overview
DuoKey for Office 365 Customer Key
Integrate seamlessly with Microsoft encryption framework to control your encryption keys, meet regulatory obligations, and protect data against unauthorized access.
Architecture
Microsoft 365 with a DuoKey-held key
Microsoft 365 keeps the data; DuoKey keeps the key. Revoke the key and the data goes dark, everywhere.
Elevating Data Security in Office 365 with Advanced Key Management
Microsoft Office 365 Customer Key allows you to provide, control, and manage your root encryption keys that are used to encrypt your data at rest in Office 365. With DuoKey for Office 365 Customer Key, you gain advanced key management capabilities using Multi-Party Computation (MPC) technology, ensuring no single point of failure and enhanced security posture.
Why DuoKey for Office 365 Customer Key?
Enhanced Control and Compliance
Manage your root encryption keys to meet compliance demands that require key management arrangements with the cloud service provider.
Robust Encryption
Works alongside Office 365 native encryption mechanisms such as BitLocker and service encryption to provide an additional layer of security.
Flexibility in Key Management
Manage encryption keys both on-premises and in the cloud, providing comprehensive coverage across all data at rest.
Key Features
Comprehensive Encryption Coverage
DuoKey extends encryption capabilities across various Office 365 applications:
- Exchange Online (mailbox data)
- SharePoint Online (sites and documents)
- OneDrive for Business (personal files)
- Microsoft Teams (chat, files, and recordings)
Seamless Integration with Office 365
Integrates with Office 365 without altering the native user experience, maintaining performance and functionality while enhancing security.
Advanced Key Management Capabilities
Multi-Party Computation (MPC): Unlike traditional key management services, DuoKey utilizes MPC to enhance security by distributing parts of the encryption key across multiple locations, ensuring no single point of failure.
No Single Access
No single party has complete access to encryption keys.
Insider Threat Protection
Enhanced protection against insider threats.
Secure Operations
Cryptographic operations performed without exposing keys.
Compliance Ready
Meets stringent compliance requirements.
Competitive Advantage
Beyond Traditional HSM Solutions
DuoKey provides more robust data protection capabilities than traditional HSMs by allowing organizations to retain complete control over their encryption keys.
Multi-Party Computation
Distributed key operations with no single point of compromise.
Enhanced Audit
Enhanced audit and monitoring capabilities.
Flexible Deployment
Cloud or on-premises deployment options.
Regulatory Compliance
GDPR, HIPAA, SOC 2, and industry-specific regulations.
Integration with Microsoft Encryption Technologies
| Technology | Level | Description |
|---|---|---|
| BitLocker | Disk-level | Disk-level encryption for physical security |
| SSE (Service Encryption) | Service-level | Service-level encryption within data centers |
| Customer Key | Application-level | Application-level encryption with customer-controlled keys |
DuoKey adds an extra layer of key management control, ensuring that even if one layer is compromised, your data remains protected.
Technical Process for BYOK Import
The Bring Your Own Key (BYOK) process is a comprehensive method for customers to import and control their encryption keys within Microsoft Office 365, ensuring enhanced data security and compliance.
BYOK Process for Office 365 Customer Key
Offline Key Generation
The process begins with the generation of the target Customer Key on an offline machine. This key can be RSA (Rivest-Shamir-Adleman), EC (Elliptic Curve), or AES (Advanced Encryption Standard). The key is encrypted using the MRZ15 algorithm for additional security during transport.
Online Key Exchange Key (KEK) Generation
Two RSA KEKs are created online via DuoKey automation and Azure Graph API. These KEKs are stored securely in two Azure Key Vaults, which are Azure premium HSM-backed key management services.
Retrieve KEK Public Key
The public keys of the KEKs generated in the previous step are retrieved, which will be used in the next steps to secure the encryption process.
Temporary AES Key Creation
A temporary AES 256-bit key is generated online, which will be used to encrypt the Customer Key in transit to ensure its confidentiality and integrity.
Encrypt Temporary AES Key
The temporary AES key is then securely wrapped using the RSA KEKs from Step 3, employing the RSA_PKCS_OAEP algorithm for robust encryption.
