diff --git a/sdk/keyvault/azure-security-keyvault-keys/CMakeLists.txt b/sdk/keyvault/azure-security-keyvault-keys/CMakeLists.txt
index 9c9cfb4c5..13852d0cc 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/CMakeLists.txt
+++ b/sdk/keyvault/azure-security-keyvault-keys/CMakeLists.txt
@@ -41,11 +41,6 @@ set(
     inc/azure/keyvault/keys/cryptography/wrap_result.hpp
     inc/azure/keyvault/keys/cryptography/unwrap_result.hpp
     inc/azure/keyvault/keys/cryptography/verify_result.hpp
-    inc/azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp
-    inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider_factory.hpp
-    inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider.hpp
-    inc/azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp
-    inc/azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp
     inc/azure/keyvault/keys/backup_key_result.hpp
     inc/azure/keyvault/keys/delete_key_operation.hpp
     inc/azure/keyvault/keys/deleted_key.hpp
@@ -83,6 +78,7 @@ set(
     src/cryptography/wrap_result.cpp
     src/cryptography/unwrap_result.cpp
     src/cryptography/verify_result.cpp
+    src/private/cryptography_provider.hpp
     src/private/cryptography_serializers.hpp
     src/private/key_backup.hpp
     src/private/key_constants.hpp
@@ -93,7 +89,11 @@ set(
     src/private/key_wrap_parameters.hpp
     src/private/keyvault_constants.hpp
     src/private/keyvault_protocol.hpp
+    src/private/local_cryptography_provider.hpp
+    src/private/local_cryptography_provider_factory.hpp
     src/private/package_version.hpp
+    src/private/remote_cryptography_client.hpp
+    src/private/rsa_cryptography_provider.hpp
     src/delete_key_operation.cpp
     src/deleted_key.cpp
     src/import_key_options.cpp
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/cryptography/cryptography_client.hpp b/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/cryptography/cryptography_client.hpp
index 3bb29c8a2..4ab1d115d 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/cryptography/cryptography_client.hpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/cryptography/cryptography_client.hpp
@@ -11,18 +11,24 @@
 
 #include "../src/private/keyvault_protocol.hpp"
 
+#include <azure/core/context.hpp>
 #include <azure/core/io/body_stream.hpp>
 
 #include "azure/keyvault/keys/cryptography/cryptography_client_options.hpp"
+#include "azure/keyvault/keys/cryptography/decrypt_parameters.hpp"
+#include "azure/keyvault/keys/cryptography/decrypt_result.hpp"
 #include "azure/keyvault/keys/cryptography/encrypt_parameters.hpp"
 #include "azure/keyvault/keys/cryptography/encrypt_result.hpp"
+#include "azure/keyvault/keys/cryptography/key_wrap_algorithm.hpp"
 #include "azure/keyvault/keys/cryptography/sign_result.hpp"
+#include "azure/keyvault/keys/cryptography/signature_algorithm.hpp"
+#include "azure/keyvault/keys/cryptography/unwrap_result.hpp"
+#include "azure/keyvault/keys/cryptography/verify_result.hpp"
 #include "azure/keyvault/keys/cryptography/wrap_result.hpp"
-#include "azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp"
-#include "azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp"
 
 #include <memory>
 #include <string>
+#include <vector>
 
 namespace Azure {
   namespace Security {
@@ -30,6 +36,11 @@ namespace Azure {
       namespace Keys {
         namespace Cryptography {
 
+  namespace _detail {
+    struct CryptographyProvider;
+    struct RemoteCryptographyClient;
+  } // namespace _detail
+
   /**
    * @brief A client used to perform cryptographic operations with Azure Key Vault keys.
    *
@@ -52,18 +63,6 @@ namespace Azure {
 
     void Initialize(std::string const& operation, Azure::Core::Context const& context);
 
-    /**
-     * @brief Provides a #CryptographyProvider that performs operations in the Key Vault Keys
-     * Server.
-     *
-     * @return A cryptographic client to perform operations on the server.
-     */
-    std::shared_ptr<Azure::Security::KeyVault::Keys::Cryptography::_detail::CryptographyProvider>
-    RemoteClient() const
-    {
-      return m_remoteProvider;
-    }
-
     /**
      * @brief Gets whether this #CryptographyClient runs only local operations.
      *
@@ -89,6 +88,12 @@ namespace Azure {
     {
     }
 
