Microsoft 365 DKE Providers Compared: DuoKey, Thales, Entrust, Fortanix, Utimaco, Cosmian, IBM

Microsoft 365 Double Key Encryption (DKE) needs a second key that Microsoft never holds. Microsoft publishes a reference key service you can host yourself, and several vendors offer to run or back that second key for you. They differ on three things that matter in production: how the key is protected, who operates the DKE service, and what happens when you rotate or restrict access.

This page compares the main options as documented publicly by each vendor. It is written by DuoKey, so we state our own position plainly and give the cases where another provider is the better fit.

Method. Competitor information comes only from each vendor's public documentation, reviewed in October 2026. "Not found in public docs" means exactly that: the capability may exist without being documented. Check every point with the vendor in a pilot.

---

Table of Contents

1. Summary table
2. DuoKey
3. Thales (CipherTrust / Luna)
4. Entrust (KeyControl Vault)
5. Fortanix (DSM)
6. Utimaco
7. Cosmian
8. IBM (UKO for z/OS)
9. Self-hosting Microsoft's sample
10. Which provider fits which buyer
11. FAQ

---

Summary table

Feature-by-feature comparisons: DuoKey vs Thales · DuoKey vs Entrust · DuoKey vs Fortanix · DuoKey vs Utimaco · DuoKey vs Cosmian

---

DuoKey

DuoKey sells DKE as a product, not as a module of a larger KMS. With the MPC backend, the second key is split across independent nodes so that no server, no administrator and no single compromised node can reconstruct it; an HSM backend is also available. The DKE service is deployed from a wizard in DuoKey Cockpit, which also provisions the Entra ID app registration through Microsoft Graph.

• Rotation with continuity. A configurable cache window keeps the previous key serving GetKey and Decrypt during rotation. The Purview label URL names the service, not a key, so it does not change.
• Zero Trust on every decrypt. Each decrypt is checked against an access policy combining user, identity-provider group, IP range, country and time, with Block rules that override allows.
• Governance and audit. M-of-N quorum approvals on key and vault deletion, and HMAC-signed, hash-chained audit records.
• Operated for you. DuoKey runs the DKE endpoint, TLS and availability (ISO 27001, SOC 2, TISAX AL3). Customers who must keep everything in-house can run Cockpit on-premises or on OpenShift.

Choose DuoKey if you want DKE without operating a key service, want MPC rather than a single HSM to hold the second key, or need a Swiss jurisdiction.

Thales (CipherTrust / Luna)

Thales offers DKE two ways: as a module of CipherTrust Cloud Key Manager (on a CipherTrust Manager appliance, or hosted by Thales as a service), and as Luna Key Broker for DKE, a container the customer deploys on Kubernetes with keys in Luna HSMs (FIPS 140-3 Level 3). The CCKM documentation covers scheduled and versioned DKE rotation, DKE Authorized Tenants for multi-tenant use, quorum approval, SNMP, standard key export and per-tenant authorization by email or Active Directory group. It is a mature, well-documented option, with a hosted edition in the EU or US.

The differences with DuoKey are structural: Thales sells a multi-cloud key management platform in which DKE is one module, and the Azure app registration is a manual step. Thales's public Luna Key Broker setup guide runs to more than 50 manual commands on AKS, with a CentOS 7 image (end of life since June 2024) and a sample policy that admits any user whose token carries a UPN.

Choose Thales if you already run CipherTrust or Luna HSMs and want DKE on the same platform as your other keys.

Entrust (KeyControl Vault)

Entrust offers DKE through KeyControl Vault backed by nShield HSMs (FIPS 140-2 Level 3, Common Criteria EAL4+), deployed as a geo-redundant active-active cluster. Its documentation covers scheduled DKE rotation, multi-tenant options (all tenants or specific tenants), tenant-GUID restriction and high availability. Continuity during rotation was not found in its public docs. The Azure app registration is manual.

Choose Entrust if you are standardised on nShield and KeyControl and want DKE within that estate.

Fortanix (DSM)

Fortanix's DKE service is built on Microsoft's open-source DKE implementation, with keys held in Fortanix Data Security Manager (FIPS 140-2 Level 3). Its published deployment guide has the customer install the .NET Core 3.1 SDK (end of life since December 2022) and .NET 6 hosting, unzip the service into IIS, edit appsettings.json by hand and register the Azure app manually. It advises keeping old keys until all documents are relabeled. Authorization is an email allow-list; if the list is empty, every user in the tenant is allowed.