Wrap Customer Key
The Customer Key is wrapped with the AES key generated in Step 4 using the CKM_AES_KEY_WRAP_PAD algorithm. This step secures the Customer Key before it is uploaded to Azure Key Vault.
Combine Encryption Session Key and Encrypted Message
The encrypted outputs from Step 5 and Step 6 are combined to form a secure message package that includes both the encrypted key and the encrypted data, ready for secure transmission or storage.
Generate BYOK File for Import
A BYOK file in JSON format is created, which includes all necessary parameters and encrypted keys from the previous steps. This file is ready to be imported into Azure Key Vault, enabling the secure use of Customer Keys within Microsoft Office 365 environments.
Security and Compliance Considerations
Data Sovereignty and Control
Customers retain full control over their keys, ensuring compliance with local data sovereignty laws and regulations.
Enhanced Security
Customers generate and keep the root keys outside Microsoft, authorise their use in Azure Key Vault and can revoke that authorisation.
Auditing and Compliance
Supports detailed auditing capabilities, allowing organizations to monitor key usage and access for compliance.
How Office 365 Customer Key Works
Encryption Architecture
Office 365 uses a layered encryption approach:
Service Encryption Layer
Microsoft encrypts data at rest using service encryption keys (Microsoft-managed key).
Customer Key Layer
Your Customer Keys encrypt the service encryption keys (Your Customer Key from DuoKey).
BitLocker Layer
Additional disk-level encryption for physical security.
Data Encryption Process
User Data (Plaintext)
|
[Layer 1: Service Encryption]
| (Microsoft-managed key)
Service-Encrypted Data
|
[Layer 2: Customer Key Encryption]
| (Your Customer Key from DuoKey)
Customer Key-Encrypted Data
|
[Layer 3: BitLocker Encryption]
| (Disk-level encryption)
Fully Encrypted Data at Rest
Key Hierarchy
Customer Key (Your control via DuoKey)
|
Data Encryption Policy (DEP)
|
Intermediate Keys
|
Per-mailbox/per-file Keys
|
Encrypted User Data
Use Cases
Scenario: Need to comply with financial regulations requiring control over data access and key management.
Solution: DuoKey enables financial organizations to manage their own keys, enhancing security and ensuring compliance with GDPR, SOX, PCI DSS, and Basel III.
Benefits:
- Demonstrate cryptographic key control to auditors
- Meet data residency requirements
- Instant key revocation capabilities
- Complete audit trail of key operations
Supported Office 365 Workloads
Exchange Online
Mailbox data encryption, archive mailbox encryption, and encryption of data indexed by Exchange Search.
SharePoint Online and OneDrive
Document libraries, lists and list items, site content, search indexes, and OneDrive personal files.
Microsoft Teams
Chat messages and conversations, files shared in Teams channels, meeting recordings, and Teams site content.
Skype for Business
Conversation history, shared files, and meeting content.
Multi-Party Computation (MPC) Technology
DuoKey leverages MPC technology to provide enhanced security for your Office 365 Customer Keys.
How MPC Works
Key Splitting
Your Customer Key is mathematically split into multiple shares.
Distributed Storage
Shares are stored in separate, isolated locations.
Threshold Operations
A minimum number of shares (threshold) required for operations.
No Single Point of Access
No single party can access or reconstruct the complete key.
MPC Benefits
No Single Point of Failure
Even if one location is compromised, your key remains secure.
Enhanced Access Control
Multiple parties must collaborate for key operations.
Cryptographic Operations
Performed without ever exposing the complete key.
Compliance Advantage
Demonstrates enhanced security controls to auditors.
Key Revocation and Data Recovery
Instant Key Revocation
Revoking keys will immediately prevent Microsoft from decrypting your data. Users will lose access to their mailboxes, files, and Teams data until keys are restored.
Deprovision Keys
Remove Customer Keys from Azure Key Vault.
Immediate Effect
Microsoft loses access to decrypt your data within hours.
Data Protection
Your data remains encrypted and inaccessible.
Availability Key
Microsoft maintains an Availability Key as a backup mechanism. It is used only in specific scenarios (e.g., key unavailability), does not provide Microsoft with routine access to your data, and is subject to strict access controls and auditing.
