update

Author: msmbaldwin

articles/security/fundamentals/key-management-choose.md

@@ -80,7 +80,7 @@ Here is a list of the key management solutions we commonly see being utilized ba
 
 **Azure Managed HSM**: A FIPS 140-2 Level 3 validated, PCI compliant, single-tenant HSM offering that gives customers full control of an HSM for encryption-at-rest, Keyless SSL/TLS offload, and custom applications. Azure Managed HSM is the only key management solution offering confidential keys. Customers receive a pool of three HSM partitions—together acting as one logical, highly available HSM appliance—fronted by a service that exposes crypto functionality through the Key Vault API. Microsoft handles the provisioning, patching, maintenance, and hardware failover of the HSMs, but doesn't have access to the keys themselves, because the service executes within Azure's Confidential Compute Infrastructure. Azure Managed HSM is integrated with the Azure SQL, Azure Storage, and Azure Information Protection PaaS services and offers support for Keyless TLS with F5 and Nginx. For more information, see [What is Azure Key Vault Managed HSM?](/azure/key-vault/managed-hsm/overview).
 
-**Azure Cloud HSM**: A FIPS 140-3 Level 3 validated, single-tenant HSM-as-a-service offering that provides customers with dedicated HSM clusters for cryptographic key storage and operations within the Azure environment. Azure Cloud HSM grants customers full administrative control over their HSMs while Microsoft manages patching, maintenance, high availability, and hardware failover. This IaaS solution supports PKCS#11, OpenSSL, JCE/JCA, and CNG/KSP for applications including SSL/TLS offloading, certificate authority private key protection, transparent data encryption (TDE), and code/document signing. Azure Cloud HSM does not integrate with Azure PaaS/SaaS services or support Encryption at Rest scenarios. For more information, see [Azure Cloud HSM Overview](/azure/cloud-hsm/overview).
+**Azure Cloud HSM Preview**: A FIPS 140-3 Level 3 validated, single-tenant HSM-as-a-service offering that provides customers with dedicated HSM clusters for cryptographic key storage and operations within the Azure environment. Azure Cloud HSM grants customers full administrative control over their HSMs while Microsoft manages patching, maintenance, high availability, and hardware failover. This IaaS solution supports PKCS#11, OpenSSL, JCE/JCA, and CNG/KSP for applications including SSL/TLS offloading, certificate authority private key protection, transparent data encryption (TDE), and code/document signing. Azure Cloud HSM does not integrate with Azure PaaS/SaaS services or support Encryption at Rest scenarios. For more information, see [Azure Cloud HSM Overview](/azure/cloud-hsm/overview).
 
 **Azure Dedicated HSM**: A FIPS 140-2 Level 3 validated single-tenant bare metal HSM offering that lets customers lease a general-purpose HSM appliance that resides in Microsoft datacenters. The customer has complete ownership over the HSM device and is responsible for patching and updating the firmware when required. Microsoft has no permissions on the device or access to the key material, and Azure Dedicated HSM is not integrated with any Azure PaaS offerings. Customers can interact with the HSM using the PKCS#11, JCE/JCA, and KSP/CNG APIs. This offering is most useful for legacy lift-and-shift workloads, PKI, SSL Offloading and Keyless TLS (supported integrations include F5, Nginx, Apache, Palo Alto, IBM GW and more), OpenSSL applications, Oracle TDE, and Azure SQL TDE IaaS. For more information, see [What is Azure Dedicated HSM?](/azure/dedicated-hsm/overview).