Choose Fortanix if DSM is already your key platform and your team is comfortable operating the DKE web service on IIS.

Utimaco

Utimaco's DKE offer is DKE Anchor, software the customer installs in front of a CryptoServer HSM (FIPS 140-2 Level 3, CC EAL4+, German VS-NfD approval), on premises or with Utimaco's HSM as a Service. It supports partner tenants and keeps older key versions readable. Decrypt permissions are granted user by user by email address, audit logs are local files, and the Azure app registration is manual. Utimaco's 2026 blog posts describe its Enterprise Key Manager as a Service holding the DKE key, so check current availability.

Choose Utimaco if you need VS-NfD-approved hardware or already operate Utimaco HSMs.

Cosmian

Cosmian KMS, now documented as Eviden KMS, exposes DKE endpoints from a server the customer runs, operated with its ckms command-line tool, under French jurisdiction. Its DKE documentation states that the Office client sends no authentication to the KMS and that firewalling the server is critical. Its documented rotation creates a new sensitivity label in Purview and moves users to it, which turns each rotation into a change-management exercise. Provisioning is manual.

Choose Cosmian if you want a French, self-operated KMS and your team prefers a CLI-driven toolkit.

IBM (UKO for z/OS)

IBM supports Microsoft DKE through Unified Key Orchestrator for z/OS, with keys in IBM Z Crypto Express adapters and RBAC with dual control. Its public DKE documentation is thin: rotation, continuity, multi-tenant use and Azure provisioning were not found. The operating model, a mainframe key-orchestration stack, is the opposite of a cloud-native managed service.

Choose IBM if your key management is already centred on IBM Z and you want DKE keys governed there.

Self-hosting Microsoft's sample

Microsoft publishes a reference DKE key store on GitHub. It is free and fine for a lab. In production you build and run everything yourself: hosting, TLS, the key store, the app registration, access rules in configuration files, rotation and audit. Several vendor offers above are built on this same sample. Our DKE setup guide shows what the DuoKey alternative looks like step by step.

---

Which provider fits which buyer

Whatever the shortlist, test the six DKE evaluation criteria in a pilot on your own tenant.

---

FAQ

What is a DKE provider? A DKE provider hosts or protects the second key of Microsoft 365 Double Key Encryption, the one Microsoft never holds. Office calls the provider's DKE endpoint to fetch the public key and to request decrypts.

Can Microsoft decrypt DKE content? No. DKE content needs both Microsoft's Azure RMS key and the customer key held by the DKE provider. Microsoft never has the second key.

Which DKE provider does not need an HSM? DuoKey can protect the DKE key with Multi-Party Computation: the key is split across independent nodes and never assembled on one machine. An HSM backend is also available. The other providers listed here rely on HSMs (Thales, Entrust, Utimaco, IBM), on Fortanix DSM or on a software KMS (Cosmian).

Which DKE provider rotates keys without changing Purview labels? DuoKey (configurable cache window, label URL unchanged) and Thales (versioned rotation) document rotation with continuity. Fortanix and Cosmian document rotation processes that involve relabelling or a new label.

Is there a Swiss DKE provider? Yes. DuoKey SA is based in Switzerland and operates its DKE service itself, with ISO 27001, SOC 2 and TISAX AL3.

---

Sources

• DuoKey: Double Key Encryption documentation
• Thales: Luna Key Broker for DKE setup guide (GitHub), CCKM Microsoft DKE resources, Managing DKE Authorized Tenants
• Entrust: Microsoft DKE and KeyControl Integration Guide
• Fortanix: Fortanix DSM with Double Key Encryption for Microsoft 365
• Utimaco: DKE and CryptoServer HSM integration guide
• Cosmian: Microsoft 365 Double Key Encryption (DKE)
• IBM: Understanding MSDKE support, UKO for z/OS (ibm.com)
• Microsoft Learn: Double Key Encryption

Vendor documentation reviewed in October 2026. Product names belong to their respective owners. Corrections from vendors are welcome at the contact address on this site.