Key Recovery
Restore Customer Keys
Restore Customer Keys to Azure Key Vault.
Update DEP
Update Data Encryption Policy (DEP).
Service Recovery
Service automatically regains access to decrypt data.
Prerequisites
Prerequisites
- Office 365 Enterprise E5 license (or E5 Compliance add-on)
- Exchange Online Plan 2
- SharePoint Online Plan 2
- OneDrive for Business Plan 2
- Global Administrator role for configuration
- Azure subscription
- Azure Key Vault Premium (HSM-backed) in two regions
- Appropriate Azure Active Directory permissions
- Resource group for Key Vault deployment
- DuoKey platform access
- DuoKey Cockpit configured for Office 365 Customer Key
- Valid DuoKey license
- HTTPS connectivity between Office 365 and Azure Key Vault
- Outbound connectivity from Office 365 services
- Proper firewall and proxy configurations
Performance Considerations
Impact on User Experience
Customer Key operations are designed to have minimal impact on end-users. Encryption and decryption happens transparently with no noticeable performance degradation. Key management occurs as background operations.
Initial Encryption Timeline
| Workload | Timeline | Notes |
|---|---|---|
| Mailboxes | 24-48 hours per DEP | Depends on mailbox size |
| SharePoint/OneDrive | Several days to weeks | Depends on data volume |
| Teams | Follows SharePoint timeline | Data stored in SharePoint |
Ongoing Operations
- Real-time encryption for new content
- Automatic key rotation support
- Continuous background encryption for unencrypted content
Monitoring and Auditing
DuoKey Audit Logs
Key access attempts, successful/failed operations, administrative changes, and compliance reports.
Office 365 Audit Logs
DEP assignments, key usage, administrative actions, and security incidents.
Integration Points
Azure Monitor, Office 365 Security and Compliance Center, DuoKey Cockpit, and SIEM integration.
Quotas and Limits
Office 365 Customer Key Limits
| Resource | Limit |
|---|---|
| Maximum DEPs per tenant | 50 |
| DEP assignment scope | Multiple mailboxes/sites per DEP |
| Minimum key size | 2048-bit RSA keys |
| Key refresh operations | Subject to Azure Key Vault throttling |
Azure Key Vault Limits
| Resource | Limit |
|---|---|
| Keys per vault | 25,000 |
| Operations per 10 seconds | Varies by key type and operation |
| Region-specific quotas | Apply per Azure region |
Best Practices
Key Management
Maintain offline backups, plan regular key rotation, implement least-privilege access, and store keys in different Azure regions.
Security
Require MFA for admin access, use separate Azure tenants, enable comprehensive logging, and develop incident response procedures.
Operational Excellence
Test DEP assignments in non-production, maintain detailed runbooks, follow structured change processes, and train IT staff.
Comparison with Other Solutions
Customer Key vs. Default Encryption
| Feature | Default Service Encryption | Customer Key |
|---|---|---|
| Key Control | Microsoft manages | Customer manages |
| Key Location | Microsoft datacenters | Azure Key Vault (customer's) |
| Compliance | Standard compliance | Enhanced compliance (data sovereignty) |
| Key Revocation | Not possible | Instant revocation capability |
| Audit Control | Microsoft audit logs | Customer audit logs + Microsoft logs |
| Cost | Included | Additional licensing required |
Customer Key vs. Customer Lockbox
| Feature | Customer Key | Customer Lockbox |
|---|---|---|
| Purpose | Encryption key control | Access request approval |
| Scope | Data at rest encryption | Microsoft support access |
| Implementation | Technical setup required | Administrative approval workflow |
| Compliance Impact | Enhanced data protection | Enhanced access governance |
Getting Started
Getting Started
Review prerequisites and initial setup.
Operations Guide
Learn about day-to-day key management.
Best Practices
Follow security and operational excellence guidelines.
Troubleshooting
For detailed troubleshooting guidance, see Troubleshooting Guide.
Support
For technical support or questions about DuoKey for Office 365 Customer Key:
- Email: [email protected]
- Documentation: DuoKey Support
- Microsoft Documentation: Service Encryption with Customer Key