Two Azure Marketplace components, one Python SDK. Encrypt every Azure ML pipeline run and online endpoint without changing your model.
Enigmata Cipher Secure Mode for Azure ML ships as two Azure Marketplace components (a pipeline Encryption Component and an Online Endpoint Encryption Deployment) plus a free Python SDK that binds an encryption context to a customer-managed key in Azure Key Vault. Everything runs inside the customer’s Azure Machine Learning workspace, behind a Managed VNet and a Private Endpoint. Encrypted columns preserve equality, order, and cosine similarity, so AutoML, MLflow runs on Azure ML, and Model Registry deployments keep their accuracy. Your plaintext never needs to leave your premises. Run Enigmata Cipher’s signed confidential-VM image on-prem to encrypt your data, and upload only ciphertext to Blob Storage. Azure sees ciphertext, never plaintext.
Accuracy parity in the published vector ML benchmark (binary classification on Gaussian-clustered embeddings).
Outbound calls from the encryption component or endpoint deployment beyond the AML control plane.
Vector payload compression at the default token length (a 1536-dim f32 embedding becomes a 256-bit token, 32 bytes on the wire).
First-class component + endpoint deployment artifacts; works with `az ml` CLI v2 too.
What this unlocks for you
Encrypted training inside AML compute
Encrypt training data on the way out of Blob Storage so the AML compute cluster sees only protected representations during AutoML, MLflow-on-Azure-ML, or custom training jobs.
Encrypted online endpoints, no model rewrites
Wrap your existing online endpoint and the front-end deployment encrypts requests before your model sees them. Same code path for training and inference.
Customer-owned keys, Key Vault-native
Your Azure Key Vault holds the wrapping key; we never see key material; the seed lives only inside your AML compute. No parallel key-management plane to operate.
Sovereign-cloud parity
Works identically in Azure Government, Azure China (21Vianet), and the Microsoft sovereign clouds: same components, same Key Vault contract, no per-cloud-region forks.
Three pillars, preserved
Text: equality preserved
Joins, group-by, and exact-match lookups work directly on encrypted columns in Azure Synapse, Microsoft Fabric, or any downstream Power BI query against the encrypted feature store.
Numeric: order preserved
Sorts, range filters, percentiles, and tree-model splits work on encrypted numbers; AutoML’s tree algorithms (LightGBM, XGBoost) train on encrypted features without modification.
Vector: cosine similarity preserved
Azure ML Online Endpoints that front Azure AI Search vector indexes rank encrypted embeddings the same way they’d rank plaintext.
How customers install it
Subscribe to Enigmata Cipher Encryption Component and Enigmata Cipher Online Endpoint Deployment in your Azure tenant, in the region your AML workspace runs in.
Install the Enigmata Cipher SDK in your AML compute instance or local development environment.
Use the Enigmata Cipher SDK to bind a customer-managed Key Vault key to your column schema. On-prem: the signed Enigmata Cipher confidential-VM image attests to Key Vault, derives the seed inside your facility, and uploads the wrapped manifest to your Blob Storage account so AML can read it. In-Azure alternative: the SDK calls Key Vault from your AML compute, HKDF-derives a seed, and writes the same wrapped manifest to Blob Storage with customer-managed-key encryption.
On-prem: encrypt your source data with the confidential-VM image and upload ciphertext directly to Blob Storage. AML pipelines and online endpoints read ciphertext from there. In-Azure alternative: reference the Marketplace-installed Enigmata Cipher command component from your AML pipeline registry, or attach the online endpoint deployment in your endpoint config. No other changes.
Where it fits
Best fit: Azure-first ML teams, Microsoft-shop enterprises, and any regulated or sovereign-cloud deployment where Azure Key Vault must hold the root of trust and Managed VNet boundaries are non-negotiable.
Financial Services
Risk and fraud models on PII-laden customer records, encrypted before they enter the AML compute cluster; Key Vault custody satisfies Article 5 / Article 32 GDPR processing requirements out of the box.
Healthcare
Clinical embeddings feed AutoML jobs without leaving the protected representation; ePHI never appears in plaintext in workspace logs or MLflow artifacts.
Public Sector
Constituent-data models running under Azure Government or sovereign-cloud data-residency mandates, encrypted inside the customer’s region with Key Vault rooted in the customer’s HSM tenant.
Insurance
Underwriting and claims models on encrypted customer dossiers; inference encrypted before scoring; integrates with Microsoft Purview for end-to-end policy-data lineage.
