Creating Symmetric Key from external provider
tl;dr - use CREATE CRYPTOGRAPHIC PROVIDER to create a connection inside SQL Server to your EKM/HSM hardware/software, through a vendor-provided .DLL file designed for that purpose.

You can use Azure Key Vault to protect on-premises data.  There are many steps required to enable your Azure account with Azure Key Vault, which are detailed at setup steps for extensible key management using Azure Key Vault.  

The steps inside SQL Server consist of the following:


Install the SQL Server Connector for Azure Key Vault from the Microsoft download center.
Run the following code to enable EKM providers:

-- Enable advanced options.  
USE master;  
GO  

sp_configure 'show advanced options', 1;  
GO  
RECONFIGURE;  
GO  

-- Enable EKM provider  
sp_configure 'EKM provider enabled', 1;  
GO  
RECONFIGURE;  

Register the EKM module:

CREATE CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov   
FROM FILE = 'C:\Program Files\SQL Server Connector for Microsoft Azure Key Vault\Microsoft.AzureKeyVaultService.EKM.dll';  
GO 

Setup a credential for SQL Server to connect to Azure:

USE master;  
CREATE CREDENTIAL sysadmin_ekm_cred   
    WITH IDENTITY = 'ContosoDevKeyVault', -- for public Azure
    -- WITH IDENTITY = 'ContosoDevKeyVault.vault.usgovcloudapi.net', -- for Azure Government
    -- WITH IDENTITY = 'ContosoDevKeyVault.vault.azure.cn', -- for Azure China
    -- WITH IDENTITY = 'ContosoDevKeyVault.vault.microsoftazure.de', -- for Azure Germany   
    SECRET = 'EF5C8E094D2A4A769998D93440D8115DReplace-With-AAD-Client-Secret'   
FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov;  

-- Add the credential to the SQL Server administrator's domain login   
ALTER LOGIN [&lt;domain&gt;\&lt;login&gt;]  
ADD CREDENTIAL sysadmin_ekm_cred;  

Open the key vault:

CREATE ASYMMETRIC KEY CONTOSO_KEY   
FROM PROVIDER [AzureKeyVault_EKM_Prov]  
WITH PROVIDER_KEY_NAME = 'ContosoRSAKey0',  
CREATION_DISPOSITION = OPEN_EXISTING;  



You can then enable TDE by following the steps listed to use SQL Server with SQL Encryption.