DuoKey

Microsoft 365 Double Key Encryption

DuoKey vs Fortanix

Fortanix's DKE service is based on Microsoft's open-source DKE implementation, with keys held in Fortanix Data Security Manager. DSM can be SaaS or on-premises; the DKE web service itself is deployed and run by the customer on IIS or Azure App Service. DuoKey is a Swiss DKE service operated by DuoKey (ISO 27001, SOC 2, TISAX AL3) or deployed on your own infrastructure, with keys protected by Multi-Party Computation or an HSM backend.

DuoKey

30 / 33

Fortanix

18 / 33

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Decrypt authorized by Entra ID groups
  • Multi-tenant and partner (B2B) tenants
  • Contextual access on key use
  • Access rules changed live
  • Block rules that override allows
  • Tamper-evident audit log
  • Optional mTLS on decrypt calls
  • Built-in end-to-end key test
  • Rotation without a new Purview label
  • Vendor-hosted DKE service (SaaS)
  • Automatic Entra ID app registration
  • No end-of-life runtime or OS
  • FIPS 140 Level 3 key storage
  • Key never assembled in one place

Feature by feature

DuoKey and Fortanix, side by side

CapabilityDuoKeyFortanix

Vendor and support

124/7 support with SLA response times

Round-the-clock support with contractual response times for critical incidents.

Yes24/7 on Platinum, 1-hour critical responseSource
Yes30-min P1 response 24x7 on PremiumSource

2Evaluation or trial licence

A free trial or proof-of-concept licence to test before buying.

YesFree 30-day proof of conceptSource
Yes30-day DSM SaaS trialSource

Microsoft DKE coverage

3Native Microsoft 365 DKE endpoint

Serves the Microsoft GetKey and Decrypt calls used by Word, Excel, PowerPoint and Outlook.

YesSource
YesSource

4Decrypt authorized by Entra ID groups

The key service itself restricts decryption to members of directory groups or roles.

YesEntra ID or Okta group rulesSource
PartialEmail allow-list; empty list allows whole tenantSource

5Multi-tenant and partner (B2B) tenants

One key service shared with several Entra ID tenants or external partners.

YesSource
Not documentedSingle tenant in sample configurationSource

Administration and access control

6Admin SSO and MFA

Administrators sign in through the corporate identity provider with multi-factor authentication.

YesOIDC, TOTP and passkeysSource
YesSAML, OIDC, LDAP; mandatory 2FA optionSource

7Fine-grained administrator RBAC

Custom roles and permissions scoped to keys, services or organisational units.

YesRoles scoped to organisational unitsSource
YesCustom account and group rolesSource

8Quorum (four-eyes) approval

Sensitive key operations need approval from several administrators.

YesM-of-N on key and vault deletion, vault rotationSource
YesGroup quorum policySource

9Contextual access on key use

Decrypt allowed or denied by IP range, country or time of day.

YesIP, country and time rulesSource
PartialIP ranges onlySource

Monitoring

10Audit logs exported to a SIEM

Key and admin events forwarded to Splunk, Sentinel, QRadar or syslog.

YesSplunk, Sentinel, QRadar, syslog/CEFSource
YesSplunk, syslog, Log AnalyticsSource

11Built-in monitoring dashboard

Health and usage dashboard shipped with the product.

YesPer-service health, GetKey and Decrypt countersSource
YesUsage dashboardSource

12SNMP monitoring

SNMP polling or traps for the operations team.

Not documentedNot in public docs
PartialOn-premises monitoring VM onlySource

Zero Trust and audit

28Access rules changed live

DKE access rules are edited in a UI or API and apply at once, without config files or redeployment.

YesPolicies apply without restartSource
NoEmail list in appsettings.jsonSource

29Block rules that override allows

Explicit deny rules to cut decrypt access for a user, group, network or country during an incident.

YesBypass > Block > Allow > default denySource
Not documentedAllow-list onlySource

30Several identity providers

Entra ID plus Okta, Keycloak or other OIDC providers for sign-in and group-based rules.

YesEntra ID, Okta, Keycloak and other OIDCSource
YesPlatform: SAML, OIDC, LDAPSource

31Tamper-evident audit log

Each audit record is signed or hash-chained, so edits and deletions are detectable.

YesHMAC-SHA256 per record plus SHA-256 chainSource
Not documentedImmutable in UI; no chaining statedSource

32Optional mTLS on decrypt calls

A client-certificate check on DKE decrypt calls, on top of the Entra ID token.

YesClient CA, allowed subjects, headerSource
Not documentedServer certificate onlySource

33Built-in end-to-end key test

The key and backend are tested with a wrap/unwrap round-trip before the service goes live.

YesPreflight wrap/unwrap checkSource
PartialManual curl of the public keySource

Availability and key lifecycle

13High-availability cluster

Active-active nodes so the key service survives a node failure.

