AWS S3 Encryption
Objects stay in S3 for scale. Decryption still requires a key share you hold outside AWS.
Own the root keys of Exchange Online
Microsoft Purview Customer Key encrypts Microsoft 365 data at rest with root keys you control. DuoKey generates and governs them under your authority.
Your root keys
Root keys created and governed by you, then made available to Microsoft 365 service encryption.
Every feature keeps working
Search, eDiscovery and Copilot keep working, because Microsoft 365 services can still use the key.
A real exit
Revoking access to your keys triggers cryptographic deletion of your data.
Service encryption under your root keys.
Customer Key encrypts data at rest for the Microsoft 365 services you authorise, with RSA root keys in Azure Key Vault or Managed HSM that you control.
- An availability key protected by Microsoft keeps services running.
- Data encryption policies per workload or per mailbox.
Exchange, SharePoint, OneDrive and Teams.
One data encryption policy can cover several workloads, including Copilot interactions and Windows 365 data at rest.
- Choose which services and mailboxes each policy covers.
- Pair it with Double Key Encryption for the most sensitive labels.
Lifecycle without guesswork.
Create, rotate and revoke keys from the Cockpit, with policies on who can do what and a record of every key operation.
- Monitor who uses your keys.
- Scales to large tenants without redesigning key management.
Leave with your data unreadable.
Microsoft documents it plainly: revoking access to your keys triggers deletion of the availability key and cryptographic deletion of your data.
- An exit plan regulators can review.
- Keys generated with MPC, never held whole by one party.
Exchange Online
SharePoint
OneDrive
DuoKey Customer Key
Teams
Windows 365
Azure Key Vault
Where Customer Key applies.
Customer Key covers service encryption for the core Microsoft 365 workloads. Use it broadly, and DKE for the small slice Microsoft must never read.
- Licensing and set-up follow Microsoft Purview Customer Key.
- Keys made available through Azure Key Vault or Managed HSM.
Key features
Root key control
Generate and govern the keys behind Microsoft 365 service encryption.
Key lifecycle
Create, rotate and revoke from one console.
Usage monitoring
See who uses your keys and when.
MPC technology
Distributed trust, no single point of compromise.
Compliance evidence
The records regulators expect, from one place.
Scale
Built for large tenants and key volumes.
Choose your Microsoft 365 control model
Customer Key for broad service encryption, DKE for what Microsoft must never read.
Proof in practice
Where teams deploy this
Deep dives
Field guides for your programme
Compliance
Frameworks this product supports
Trust
Assurance and customer programmes
Customer programmes
Microsoft 365 data under keys you hold.
See Customer Key with root keys under your authority and a real exit plan.
Products
Check out the other DuoKey products
View product