+    /**
+     * @brief Destructs `%CryptographyClient`.
+     *
+     */
+    ~CryptographyClient();
+
     /**
      * @brief Encrypts plaintext.
      *
@@ -122,8 +127,8 @@ namespace Azure {
      * @param key The key to encrypt.
      * @param context A #Azure::Core::Context to cancel the operation.
      * @return The result of the wrap operation. The returned #WrapResult contains the wrapped key
-     * along with all other information needed to unwrap it. This information should be stored with
-     * the wrapped key.
+     * along with all other information needed to unwrap it. This information should be stored
+     * with the wrapped key.
      */
     WrapResult WrapKey(
         KeyWrapAlgorithm algorithm,
@@ -136,8 +141,8 @@ namespace Azure {
      * @param algorithm The #KeyWrapAlgorithm to use.
      * @param encryptedKey The encrypted key.
      * @param context A #Azure::Core::Context to cancel the operation.
-     * @return The result of the unwrap operation. The returned #UnwrapResult contains the key along
-     * with information regarding the algorithm and key used to unwrap it.
+     * @return The result of the unwrap operation. The returned #UnwrapResult contains the key
+     * along with information regarding the algorithm and key used to unwrap it.
      */
     UnwrapResult UnwrapKey(
         KeyWrapAlgorithm algorithm,
@@ -152,8 +157,8 @@ namespace Azure {
      * must be compatable with the specified algorithm.
      * @param context A #Azure::Core::Context to cancel the operation.
      * @return The result of the sign operation. The returned #SignResult contains the signature
-     * along with all other information needed to verify it. This information should be stored with
-     * the signature.
+     * along with all other information needed to verify it. This information should be stored
+     * with the signature.
      */
     SignResult Sign(
         SignatureAlgorithm algorithm,
@@ -167,8 +172,8 @@ namespace Azure {
      * @param data The data to sign.
      * @param context A #Azure::Core::Context to cancel the operation.
      * @return The result of the sign operation. The returned #SignResult contains the signature
-     * along with all other information needed to verify it. This information should be stored with
-     * the signature.
+     * along with all other information needed to verify it. This information should be stored
+     * with the signature.
      */
     SignResult SignData(
         SignatureAlgorithm algorithm,
@@ -182,8 +187,8 @@ namespace Azure {
      * @param data The data to sign.
      * @param context A #Azure::Core::Context to cancel the operation.
      * @return The result of the sign operation. The returned #SignResult contains the signature
-     * along with all other information needed to verify it. This information should be stored with
-     * the signature.
+     * along with all other information needed to verify it. This information should be stored
+     * with the signature.
      */
     SignResult SignData(
         SignatureAlgorithm algorithm,
@@ -193,8 +198,8 @@ namespace Azure {
     /**
      * @brief Verifies the specified signature.
      *
-     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to sign
-     * the digest.
+     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to
+     * sign the digest.
      * @param digest The pre-hashed digest corresponding to the signature. The hash algorithm used
      * to compute the digest must be compatable with the specified algorithm.
      * @param signature The signature to verify.
@@ -211,8 +216,8 @@ namespace Azure {
     /**
      * @brief Verifies the specified signature.
      *
-     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to sign
-     * the data.
+     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to
+     * sign the data.
      * @param data The data corresponding to the signature.
      * @param signature The signature to verify.
      * @param context A #Azure::Core::Context to cancel the operation.
@@ -228,8 +233,8 @@ namespace Azure {
     /**
      * @brief Verifies the specified signature.
      *
-     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to sign
-     * the data.
+     * @param algorithm The #SignatureAlgorithm to use. This must be the same algorithm used to
+     * sign the data.
      * @param data The data corresponding to the signature.
      * @param signature The signature to verify.
      * @param context A #Azure::Core::Context to cancel the operation.
diff --git a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/cryptography_client.cpp b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/cryptography_client.cpp
index 2976a36ca..79e62dd77 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/cryptography_client.cpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/cryptography_client.cpp
@@ -9,9 +9,12 @@
 #include <azure/core/http/policies/policy.hpp>
 
 #include "azure/keyvault/keys/cryptography/cryptography_client.hpp"
-#include "azure/keyvault/keys/internal/cryptography/local_cryptography_provider_factory.hpp"
 #include "azure/keyvault/keys/key_operation.hpp"
 
+#include "../private/cryptography_provider.hpp"
+#include "../private/local_cryptography_provider_factory.hpp"
+#include "../private/remote_cryptography_client.hpp"
+
 #include <memory>
 #include <string>
 #include <vector>
@@ -51,6 +54,8 @@ inline std::vector<uint8_t> CreateDigest(
 }
 } // namespace
 
