← LeaderboardThe Skill Leaderboard

azure-confidential-computing

Expert knowledge for Azure Confidential Computing development including best practices, decision making, architecture & design patterns, security, configuration, integrations & coding patterns, and deployment. Use when using SGX enclaves, confidential VMs/GPUs, AKS confidential containers, Fortanix CCM, or secure key release, and other Azure Confidential Computing related development tasks. Not for Azure Enclave (use azure-enclave), Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payment Hsm (use azure-payment-hsm).

Published by MicrosoftDocs ↗MicrosoftDocs/Agent-Skills

Try your first task

A source-grounded starter task has not been verified for this skill yet.

SKILL.md

name: azure-confidential-computingdescription: Expert knowledge for Azure Confidential Computing development including best practices, decision making, architecture & design patterns, security, configuration, integrations & coding patterns, and deployment. Use when using SGX enclaves, confidential VMs/GPUs, AKS confidential containers, Fortanix CCM, or secure key release, and other Azure Confidential Computing related development tasks. Not for Azure Enclave (use azure-enclave), Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payment Hsm (use azure-payment-hsm).compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.metadata:   generated_at: "2026-11-01"  generator: "docs2skills/1.0.0"

Azure Confidential Computing Skill

This skill provides expert guidance for Azure Confidential Computing. Covers best practices, decision making, architecture & design patterns, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Best Practices	L35-L40	Guidance on building, debugging, and packaging SGX enclaves with Azure tools, and creating enclave-aware containerized workloads on AKS for confidential computing.
Decision Making	L41-L56	Guidance on choosing and planning Azure confidential computing solutions: containers, AKS, SGX enclaves, confidential VMs/GPUs, and AMD vs Intel options for secure deployment architectures.
Architecture & Design Patterns	L57-L62	Designing SGX enclave apps on Azure VMs and understanding how confidential VM guest attestation works, including trust, measurement, and verification flows.
Security	L63-L77	Security and attestation for confidential VMs, AKS confidential containers, SGX enclaves, vTPM usage, hardening Linux images, and managing secrets/keys in Azure Confidential Computing.
Configuration	L78-L89	Configuring and deploying Azure confidential VMs and AKS (SGX, containers), managing CMKs and secure key release, and tuning VM metadata/blob settings for security and compliance.
Integrations & Coding Patterns	L90-L99	Patterns and code samples for building and attesting confidential workloads (SGX, SEV-SNP, dm-verity/IMA), using Fortanix, and implementing secure key release with VMs and containers.
Deployment	L100-L107	Deploying and migrating Azure confidential VMs/VMSS, creating custom hardened images, setting up Intel SGX VMs, and deploying Fortanix CCM as a managed app.

Best Practices

Topic	URL
Use Azure tools for SGX enclave development	https://learn.microsoft.com/en-us/azure/confidential-computing/application-development
Develop enclave-aware containers on AKS	https://learn.microsoft.com/en-us/azure/confidential-computing/enclave-aware-containers

Decision Making

Topic	URL
Select Azure confidential container offerings	https://learn.microsoft.com/en-us/azure/confidential-computing/choose-confidential-containers-offerings
Select Azure confidential deployment model	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-deployment-models
Choose Azure confidential solution implementation approach	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-solutions
Plan and adopt confidential containers on Azure	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
Plan and adopt confidential containers on Azure	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers
Use confidential containers with Intel SGX enclaves	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-enclaves
Choose and use AKS confidential VM node pools	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-node-pool-aks
Plan Intel SGX enclave nodes on AKS	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-overview
Understand and configure Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview
Use Azure confidential GPUs for secure compute offload	https://learn.microsoft.com/en-us/azure/confidential-computing/gpu-options
Select appropriate Azure confidential computing product	https://learn.microsoft.com/en-us/azure/confidential-computing/overview-azure-products
Compare Azure confidential VM AMD and Intel options	https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-options

Architecture & Design Patterns

Topic	URL
Design SGX enclave-based workloads on Azure VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-computing-enclaves
Understand Azure confidential VM guest attestation design	https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-virtual-machines-design

Security

Topic	URL
Implement attestation for Azure SGX enclaves	https://learn.microsoft.com/en-us/azure/confidential-computing/attestation
Use attestation types for Azure confidential workloads	https://learn.microsoft.com/en-us/azure/confidential-computing/attestation-solutions
Security model for AKS Confidential Containers	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-aks-security-policy
Understand security and behavior of Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-faq
Configure guest attestation for Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-confidential-vms
Secure confidential VMs with Defender for Cloud and guest attestation	https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-defender-for-cloud
Harden Linux images by removing Azure guest agent	https://learn.microsoft.com/en-us/azure/confidential-computing/harden-a-linux-image-to-remove-azure-guest-agent
Harden Linux images by removing sudo users for confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/harden-the-linux-image-to-remove-sudo-users
Leverage vTPM features in Linux confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-leverage-virtual-tpms-in-azure-confidential-vms
Manage secrets and keys in Azure confidential computing	https://learn.microsoft.com/en-us/azure/confidential-computing/secret-key-management
Use virtual TPMs in Azure confidential VMs securely	https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-tpms-in-azure-confidential-vm

Configuration

Topic	URL
Configure Confidential Containers on AKS (preview)	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview
Configure AKS plugin for Intel SGX confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-nodes-aks-addon
Disable VMMD blob creation for Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/disable-confidential-vm-metadata-blob
Rotate customer-managed keys for Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/key-rotation-offline
Deploy Azure confidential VMs with ARM templates	https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-arm
Provision Azure confidential VMs using Azure CLI	https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-azure-cli
Author Secure Key Release policies for Azure TEEs	https://learn.microsoft.com/en-us/azure/confidential-computing/skr-policy-examples
Configure Virtual Machine Metablob Disk for confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-metablob-disk

Integrations & Coding Patterns

Topic	URL
Build SGX application enclaves with open-source tools	https://learn.microsoft.com/en-us/azure/confidential-computing/enclave-development-oss
Use guest attestation sample app with confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/guest-attestation-example
Attest Linux workloads with dm-verity and IMA on Azure confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-attest-linux-workload
Run apps with Fortanix CCM and Node Agent	https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager-node-agent
Implement SKR with confidential containers on Azure Container Instances	https://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-containers-azure-container-instance
Implement SKR from Key Vault to AMD SEV-SNP confidential VMs	https://learn.microsoft.com/en-us/azure/confidential-computing/skr-flow-confidential-vm-sev-snp

Deployment

Topic	URL
Create custom images for Azure confidential VMs with CLI	https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-create-custom-image-confidential-vm
Deploy Fortanix CCM as Azure managed app	https://learn.microsoft.com/en-us/azure/confidential-computing/how-to-fortanix-confidential-computing-manager
Migrate nested Azure confidential VMs across regions	https://learn.microsoft.com/en-us/azure/confidential-computing/migrate-nested-confidential-vms
Deploy Intel SGX virtual machines on Azure	https://learn.microsoft.com/en-us/azure/confidential-computing/virtual-machine-solutions-sgx
Deploy VM scale sets with hardened Linux images	https://learn.microsoft.com/en-us/azure/confidential-computing/vmss-deployment-from-hardened-linux-image