How to Evaluate a DKE Provider: 6 Criteria

---

Microsoft 365 Double Key Encryption (DKE) only delivers independent control if the second key provider can operate keys the way a security team actually runs production: rotate without breaking labels, provision cleanly in Azure, support partner tenants, and enforce who may unwrap under which context.

Use these six criteria when you shortlist a DKE key provider. They are capability tests, not a vendor league table. Ask each candidate to demonstrate them in a pilot.

---

Table of Contents

1. Rotation with continuity
2. Automatic Graph provisioning
3. Multi-tenant and B2B
4. Contextual ABAC
5. Independent key custody
6. Operability and evidence
7. How DuoKey maps to the six

---

1. Rotation with continuity

Ask: When we rotate a DKE key, do users keep opening protected content without a new Purview label rollout or a change-management programme?

Why it matters. Rotation that forces new labels, re-classification, or a weekend of broken documents will be deferred. Deferred rotation is residual risk.

What good looks like. A configurable cache window so the previous key still serves decrypt operations during rotation. Continuity is a product behaviour, not a runbook apology.

---

2. Automatic Graph provisioning

Ask: Is the Azure app registration and DKE endpoint wiring provisioned through Microsoft Graph, or is it a manual portal checklist?

Why it matters. Manual app registration drift is how pilots stall and how production differs from the diagram.

What good looks like. Automated Graph-based provisioning of the application registration and required configuration, repeatable per environment.

---

3. Multi-tenant and B2B

Ask: Can partner domains and dedicated issuers participate without flattening everyone into one tenant trust model?

Why it matters. Real estates include subsidiaries, law firms, and B2B guests. DKE that only works for a single tidy tenant fails the first external collaboration test.

What good looks like. Support for partner domains and dedicated issuers so cross-tenant collaboration stays under explicit key policy.

---

4. Contextual ABAC

Ask: Can unwrap be denied or allowed based on user, IP, location, time, Azure groups and MFA state, not only "member of group X"?

Why it matters. DKE without contextual access control becomes a binary: anyone who can authenticate to the key service can unwrap. That is not how regulated mail and files are supposed to work.

What good looks like. Attribute-based rules evaluated on each key access: identity, network, geo, time, group membership, MFA.

---

5. Independent key custody

Ask: Who can reconstruct or use the customer-controlled key alone? Does any single party (including the DKE vendor or hyperscaler) hold a complete unwrap secret?

Why it matters. DKE exists so Microsoft cannot unwrap alone. The second key should not recreate a new single point of compromise at the provider.

What good looks like. Customer-held control with distributed key technology (for example MPC) so no single operator or appliance holds the full key. See MPC vs HSM.

---

6. Operability and evidence

Ask: Can we show auditors who accessed keys, when rotation happened, and how B2B issuers are scoped, without exporting tribal knowledge from the implementer?

Why it matters. Sovereignty programmes fail audits on evidence, not on slideware.

What good looks like. Audit trails, clear key ownership, documented rotation history, and operational runbooks that match what the product actually does.

---

How DuoKey maps to the six

On DuoKey for Microsoft 365 DKE these criteria are product capabilities, not roadmap slogans:

Use the six questions above against any provider, including us. The right shortlist is the one that can demonstrate each item with your tenant, not the one with the longest feature PDF.

---

Conclusion

Evaluating DKE providers on brand familiarity alone misses the operational failures that kill programmes: rotation that breaks labels, manual Azure wiring, no B2B path, and unwrap rules that ignore context. Score every candidate on these six criteria in a pilot. Keep Microsoft off the second key, and keep your own provider from becoming the new single point of failure.

---

References

• DuoKey Double Key Encryption for Microsoft 365
• Microsoft 365 DKE setup guide
• Why M365 encryption is not enough