Microsoft 365 Customer Key: Service Encryption with Customer Key

Microsoft 365 already encrypts data at rest with BitLocker and Distributed Key Manager. Windows 365 Enterprise and Business Cloud PC disks use Azure Storage server-side encryption. Service encryption with Customer Key is the extra layer: you control the root encryption keys, and Microsoft 365 uses them, with keys Microsoft still holds, to encrypt Exchange, SharePoint, OneDrive, Teams and Windows 365 Cloud PCs. (Microsoft Learn: Customer Key overview)

People search for this under several names: Microsoft 365 Customer Key, Office 365 Customer Key, service encryption with customer key, and Microsoft 365 BYOK. They are the same Microsoft feature. It is not Double Key Encryption.

---

Table of Contents

1. What Customer Key adds
2. Which workloads a data encryption policy covers
3. Who can decrypt in normal operation
4. What revocation does
5. Customer Key and Double Key Encryption
6. Where DuoKey fits
7. FAQ

---

What Customer Key adds

Customer Key sits at the application layer, on top of disk encryption in Microsoft's data centres. Microsoft's description of the control is specific: it lets you control the root encryption keys, and you explicitly authorise Microsoft 365 to use those keys for eDiscovery, anti-malware, anti-spam, search indexing and similar services. (Microsoft Learn: Customer Key overview)

Two boundaries follow from that page:

• Customer Key encrypts data at rest in the cloud. It does not protect on-premises mailboxes or files.
• The encryption hierarchy uses keys you manage and an availability key that Microsoft protects.

Licensing is per workload. Microsoft publishes the prerequisites separately. This page does not restate SKUs.

---

Which workloads a data encryption policy covers

A data encryption policy (DEP) is the object you create, with PowerShell, and assign. Microsoft documents three kinds. (Microsoft Learn: Customer Key overview)

SharePoint and OneDrive are not covered by the multi-workload DEP. They need the SharePoint DEP. Teams files saved into SharePoint follow that SharePoint policy. Teams Live Events, Viva Engage and Planner are outside these DEPs.

For Exchange, assigning a DEP rewraps existing encrypted mailboxes on next access. For Exchange and Teams under a multi-workload DEP, Microsoft's note on timing differs by service: Exchange covers existing and new data, and some other services encrypt new data from the assignment onward. Read the workload note on Microsoft's page before you tell an auditor the history is covered.

---

Who can decrypt in normal operation

This is the point that gets overstated.

Customer Key is BYOK for service encryption. Microsoft 365 services decrypt content during normal operation, which is why search, eDiscovery and the rest keep working. Each DEP includes an availability key Microsoft protects. Your root keys improve governance and give you a revocation path. They do not remove Microsoft from the decryption path while the service is running. (Hold Your Own Key guide, Microsoft Learn: Customer Key overview)

If the requirement is that Microsoft cannot read a document on its own, the Microsoft feature for that is Double Key Encryption, applied to a sensitivity label. Customer Key will not meet that test.

---

What revocation does

Microsoft documents the exit in one sentence: revoking access to your keys triggers deletion of the availability key, which results in cryptographic deletion of your data. You can also ask Microsoft to purge specific DEPs when you leave the service. (Microsoft Learn: Customer Key overview)

That is a leave-the-service control. It is not a per-document deny. Plan for it as a purge, with the availability consequences Microsoft describes, and test it only on a scope you can afford to lose.

---

Customer Key and Double Key Encryption

The longer decision guide is DKE vs Microsoft 365 Customer Key.

---

Where DuoKey fits

DuoKey supplies the key service on the Customer Key path, with MPC-backed custody of the customer keys, key lifecycle and an audit of key use. (DuoKey for Customer Key)

That changes who holds your root key material and who can authorise its use. It does not change Microsoft's Customer Key design: the availability key, and the services you authorise, remain part of the feature. Read the product page next to this explanation, and use DKE when the threat model requires a key Microsoft cannot use.

---

FAQ

What is service encryption with Customer Key?

It is Microsoft's name for the Customer Key layer on top of BitLocker and Distributed Key Manager. You supply root keys. Microsoft 365 uses them, together with an availability key Microsoft protects, to encrypt supported cloud workloads at rest.

Is Office 365 Customer Key the same as Microsoft 365 Customer Key?

Yes. Current Microsoft documentation uses Microsoft 365 Customer Key and "service encryption with Customer Key" for the same feature. Older pages still say Office 365.

Is Microsoft 365 BYOK the same thing?

For Microsoft 365 service encryption, BYOK refers to this Customer Key path: you bring root keys, and the service decrypts in normal operation. Hold Your Own Key, in Microsoft's model, is Double Key Encryption. (HYOK guide)

Does Customer Key cover on-premises Exchange?

No. Microsoft states that Customer Key encrypts only data at rest in the cloud.

Which DuoKey product is this?

Service Encryption for Microsoft 365. DKE is a separate product: Microsoft 365 Double Key Encryption.