YesN+1 Cockpit, 3+ MPC nodesSource
YesDSM cluster; DKE web service is yoursSource

14Multi-site or geo-redundant deployment

Survives the loss of a whole data centre.

YesThree-site MPC clusterSource
YesThree data centres per SaaS regionSource

15Key backup and recovery procedure

Documented backup and restore of keys after an incident.

YesSource
YesSource

16Old documents open after rotation

Content protected with a previous key version stays readable.

YesRotated keys kept decrypt-onlySource
YesOld keys kept until relabelSource

17Rotation without a new Purview label

Rotating the key does not require a new label or a relabelling campaign.

YesLabel URL unchanged since Cockpit 2.0.8Source
PartialRelabel before deleting old keysSource

18Scheduled key rotation

Automatic rotation on a schedule.

Not documentedManual one-click rotation documented
YesDSM rotation policySource

Hosting and deployment

19Vendor-hosted DKE service (SaaS)

The vendor runs the DKE endpoint; nothing for the customer to host.

YesOperated by DuoKeySource
PartialDSM SaaS; DKE web service is yoursSource

20On-premises option

Run the whole DKE stack inside your own perimeter.

YesOpenShift or VMsSource
YesIIS plus DSM appliancesSource

21Automatic Entra ID app registration

The DKE app registration is created for you instead of manual portal steps.

YesCreated through Microsoft GraphSource
NoManual Azure portal stepsSource

22No end-of-life runtime or OS

The documented deployment does not depend on an unsupported framework or operating system.

YesSupported OpenShift 4.xSource
No.NET Core 3.1 (EOL Dec 2022)Source

Key storage, compliance and exit

23FIPS 140 Level 3 key storage

Keys protected by a FIPS 140-2 or 140-3 Level 3 validated module.

YesWith an HSM backend such as SecurosysSource
PartialLevel 3 appliances; SaaS in non-FIPS modeSource

24Key never assembled in one place

Multi-Party Computation or threshold cryptography: no single node holds the whole key.

YesWith the MPC key backendSource
Not documented

25Vendor ISO/IEC 27001 certified

The vendor's own operations are ISO/IEC 27001 certified.

YesISO 27001, SOC 2, TISAX AL3Source
YesSource

26Customer chooses the hosting region

Pick where the key service and keys are hosted.

YesEU, Switzerland or USSource
YesRegion chosen at sign-upSource

27Key export in standard formats

Reversibility: keys can be exported through KMIP, PKCS#8 or PKCS#12.

Not documentedKeys marked non-extractableSource
YesKMIP and PKCS#11Source

Why teams choose DuoKey

Key differences with Fortanix

01

A managed DKE service, not a web app to run

Fortanix's guide has you install the .NET Core 3.1 SDK (end of life since December 2022) and .NET 6 hosting, unzip the service into C:\inetpub\wwwroot, edit appsettings.json and register the Azure app by hand. DuoKey runs the DKE service for you.

02

Authorization beyond an email list

Fortanix authorizes decryption with an email allow-list; if the list is empty, every user in the tenant is allowed. DuoKey enforces group, IP, country and time rules on every decrypt.

03

Rotation without relabelling

Fortanix advises keeping old keys until all documents are relabeled. DuoKey keeps rotated keys decrypt-only and leaves the Purview label URL unchanged.

04

MPC and partner tenants

DuoKey's MPC backend never assembles the key, and the DKE service supports B2B partner tenants out of the box. Neither is documented for Fortanix's DKE service.

What Fortanix does well

DSM is a strong platform: 24/7 support, a 30-day trial, SAML and OIDC sign-in, custom roles, quorum policies, SIEM export, scheduled rotation, regional SaaS and KMIP/PKCS#11 interfaces. If DSM is already your key platform and you are comfortable running the DKE web service, Fortanix can work.

FAQ

Is DuoKey an alternative to Fortanix for Microsoft 365 DKE?

Yes. DuoKey provides the customer-held second key and the DKE service that Microsoft 365 calls, operated by DuoKey or deployed on your own infrastructure.

Can I migrate from Fortanix to DuoKey?

Yes. Create a DuoKey DKE service and a sensitivity label for new content, and keep the existing Fortanix service running for documents already protected with it until they are re-labelled or reach the end of retention.

How were these criteria chosen?

