Managed HSM support for Document Intelligence

Hello @CHUNSIK KIM

Thank you for reaching out to Microsoft Q&A.

Based on the information provided, you are attempting to configure Customer-Managed Keys (CMK) for Azure Document Intelligence using an Azure Managed HSM, but the portal fails with the following error:

"The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link..."

From the screenshot and your description, we understand that:

• The Managed HSM is configured to allow all network access.
• No private endpoint is configured on the Managed HSM.
• The Managed HSM appears as a selectable option in the Azure portal under the Document Intelligence encryption settings.
• The failure occurs when the portal attempts to enumerate keys from the Managed HSM.

Supportability of Managed HSM with Azure Document Intelligence

Based on the currently published Microsoft documentation, we cannot conclusively confirm that Azure Document Intelligence supports Customer-Managed Keys backed by Azure Managed HSM.

The Microsoft documentation that tracks Customer-Managed Key support across Azure services:

https://learn.microsoft.com/azure/security/fundamentals/encryption-customer-managed-keys-support

does not currently list Azure Document Intelligence as a service supporting Managed HSM-backed encryption.

Additionally, the Document Intelligence documentation currently available focuses on service capabilities, models, and features, but does not explicitly document support for Azure Managed HSM as a key store for CMK scenarios.

Because of this, the presence of the Managed HSM option in the portal should not be interpreted as confirmation that the scenario is fully supported. In some cases, Azure services share a common encryption configuration experience in the portal, and certain options may appear even when support is limited or not yet fully implemented for a specific service.

About the "Connection to data plane failed" error

The error message itself indicates that the portal is unable to communicate successfully with the Managed HSM data plane.

The portal guidance specifically references troubleshooting steps that are commonly associated with:

Private Endpoint configurations

Network access restrictions

Data-plane connectivity issues

Authorization and permission validation

However, since you have already confirmed that:

Private Endpoints are not configured

The Managed HSM is open to all networks

the issue may be related to one of the following:

• Managed HSM data-plane permissions
• Managed HSM activation status
• Azure portal validation logic
• A current product limitation regarding Document Intelligence and Managed HSM integration
• A potential portal-side issue

Recommended troubleshooting

Since the currently available documentation does not explicitly confirm Managed HSM support for Document Intelligence, we recommend the following:

Follow the troubleshooting guidance referenced in the portal error message.

Verify that the Managed HSM is fully activated and operational.

Managed HSM requires activation before its data plane becomes fully functional. Even when the resource is provisioned successfully, key enumeration and management operations can fail if activation has not completed successfully.

Validate that the Managed HSM data plane is accessible independently.

For example, confirm that:

• Keys can be listed through Azure CLI, PowerShell, or REST APIs.
• The identity performing the operation has the required Managed HSM roles and permissions.

Test the same encryption workflow using a standard Azure Key Vault key.

If Azure Key Vault succeeds while Managed HSM consistently fails, that would suggest either:

• A supportability gap, or
• A service-specific limitation with Managed HSM integration.

To help determine whether this is a configuration issue or a product limitation, could you please provide:

• Azure region of the Document Intelligence resource
• Document Intelligence SKU/tier
• Confirmation whether Customer-Managed Keys work successfully with a standard Azure Key Vault
• Any Activity Log entries or deployment errors associated with the encryption configuration attempt

I Hope this helps. Do let me know if you have any further queries.

Thank you!

Hi @CHUNSIK KIM

Did you get any chance to review the above response. Do let me know if you have any further queries.

Thank you!