getting-started

Getting Started

Walk through the initial setup and configuration of DuoKey for Office 365 Customer Key to enable you to control your encryption keys for data stored in Microsoft 365.

Applies to:

Office 365 E5Azure Key Vault PremiumDuoKey Platform

Overview

Implementing DuoKey for Office 365 Customer Key involves several key steps:

1

Verify Prerequisites

Ensure you have the required licenses and permissions.

2

Set Up Azure Key Vaults

Create and configure Azure Key Vaults to store your keys.

3

Generate Customer Keys

Create encryption keys using DuoKey with MPC technology.

4

Register Keys with Microsoft 365

Import keys into Azure Key Vault.

5

Create Data Encryption Policies (DEPs)

Configure DEPs for your workloads.

6

Assign DEPs

Apply encryption policies to mailboxes, sites, and teams.

7

Monitor and Maintain

Set up monitoring and establish operational procedures.

Prerequisites Checklist

Before proceeding with implementation, ensure you have all prerequisites in place.

Prerequisites

• Office 365 Enterprise E5 license (or E5 Compliance add-on)
• Exchange Online Plan 2
• SharePoint Online Plan 2
• OneDrive for Business Plan 2
• Microsoft Teams included in subscription
• Global Administrator role in Microsoft 365
• Compliance Administrator role (recommended)
• Multi-factor authentication (MFA) enabled

Prerequisites

• Azure subscription (can be separate from Microsoft 365 subscription)
• Ability to create Azure Key Vaults in two different regions
• Azure Key Vault Premium tier (HSM-backed) available
• Permissions to create resource groups
• Permissions to create service principals
• Azure Active Directory administrator access
• Understanding of Azure role-based access control (RBAC)

Deployment Planning

Choose Your Deployment Strategy

Pilot Deployment

Start with 10-50 test users. Validate encryption and performance. Recommended for first-time users. Timeline: 2-4 weeks.

Phased Production

Phase 1: VIP mailboxes. Phase 2: Departments. Phase 3: General population. Timeline: 2-6 months.

Full Production

Deploy to all users simultaneously. Best for organizations under 1,000 users. Requires dedicated monitoring. Timeline: 4-8 weeks.

Workload Selection

Workload	Complexity	Impact	Recommended Order
Exchange Online (Mailboxes)	Medium	High	1st
SharePoint Online	High	High	2nd
OneDrive for Business	High	Medium	3rd
Microsoft Teams	High	Medium	4th

Quick Start: Pilot Environment

For a proof-of-concept pilot deployment, follow these steps.

Step 1: Create Azure Key Vaults

You need two Azure Key Vaults in different Azure regions for redundancy.

# Install Azure PowerShell module if not already installed
Install-Module -Name Az -AllowClobber -Force

# Connect to Azure
Connect-AzAccount

# Set variables
$subscriptionId = "your-subscription-id"
$resourceGroupName = "rg-customer-key-pilot"
$location1 = "eastus"
$location2 = "westus"
$keyVaultName1 = "kv-customerkey-eus-01"
$keyVaultName2 = "kv-customerkey-wus-01"

# Set subscription context
Set-AzContext -SubscriptionId $subscriptionId

# Create resource group
New-AzResourceGroup -Name $resourceGroupName -Location $location1

# Create first Key Vault (Premium tier with HSM)
New-AzKeyVault -Name $keyVaultName1 `
    -ResourceGroupName $resourceGroupName `
    -Location $location1 `
    -Sku Premium `
    -EnabledForDeployment `
    -EnabledForTemplateDeployment `
    -EnablePurgeProtection `
    -EnableSoftDelete

# Create second Key Vault
New-AzKeyVault -Name $keyVaultName2 `
    -ResourceGroupName $resourceGroupName `
    -Location $location2 `
    -Sku Premium `
    -EnabledForDeployment `
    -EnabledForTemplateDeployment `
    -EnablePurgeProtection `
    -EnableSoftDelete

Step 2: Generate Customer Keys with DuoKey

Use DuoKey to generate encryption keys with MPC technology:

# Login to DuoKey Cockpit (the CLI binary is `dke`)
dke login --url https://<cockpit-host> --api-key-file ./api-key.txt

# Create a new Customer Key
dke keys create \
    --vault-id <vault-id> \
    --name "CustomerKey-Pilot-Primary" \
    --key-type RSA \
    --size 2048 \
    --description "Pilot Customer Key" \
    --ops Encrypt,Decrypt \
    --exportable

# Create a second key for redundancy
dke keys create \
    --vault-id <vault-id> \
    --name "CustomerKey-Pilot-Secondary" \
    --key-type RSA \
    --size 2048 \
    --description "Pilot Customer Key (secondary)" \
    --ops Encrypt,Decrypt \
    --exportable

Note

dke keys export writes PKCS#8, PKCS#12 or RSA-AES wrapped files (see Key Export); it does not write the Azure .byok file. To obtain the .byok file referenced in the next step, export the key material through the DuoKey Cockpit UI rather than the CLI.