+CryptographyClient::~CryptographyClient() = default;
+
 void CryptographyClient::Initialize(std::string const&, Azure::Core::Context const& context)
 {
   if (m_provider != nullptr)
diff --git a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/remote_cryptography_client.cpp b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/remote_cryptography_client.cpp
index c5ad461a0..b866bf1a8 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/remote_cryptography_client.cpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/remote_cryptography_client.cpp
@@ -11,7 +11,7 @@
 #include "../private/key_sign_parameters.hpp"
 #include "../private/key_verify_parameters.hpp"
 #include "../private/key_wrap_parameters.hpp"
-#include "azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp"
+#include "../private/remote_cryptography_client.hpp"
 
 #include <memory>
 #include <string>
diff --git a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/rsa_cryptography_provider.cpp b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/rsa_cryptography_provider.cpp
index c33e1a975..932e0bed8 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/rsa_cryptography_provider.cpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/cryptography/rsa_cryptography_provider.cpp
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-#include "azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp"
+#include "../private/rsa_cryptography_provider.hpp"
 
 #include <memory>
 #include <string>
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp b/sdk/keyvault/azure-security-keyvault-keys/src/private/cryptography_provider.hpp
similarity index 100%
rename from sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp
rename to sdk/keyvault/azure-security-keyvault-keys/src/private/cryptography_provider.hpp
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider.hpp b/sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider.hpp
similarity index 94%
rename from sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider.hpp
rename to sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider.hpp
index d056256f2..e2ede91b0 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider.hpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider.hpp
@@ -9,7 +9,8 @@
 
 #pragma once
 
-#include "azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp"
+#include "cryptography_provider.hpp"
+
 #include "azure/keyvault/keys/key_vault_key.hpp"
 
 #include <memory>
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider_factory.hpp b/sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider_factory.hpp
similarity index 89%
rename from sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider_factory.hpp
rename to sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider_factory.hpp
index d07cec220..4dce23d21 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/local_cryptography_provider_factory.hpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/private/local_cryptography_provider_factory.hpp
@@ -9,10 +9,11 @@
 
 #pragma once
 
-#include "azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp"
-#include "azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp"
 #include "azure/keyvault/keys/key_vault_key.hpp"
 
+#include "cryptography_provider.hpp"
+#include "rsa_cryptography_provider.hpp"
+
 #include <memory>
 #include <string>
 
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp b/sdk/keyvault/azure-security-keyvault-keys/src/private/remote_cryptography_client.hpp
similarity index 96%
rename from sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp
rename to sdk/keyvault/azure-security-keyvault-keys/src/private/remote_cryptography_client.hpp
index e2de3527a..7db3cf3a8 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/remote_cryptography_client.hpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/private/remote_cryptography_client.hpp
@@ -12,12 +12,12 @@
 #include <azure/core/response.hpp>
 #include <azure/core/url.hpp>
 
-#include "../src/private/keyvault_protocol.hpp"
+#include "cryptography_provider.hpp"
+#include "keyvault_protocol.hpp"
 
 #include "azure/keyvault/keys/cryptography/cryptography_client_options.hpp"
 #include "azure/keyvault/keys/cryptography/encrypt_parameters.hpp"
 #include "azure/keyvault/keys/cryptography/encrypt_result.hpp"
-#include "azure/keyvault/keys/internal/cryptography/cryptography_provider.hpp"
 #include "azure/keyvault/keys/key_vault_key.hpp"
 
 #include <memory>
diff --git a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp b/sdk/keyvault/azure-security-keyvault-keys/src/private/rsa_cryptography_provider.hpp
similarity index 96%
rename from sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp
rename to sdk/keyvault/azure-security-keyvault-keys/src/private/rsa_cryptography_provider.hpp
index 50662091e..9deaac4d2 100644
--- a/sdk/keyvault/azure-security-keyvault-keys/inc/azure/keyvault/keys/internal/cryptography/rsa_cryptography_provider.hpp
+++ b/sdk/keyvault/azure-security-keyvault-keys/src/private/rsa_cryptography_provider.hpp
@@ -9,7 +9,7 @@
 
 #pragma once
 
-#include "azure/keyvault/keys/internal/cryptography/local_cryptography_provider.hpp"
+#include "local_cryptography_provider.hpp"
 
 #include <memory>
 #include <string>