key-management
Key Management
Day-to-day key management operations for DuoKey Office 365 Customer Key, including key lifecycle management, rotation, backup, and recovery procedures.
Key Lifecycle Overview
Customer Keys in Office 365 follow a specific lifecycle:
Generation
Keys are created using DuoKey with MPC technology.
Import
Keys are imported into Azure Key Vault.
Active Use
Keys encrypt data in Office 365 workloads.
Rotation
Keys are periodically rotated for security.
Retirement
Old keys are archived but retained for decryption.
Deletion
Keys are permanently deleted after retention period.
Managing Data Encryption Policies (DEPs)
View All DEPs
# Connect to Exchange Online
Connect-ExchangeOnline
# List all DEPs
Get-M365DataAtRestEncryptionPolicy |
Select-Object Name, Description, State, AssignedCount |
Format-Table -AutoSize
View DEP Details
# Get detailed information about a specific DEP
Get-M365DataAtRestEncryptionPolicy -Identity "DEP-Prod-Mailboxes" |
Format-List *
# View key URIs associated with DEP
Get-M365DataAtRestEncryptionPolicy -Identity "DEP-Prod-Mailboxes" |
Select-Object -ExpandProperty AzureKeyIDs
Key Rotation
When to Rotate Keys
Rotate your Customer Keys when:
- Following your organization's key rotation policy (typically annually)
- After a security incident or suspected compromise
- When personnel with key access leave the organization
- As part of compliance requirements
- After major system upgrades
Key Rotation Process
Generate New Keys
Generate new primary and secondary keys using DuoKey MPC and export for BYOK import.
Import New Keys to Azure Key Vault
Import the new keys to your Azure Key Vaults using Add-AzKeyVaultKey.
Update DEP with New Keys
Use Set-M365DataAtRestEncryptionPolicy to update the DEP with new key URIs.
Monitor Re-encryption
Monitor re-encryption progress using Get-M365DataAtRestEncryptionPolicyAssignment.
Archive Old Keys
After successful rotation, disable old keys in Key Vault (do not delete immediately).
Always archive old keys rather than deleting them. Old keys may still be needed to decrypt previously encrypted data.
Rotation Timeline
| Phase | Duration | Activities |
|---|---|---|
| Planning | 1 week | Generate new keys, test import |
| Implementation | 1-2 days | Update DEPs with new keys |
| Re-encryption | 3-7 days | Office 365 re-encrypts data |
| Verification | 1 week | Monitor and validate encryption |
| Cleanup | Ongoing | Archive old keys after retention period |
Key Backup and Recovery
Backup Best Practices
Frequency
Backup keys immediately after creation and rotation.
Storage
Store backups in secure, offline location with strong encryption.
Redundancy
Maintain backups in multiple geographic locations.
Testing
Regularly test backup restoration procedures.
Retention
Retain backups per compliance requirements (typically 7 years).
Access Control
Limit backup access to authorized personnel only.
Key Revocation
Emergency Key Revocation
Key revocation is an emergency procedure. It will immediately prevent Microsoft 365 from accessing encrypted data, causing a complete service disruption for affected users.
Impact of Key Revocation
| Impact | Description |
|---|---|
| Immediate | Microsoft 365 cannot access encrypted data |
| User Impact | Users cannot access their mailboxes, files, or Teams data |
| Duration | Lasts until keys are restored or new DEP assigned |
| Recovery | Restore keys or create new DEP to regain access |
Managing Mailbox Assignments
Removing a DEP assignment does not decrypt existing data. Previously encrypted data remains encrypted with the original DEP. Only new data will use default Microsoft encryption.
Maintenance Schedule
| Frequency | Tasks |
|---|---|
| Daily | Monitor DEP health status, check for encryption failures, review key access logs |
| Weekly | Review key operation metrics, validate backup integrity, check mailbox encryption progress, review audit logs |
| Monthly | Generate compliance reports, review and update access policies, test key recovery procedures, update documentation |
| Quarterly | Conduct key rotation (if required), comprehensive security review, disaster recovery testing, staff training refresh |
| Annual | Major key rotation, complete compliance audit, review and update procedures, update business continuity plans |
Support and Resources
For assistance with key management operations:
- Technical Support: [email protected]
- Documentation: DuoKey Support
- Microsoft Support: Microsoft 365 Admin Center