How it compares
The honest framing of every other option.
| Approach | What you get |
|---|---|
| Microsoft Purview classification + masking | Protects data at rest in Synapse / Fabric / Blob with sensitivity labels and masking policies; doesn’t protect data inside AML compute or during model inference. |
| Azure Confidential Computing (TEEs / SGX VMs) | Strong attestation but locks you to specific Azure VM SKUs (DCsv3 / DCadsv5 etc.) and you still have to trust the runtime end-to-end. |
| Synthetic data via Azure ML’s data-generation patterns | Models drift from production behavior; inference still needs real values and the synthetic pipeline becomes its own model-risk surface. |
| Doing nothing | The AML compute cluster sees plaintext throughout training and inference; the data path to model artifacts, MLflow logs, and Application Insights traces is the breach surface. |
| Enigmata Cipher | An Azure-native AML component pair, Marketplace-installed, Key-Vault-keyed; no compute SKU lock-in, no parallel key plane, keeps your model. |
Key capabilities
- Drop-in for any existing Azure ML pipeline: runs as a `command` component you wire between data prep and training.
- Customer-managed key in Azure Key Vault; the seed is HKDF-derived inside your AML workspace and never extracted.
- Native Azure Marketplace components: install once into your workspace, reuse across every pipeline and online endpoint.
- Three pillars preserved: equality, order, cosine similarity.
- Managed Virtual Network + Private Endpoint compatible; zero outbound calls from the encryption component or endpoint deployment.
- Microsoft Purview integration: encrypted columns carry their sensitivity label and lineage through the Purview catalog.
Technical detail
What the Azure ML component and endpoint deployment actually do.
Where the encryption step physically runs is the customer’s choice: on-prem, the signed Enigmata Cipher confidential-VM image reads plaintext inside your facility and uploads ciphertext to your Blob Storage account. Plaintext never enters Azure, and AML pipelines and online endpoints read ciphertext from there. As an in-Azure alternative, the Encryption Component is an Azure ML command component that reads a tabular dataset from your Blob Storage input port, applies the same column-level schema, and writes an encrypted copy back to your output port; both paths produce identical ciphertext. Encrypted columns become string columns; vector columns become JSON-encoded vector tokens with the underlying bits exposed for ML feature extraction; passthrough columns keep their original Arrow type. The Online Endpoint Deployment is a custom Azure ML deployment that runs ahead of your scoring container in a multi-deployment endpoint. Both the on-prem image and the in-Azure components consume the same seed and schema files that the Enigmata Cipher SDK writes to your Blob Storage; the SDK is the only thing that ever calls Azure Key Vault.
- Encryption Component: CSV + Parquet input/output, batch-mode execution, deterministic across runs under the same seed; published to the customer’s Azure ML registry via the Marketplace subscription.
- Online Endpoint Deployment: an HTTP server matching the AML deployment contract (`/health` + `/score`), Marketplace meter wired to per-request billing.
- The shared Enigmata Cipher SDK drives column-by-column encryption from the same schema definition the AWS SageMaker integration uses; context manifests round-trip across both clouds for hybrid deployments.
- Encrypted vector cells round-trip as self-describing JSON-encoded tokens, identical to the SageMaker output shape.
- The Enigmata Cipher SDK exposes both pipeline-time and endpoint-time paths from the same key context.
What it needs
An Azure subscription with Azure Machine Learning, Azure Key Vault, and Azure Blob Storage. The component runs inside your AML compute, behind your workspace’s Managed Virtual Network and Private Endpoint configuration.
Who holds the key
Run encryption on-prem and your KMS releases the seed only to an attested, unmodified Enigmata Cipher confidential-VM image. Plaintext never leaves your facility and the seed never reaches Azure. Run encryption in Azure as the alternative and the customer’s Key Vault key never leaves Azure Key Vault: Enigmata Cipher’s deterministic seed is HKDF-derived from a one-shot wrapKey/unwrapKey round trip with your Key Vault key, then AEAD-wrapped and stored in your Blob Storage account with customer-managed-key encryption.
How it’s billed
Azure Marketplace billing. Encryption Component: hourly per Azure ML compute hour with a 14-day free trial. Online Endpoint Deployment: per-request, metered through the Marketplace meter to your Azure subscription. AML compute, Key Vault, and Blob Storage charges remain on the customer’s Azure bill.
The offer
Prove it in 60 days.
Prove it in 60 days. Pick the Azure ML pipeline you’ve stalled because Key Vault custody or Managed VNet requirements rule out plaintext data in the compute layer. We’ll wire Enigmata Cipher between your data prep and your model, run a parity benchmark against your baseline, and ship the CISO + Microsoft Purview dossier needed to clear Azure procurement.
- Encryption-parity benchmarkAML training run results comparing plaintext baseline vs. encrypted baseline on the customer’s target metric, captured in MLflow on Azure ML.
- Key Vault custody attestationDiagram + Azure RBAC walk-through proving the Key Vault key never leaves Azure Key Vault and only the AML workspace service principal can wrap/unwrap.
- Managed VNet + Private Endpoint evidenceTopology screenshots and AML diagnostic logs proving zero data egress through the Managed VNet boundary.
- CISO + Microsoft Purview dossierVendor-handling delta, data-flow diagram, Purview classification labels for encrypted columns, and an incident-response playbook tailored to the customer’s Azure tenant.