered Analytics 🆕

3-company financial transaction analytics with Azure OpenAI integration:

• 5,000+ synthetic financial transactions across Contoso & Fabrikam
• Azure OpenAI chat (GPT-4o-mini) answers questions about decrypted data inside the TEE
• Real-time streaming with progress bars, KPI cards, and interactive Chart.js visualizations
• Spending by category, merchant, age group, and country with loan payment analysis

VM Samples

Confidential Virtual Machine (CVM) deployment scripts:

• BuildRandomCVM.ps1 🆕 Updated September 2026 — Deploy CVMs with Confidential OS disk encryption bound to a Customer Managed Key (CMK) and automated in-VM attestation. The OS disk and VM Guest State (vTPM + Secure Boot) are encrypted with an HSM-backed RSA-3072 key in your Key Vault Premium; the key is only released after Microsoft Azure Attestation (MAA) verifies the VM is a genuine SEV-SNP / TDX CVM, so even the Azure host fabric cannot read the disk. See What is Confidential OS disk encryption with CMK? and https://aka.ms/accdocs.
  • AMD SEV-SNP (DCa* / ECa*, default Standard_DC2as_v6) and Intel TDX (DCe* / ECe*, e.g. Standard_DC2es_v6) — auto-detected from the chosen VM SKU, with the matching attestation config selected automatically
  • NVIDIA H100 -GPU mode (Standard_NCC40ads_H100_v5) — runs checksum-pinned Azure CGPU onboarding V4.3.3, verifies CC status: ON and CC Environment: PRODUCTION, and requires successful GPU and AMD SEV-SNP CPU attestations
  • Windows Server 2022 Datacenter, Windows Server 2019, Windows 11 Enterprise 24H2, Ubuntu 24.04 LTS, RHEL 9.5 — all confidential-VM images
  • New attestation flow — runs the latest pre-built attest binary from Azure/cvm-attestation-tools inside the freshly deployed VM (Linux + Windows) and decodes the returned MAA JWT (header, payload, key claims like x-ms-attestation-type, x-ms-compliance-status, secure-boot, tpm-enabled) using jq on Linux / built-in ConvertFrom-Json on Windows
  • Pre-flight checks before any resources are created: rejects Intel SGX SKUs (different isolation model), validates the chosen SKU is offered in the target region, and confirms there is enough vCPU quota in the VM family
  • Bastion-optional (-DisableBastion), internet-optional (-NoInternetAccess), and smoketest mode (-smoketest) for CI / cost-controlled validation
• BuildRandomSQLCVM.ps1 - SQL Server 2022 on Confidential VM

AKS Samples

Azure Kubernetes Service with AMD SEV-SNP confidential computing:

• Confidential H100 GPU worker - Guide-only deployment on the latest offered AKS node image, strict GPU attestation before and after a TensorFlow GPU workload, and automatic compute shutdown. See the sample for quota, support boundaries, and resource deletion.
• BuildRandomAKS.ps1 - AKS cluster with Customer Managed Keys and confidential node pools
• AKS Virtual Nodes on Confidential AKS - End-to-end sample that deploys AKS with virtual nodes backed by ACI, validates hello-world scheduling on the virtual node, and links to a confidential ACI follow-on manifest.

Attestation Samples

Microsoft Azure Attestation (MAA) provider management:

• createPrivateMAA.ps1 - Create private Azure Attestation provider for custom attestation policies

Service Bus Examples

Deploy a confidential-computing-enabled Azure Service Bus Premium namespace, send three sample JSON messages, and verify them on read-back using passwordless Entra authentication. Tries Korea Central first, then UAE North on regional availability failures.

Utility Snippets

Reusable PowerShell snippets for common confidential computing tasks:

• snippet-createDES.ps1 - Create Disk Encryption Set for Confidential VMs
• snippet-remoteCallAttest.ps1 - Remote attestation call examples

Sovereign Examples 🆕

Confidential VM deployments with data-sovereignty and compliance focus:

• Citizen Registry - Full-stack sovereign data demo: Confidential ACI container with SQL Server on a Confidential VM, connected through a private VNet with Application Gateway. Features remote attestation, Secure Key Release, ephemeral credentials, and API-based citizen record seeding.
• CVM with Azure Backup - Windows CVM with Azure Backup (Recovery Services Vault), Customer Managed Keys, and confidential disk encryption

SKR Examples 🆕

Standalone Secure Key Release demonstration:

• Deploy-SKRExample.ps1 - End-to-end CVM deployment with AMD SEV-SNP attestation and AKV key release
  • Deploys a Confidential VM, SSHs in, performs vTPM attestation via MAA, and releases an HSM key
  • Auto-cleans up all resources after displaying the released key material
  • NSG locks SSH access to deployer's IP; ephemeral SSH key pair (no password)

Container Samples (Intel SGX)

Enclave-aware container samples for AKS with Intel SGX:

• HelloWorld - Simple enclave creation and function calls
• Attested-TLS - Secure communication channel between enclaves

🤖 AI-Assisted Development Note

Many of the samples in this repository — in particular the multi-party, sov-examples, and finance + OpenAI demos — were authored with significant assistance from AI coding tools, primarily GitHub Copilot running inside Visual Studio Code. This demonstrates the capabilities of modern AI-assisted development for:

• Complex infrastructure-as-code (ARM templates, Bicep, PowerShell, Terraform)
• Cryptographic implementations (RSA-OAEP, AES-256-GCM, SKR flows)
• Web application development (Flask, HTML/CSS/JavaScript)
• Security-focused architecture and threat modeling
• Documentation and diagram generation

While these samples are functional and demonstrate real Azure Confidential Computing capabilities, they should be reviewed by qualified security professionals before use in production scenarios.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

License

This project is licensed under the MIT License - see the LICENSE.md file for details.

By using this code, you acknowledge that:

• You have read and understood the disclaimer above
• You accept full responsibility for any use of this code
• You will conduct appropriate security reviews before any production deployment