There are three types of DEPs supported by Customer Key, each policy type uses different cmdlets and provides coverage for a different type of data. You create DEPs using PowerShell cmdlets, and then assign those DEPs to encrypt application data. This hierarchy is used by the service to encrypt data using each of the keys you manage and the availability key that's protected by Microsoft. About data encryption policiesĪ data encryption policy (DEP) defines the encryption hierarchy. You can encrypt your on-premises data using another method, such as BitLocker. Customer Key does not work to protect your on-premises mailboxes and files. Customer Key with hybrid deploymentsĬustomer Key only encrypts data at rest in the cloud. As a result, you exercise control over your organization's keys. With Customer Key, you provide and control the root encryption keys for your Microsoft 365 data at-rest at the application level. Customer Key helps you meet compliance obligations because you control the encryption keys that Microsoft 365 uses to encrypt and decrypt data.Ĭustomer Key enhances the ability of your organization to meet the demands of compliance requirements that specify key arrangements with the cloud service provider. Microsoft 365 then uses these keys to encrypt your data at rest as described in the Online Services Terms (OST). You explicitly authorize Microsoft 365 services to use your encryption keys to provide value added cloud services, such as eDiscovery, anti-malware, anti-spam, search indexing, and so on.Ĭustomer Key is built on service encryption and lets you provide and control encryption keys. Instead, Customer Key helps you meet regulatory or compliance obligations for controlling root keys. Service encryption is not meant to prevent Microsoft personnel from accessing your data. Customer Key provides extra protection against viewing of data by unauthorized systems or personnel, and complements BitLocker disk encryption in Microsoft data centers. For more information, see How Exchange Online secures your email secrets. Your data is always encrypted at rest in the Microsoft 365 service with BitLocker and DKM. How service encryption, BitLocker, and Customer Key work together Learn details about signing up and trial terms. Start now at the Microsoft Purview compliance portal trials hub.

Use the 90-day Purview solutions trial to explore how robust Purview capabilities can help your organization manage data security and compliance needs. If you're not an E5 customer, you can try all the premium features in Microsoft Purview for free.

Microsoft skype customer service