Double Key Encryption (DKE)
Double Key Encryption (DKE)
Protect Microsoft 365 documents with customer-controlled encryption keys
Introduction & Concepts
Modern work environments, especially those using cloud services, require advanced data protection. While standard permissions and encryption offer baseline security, Microsoft Purview Information Protection (MPIP) strengthens it by encrypting data and embedding usage rights directly with the information.
For highly sensitive data, even stronger safeguards are needed—particularly protection from the cloud provider itself. This is where Double Key Encryption (DKE) comes in.
The Challenge: Protecting Sensitive Data in the Cloud
Key Control
Cloud providers typically manage the encryption keys
Technical Access
Providers have technical ability to access encrypted data
Shared Control
Shared control poses regulatory and compliance challenges
Microsoft Purview Information Protection (MPIP)
Before exploring DKE, it's essential to understand MPIP/Azure RMS, which DKE extends.
| Component | Description |
|---|---|
| Microsoft Entra ID | Manages identities and tenant separation |
| Purview Information Protection | Handles sensitivity labels and protection settings |
| Azure Rights Management (Azure RMS) | Manages Microsoft-controlled cryptographic keys |
| Clients | Apps (e.g., Microsoft 365) accessing protected content |
| DKE Web Service | Customer-controlled component for DKE flow |
What is Double Key Encryption?
Double Key Encryption (DKE) builds directly on top of Microsoft Purview Information Protection. It achieves maximum data confidentiality and control by introducing a second encryption key.
Two Keys
One key managed by Microsoft, second key held exclusively by you
Customer Control
Microsoft has no access to your private, second key
Data Privacy by Design
DuoKey can never access your document content
Swiss Cloud Service
HSM-protected keys with DuoKey MPC
DuoKey - DKE
DuoKey DKE is a Swiss cloud service offering Double Key Encryption to encrypt Microsoft 365 Office documents with Hardware Security Module protected keys.
The DuoKey DKE Solution Provides
- The customer-controlled private key (DKE Key Management)
- The deployment of DKE Web Service apps
- Control of DKE service access
How Double Key Encryption Works
How Double Key Encryption Works
Sovereign MPC-based key management for Microsoft 365
Microsoft Purview
Azure RMSDuoKey Sovereign KMS
MPC VaultKey shares are computed together via Secure Multi-Party Computation — the full key never exists in any single location
Double Key Encrypted Document
Neither Microsoft nor DuoKey can access your data alone
Critical Security Considerations
DKE provides powerful control, but its security effectiveness is entirely dependent on your organization's ability to secure its components.
| Consideration | Description |
|---|---|
| Protect Your Key | The primary security requirement is rigorously safeguarding the customer-controlled private key |
| Protect Identities | Protecting user and administrator identities authorized to access the DKE service is critical |
| Identity Provider Risk | Using the same identity provider for both M365 and DKE introduces risk of single identity compromise |
DKE Components
| Component | Description |
|---|---|
| Client Functionality | Microsoft 365 desktop apps on Windows (Word, Excel, PowerPoint, Outlook) and Adobe Acrobat |
| DKE Web Service | Web server component operated by DuoKey and controlled by the customer |
Comparison: Standard MPIP vs. DKE
| Feature | Standard MPIP | DKE (with DuoKey) |
|---|---|---|
| Who holds encryption key? | Microsoft (cloud provider) | Microsoft + Customer (DuoKey HSM) |
| Can Microsoft access content? | Technically possible (with limitations) | No access possible |
| Control over sensitive data | Shared control | Exclusive customer control |
| Compliance with regulations | Limited (depends on jurisdiction) | Enhanced compliance |
What's Next
Get Started
Comprehensive setup task list
Operations
Key Management and DKE Service guides
Knowledge Base
In-depth DKE instructions
Vendor Documentation
See Also
Book a 30-Minute Demo: Schedule a personalized demo to explore how DKE can benefit your organization.