DuoKey for Microsoft 365
Double Key Encryption product sheet. 4 pages.
How Double Key Encryption works in Microsoft 365. Content with a sensitivity label needs two keys to open. Microsoft holds one, and you hold the other outside Microsoft. It covers the flow with Microsoft Purview, the key types, and running DuoKey on premises or as SaaS. Get the sheet if you have to show a regulator or customer that specific Microsoft 365 content is out of Microsoft's reach.
Get the download
Tell us where to send the link. A business email is required.
With standard Microsoft 365 encryption, Microsoft controls the keys. That means Microsoft can technically decrypt your content, and can be compelled to.
Double Key Encryption changes that. Labelled content needs two keys to open. Microsoft holds one and you hold the other. Without yours, nobody can read it, Microsoft included.
The sheet explains the two-key flow with Purview sensitivity labels, DuoKey's container-based deployment (on premises, SaaS, or a mix), and how use of your key is controlled and audited. Download it if you need to show a regulator or customer that your most sensitive Microsoft 365 content is beyond Microsoft's reach.
FAQ
Who is this for?
Microsoft 365 administrators and security or compliance teams who need some content to stay unreadable to Microsoft.
Does all of Microsoft 365 get double-encrypted?
No. Only content with the sensitivity labels you choose. Everything else keeps standard Microsoft encryption.
What keys are involved?
An AES-256 content key, protected by an RSA-2048 key. DuoKey generates and holds your key with multi-party computation, either on premises or as SaaS.