Step 3: Import Keys to Azure Key Vault

# Import primary key to first vault
$primaryKey = Add-AzKeyVaultKey -VaultName $keyVaultName1 `
    -Name "CustomerKey-Pilot-Primary" `
    -KeyFilePath "./primary-key.byok" `
    -Destination HSM

# Import secondary key to second vault
$secondaryKey = Add-AzKeyVaultKey -VaultName $keyVaultName2 `
    -Name "CustomerKey-Pilot-Secondary" `
    -KeyFilePath "./secondary-key.byok" `
    -Destination HSM

# Display key URIs (needed for DEP creation)
Write-Host "Primary Key URI: $($primaryKey.Id)"
Write-Host "Secondary Key URI: $($secondaryKey.Id)"

Step 4: Grant Microsoft 365 Access to Key Vaults

# Get Microsoft 365 service principal IDs
$exchangeServicePrincipal = "00000002-0000-0ff1-ce00-000000000000"
$sharepointServicePrincipal = "00000003-0000-0ff1-ce00-000000000000"

# Set access policy for Exchange Online on first vault
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName1 `
    -ServicePrincipalName $exchangeServicePrincipal `
    -PermissionsToKeys wrapKey,unwrapKey,get

# Set access policy for SharePoint Online on first vault
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName1 `
    -ServicePrincipalName $sharepointServicePrincipal `
    -PermissionsToKeys wrapKey,unwrapKey,get

# Repeat for second vault
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName2 `
    -ServicePrincipalName $exchangeServicePrincipal `
    -PermissionsToKeys wrapKey,unwrapKey,get

Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName2 `
    -ServicePrincipalName $sharepointServicePrincipal `
    -PermissionsToKeys wrapKey,unwrapKey,get

Step 5: Connect to Exchange Online PowerShell

# Install Exchange Online PowerShell module
Install-Module -Name ExchangeOnlineManagement -Force

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName [email protected]

# Verify connection
Get-OrganizationConfig | Select-Object Name

Step 6: Create Data Encryption Policy (DEP)

# Create DEP for Exchange Online mailboxes
New-M365DataAtRestEncryptionPolicy `
    -Name "DEP-Pilot-Mailboxes" `
    -Description "Pilot Customer Key DEP for Exchange Online" `
    -AzureKeyIDs @($primaryKey.Id, $secondaryKey.Id) `
    -Enabled $true

# Verify DEP creation
Get-M365DataAtRestEncryptionPolicy -Identity "DEP-Pilot-Mailboxes"

Step 7: Assign DEP to Pilot Mailboxes

# Assign DEP to a single mailbox
Set-Mailbox -Identity [email protected] `
    -DataEncryptionPolicy "DEP-Pilot-Mailboxes"

# Assign DEP to multiple mailboxes
$pilotUsers = @(
    "[email protected]",
    "[email protected]",
    "[email protected]"
)

foreach ($user in $pilotUsers) {
    Set-Mailbox -Identity $user -DataEncryptionPolicy "DEP-Pilot-Mailboxes"
    Write-Host "Assigned DEP to $user"
}

Step 8: Monitor Encryption Progress

# Check encryption status
Get-M365DataAtRestEncryptionPolicyAssignment `
    -Identity "DEP-Pilot-Mailboxes" |
    Format-Table -AutoSize

# Check individual mailbox encryption status
Get-MailboxStatistics -Identity [email protected] |
    Select-Object DisplayName, IsEncrypted, EncryptionStatus

Best Practices Checklist

Before Going Live

Complete these checklists before enabling Customer Key in production.

Prerequisites

• Keys backed up to secure offline location
• Access to Key Vaults limited to required personnel only
• MFA enabled for all admin accounts
• Emergency access procedures documented
• Key rotation schedule established

Timeline and Effort Estimation

Organization Size	Planning	Setup	Testing	Rollout	Total
Small (Under 500 users)	1 week	1 week	1 week	1 week	4 weeks
Medium (500-5,000 users)	2 weeks	2 weeks	2 weeks	4-6 weeks	10-12 weeks
Large (5,000+ users)	4 weeks	2 weeks	4 weeks	12-16 weeks	22-26 weeks

Next Steps

See Also

• Day-to-day operations
• Security best practices
• Troubleshooting procedures
• ↗Microsoft Customer Key Documentation
• ↗Azure Key Vault Best Practices
• ↗DuoKey MPC Technology Guide

Support and Resources

Need help with your deployment?

• Technical Support: [email protected]
• Sales Inquiries: [email protected]
• Documentation: DuoKey Support
• Microsoft Support: Microsoft 365 Admin Center