Azure Database for PostgreSQL - Flexible Server now supports cross-tenant customer-managed keys (CMK), in public preview, allowing you to encrypt your data at rest using an Azure Key Vault key that resides in a separate Microsoft Entra tenant from the database service.
This capability is designed for software as a service (SaaS) providers and enterprises that need to maintain strict separation of duties and ownership of encryption keys, enabling their customers to retain full control over key lifecycle management while PostgreSQL runs in a service provider's tenant.
With cross-tenant CMK:
Your PostgreSQL data is encrypted using a key you own and manage. The database service never has access to your key material. You can rotate or revoke keys at any time without downtime.
Authentication between PostgreSQL Flexible Server and the customer-owned key vault is handled using federated identity with Microsoft Entra ID access across tenants.