They follow the sections of a customer DKE and key management RFP: support, Microsoft DKE coverage, administration, monitoring, availability, hosting, key storage and exit. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

Fortanix

  1. [1]support.fortanix.comcriteria 1https://support.fortanix.com/docs/fortanix-support
  2. [2]support.fortanix.comcriteria 2https://support.fortanix.com/docs/sign-up-for-fortanix-data-security-manager-saas
  3. [3]support.fortanix.comcriteria 3, 4, 5, 8, 28, 29, 32, 33, 16, 17, 19, 20, 21, 22, 26https://support.fortanix.com/docs/fortanix-dsm-with-double-key-encryption-for-microsoft-365
  4. [4]support.fortanix.comcriteria 6https://support.fortanix.com/docs/users-guide-authentication
  5. [5]support.fortanix.comcriteria 7https://support.fortanix.com/docs/users-guide-custom-role
  6. [6]support.fortanix.comcriteria 9https://support.fortanix.com/docs/fortanix-data-security-manager-sysadmin-settings-ip-policy
  7. [7]support.fortanix.comcriteria 10, 31https://support.fortanix.com/docs/fortanix-dsm-logging
  8. [8]support.fortanix.comcriteria 11https://support.fortanix.com/docs/fortanix-dsm-usage-metrics
  9. [9]support.fortanix.comcriteria 12https://support.fortanix.com/docs/fortanix-data-security-manager-monitoring-and-alerting-solution
  10. [10]support.fortanix.comcriteria 30https://support.fortanix.com/docs/users-guide-single-sign-on
  11. [11]support.fortanix.comcriteria 13https://support.fortanix.com/docs/fortanix-data-security-manager-deployment-best-practices
  12. [12]support.fortanix.comcriteria 14https://support.fortanix.com/docs/fortanix-dsm-saas-architecture
  13. [13]support.fortanix.comcriteria 15https://support.fortanix.com/docs/introduction-to-fortanix-dsm-backup-and-restore
  14. [14]support.fortanix.comcriteria 18https://support.fortanix.com/docs/clients-terraform-provider
  15. [15]support.fortanix.comcriteria 23https://support.fortanix.com/docs/fortanix-data-security-manager-deployment-options
  16. [16]fortanix.comcriteria 25https://fortanix.com/company/pr/2023/01/fortanix-receives-iso-27001-certification-to-deliver-the-highest-level-of-information-security-and-risk-management-diligence
  17. [17]support.fortanix.comcriteria 27https://support.fortanix.com/docs/what-languages-and-interfaces-are-supported-by-fortanix-data-security-manager

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2https://docs.duokey.com/docs/why-mpc
  2. [2]docs.duokey.comcriteria 3https://docs.duokey.com/docs/double-key-encryption/cockpit-v2/overview
  3. [3]docs.duokey.comcriteria 4, 29https://docs.duokey.com/docs/double-key-encryption/cockpit-v2/access-policies
  4. [4]docs.duokey.comcriteria 5https://docs.duokey.com/docs/double-key-encryption/operations/b2b-collaboration
  5. [5]docs.duokey.comcriteria 6, 31https://docs.duokey.com/docs/cockpit/security
  6. [6]docs.duokey.comcriteria 7https://docs.duokey.com/docs/cockpit/administration
  7. [7]docs.duokey.comcriteria 8https://docs.duokey.com/docs/cockpit/key-policies
  8. [8]docs.duokey.comcriteria 9https://docs.duokey.com/docs/cockpit/access-policies
  9. [9]docs.duokey.comcriteria 10https://docs.duokey.com/docs/openshift-on-prem/security/compliance-audit
  10. [10]docs.duokey.comcriteria 11, 32, 33https://docs.duokey.com/docs/double-key-encryption/setup/dke-service-deployment
  11. [11]docs.duokey.comcriteria 28https://docs.duokey.com/docs/double-key-encryption/operations/zero-trust-access-control
  12. [12]docs.duokey.comcriteria 30https://docs.duokey.com/docs/developer/administration-api
  13. [13]docs.duokey.comcriteria 13https://docs.duokey.com/docs/openshift-on-prem/vm-deployment
  14. [14]docs.duokey.comcriteria 14https://docs.duokey.com/docs/openshift-on-prem/mpc-cluster
  15. [15]docs.duokey.comcriteria 15https://docs.duokey.com/docs/openshift-on-prem/operations/backup-recovery
  16. [16]docs.duokey.comcriteria 16, 17, 21https://docs.duokey.com/docs/double-key-encryption/cockpit-v2/dke-configuration
  17. [17]docs.duokey.comcriteria 19https://docs.duokey.com/docs/double-key-encryption/knowledgebase
  18. [18]docs.duokey.comcriteria 20, 22, 24https://docs.duokey.com/docs/openshift-on-prem/prerequisites
  19. [19]docs.duokey.comcriteria 23https://docs.duokey.com/docs/oracle-tde/overview
  20. [20]duokey.comcriteria 25https://duokey.com/en/compliance/iso-27001
  21. [21]docs.duokey.comcriteria 26https://docs.duokey.com/docs/double-key-encryption/faq
  22. [22]docs.duokey.comcriteria 27https://docs.duokey.com/docs/pkcs11-lib/function-coverage

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform