1. Office 365 Customer Key Jaclynn Hiranaka Senior Program Manager
BRK3014
Office 365 Customer Key
Jaclynn Hiranaka
Senior Program Manager
Exchange
Kavita Kamani
Principal PM Manager
SharePoint and OneDrive
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Agenda 1 2 3 4 The promise of Service Encryption and Customer Key
How it all works 2
How you can onboard to customer key 3
How you exercise control over customer key 4

3. Meet compliance obligations that require encrypting data
Encryption in Office 365
Built-in capabilities that help control your data and mitigate risk
Protect
Mitigate risk of data loss through default and added customer controlled encryption capabilities
Control
Leverage flexible policies and added controls that help manage your data
Compliance
Meet compliance obligations that require encrypting data

4. What is “Service Encryption”
Additional defense in depth protection for customer data
Encryption at the application layer for Office 365 data at rest
Provides strong separation of Windows Server administrators and customer data
Effective regardless of Microsoft-managed or Customer-managed keys
What is “Service Encryption”

5. New! Service encryption with Customer Key
7/17/2018 5:00 AM
New! Service encryption with Customer Key
Helps meet compliance obligations that require you to provide and manage your own keys used to encrypt Office 365 data at-rest    
Customer in control over service’s ability to reason over your data when key is revoked-initiating path towards data deletion
Built into the service for seamless integration with no disruption to end user and added protections against unintended key loss
Auditable and verified. Actions are auditable and controls will be verified in an SOC audit
© Microsoft Corporation. All rights reserved.

6. Customer Key is NOT about
Changing the dynamics of the Online Service Terms for 3rd party data requests
Changing access rules for customer data for Microsoft personnel
Customer Key is NOT about

7. How does Customer Key work in SharePoint?
Customer Keys
In Azure Key Vault Service
One pair of keys per geography/tenant scoped
How does Customer Key work in SharePoint?
Tenant Intermediate Key
2 encrypted copies, each protected by one Customer Key
Site Encryption Key
Protected by Tenant Intermediate Key
File Chunk Encryption Key
(1 File = N chunks = N keys)
Protected by Site Encryption Key

8. How does Customer Key work in Exchange?

9. Protecting your keys
Use two Key Vaults in separate Azure subscriptions, in non-paired regions
Distributed ownership of each Key Vault
Enforcement of Key Vault setup and configuration
Microsoft provides a co-operative escrow model to protect against mishaps and attackers

10. What is Recovery Key
Provides industry leading availability -- Data protection advantage to our customers
Protects against ransomware and insider compromise that could threaten the destruction of customer data
Enforced diversity in key protection and destruction to protect against malicious or accidental data loss
Shared responsibility to protect keys -redundancy in key management
Ensures destruction of customer data is always intentional

11. How does the Recovery Key work in Exchange?
Jaclynn or Paul, can we get a high level graphic here

12. How does Recovery Key work in SharePoint?
Customer Keys
In Azure Key Vault Service
One pair of keys per geography/tenant scoped
Recovery Key – Microsoft Managed
In SPO Secret Store
One per tenant
How does Recovery Key work in SharePoint?
Tenant Intermediate Key
2 encrypted copies, each protected by one Customer Key
Tenant Intermediate Key
Another encrypted copy, protected by one Recovery Key
Site Encryption Key
Protected by Tenant Intermediate Key
Only used when a recovery process is needed due to unintentional customer key compromise (customer calls Microsoft, or Microsoft detects via alert and confirms with customer)
File Chunk Encryption Key
(1 File = N chunks = N keys)
Protected by Site Encryption Key

13. Onboarding to Customer Key
Customer determines business case
Customer purchases and assigns licenses to user objects
Customer sets up Azure Key Vaults
FastTrack onboarding for Customer Key Offer
Microsoft reviews data and Feature is enabled

14. Key Vault Set Up (common to Exchange and SharePoint)
Create two Azure subscriptions in your tenant, with two different sets of administrators
Put your Azure subscriptions on the Do Not Cancel list
Create a Key Vault in each subscription
Name your Key Vault uniquely and create/upload keys
Give permissions to EXO/SPO to wrapKey/unwrapKey/get

15. Azure Key Vault Setup 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Onboard via Fasttrack 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Exchange set up Admin creates a Data Encryption Policy
Assign DEP to mailboxes
Initiate mailbox move to encrypt mailboxes
Status check
Exchange set up

20. 7/17/2018 5:00 AM
Exchange Setup
Demonstrate Data Encryption Policy creation and assignment
Status check on pre-encrypted mailbox
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. SharePoint set up
Admin creates tenant-wide encryption (Register-SPODataEncryptionPolicy)
Status check

23. 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. SharePoint Setup Demonstrate encryption policy creation and assignment
7/17/2018 5:00 AM
SharePoint Setup
Demonstrate encryption policy creation and assignment
Status check on pre-configured tenant
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Rolling Keys
Business or compliance needs may require you to roll keys at some regular cadence
Create new key versions, and update the policy
Exchange: Run Set-DataEncryptionPolicy <DEP name> -Refresh
SharePoint: Run Update-SPODataEncryptionPolicy
Check encryption status
Exchange: Run Get-MailboxStatistics
SharePoint: Run Get-SPODataEncryptionPolicy

26. Data Purge Path
Remove SPO/EXO ID permissions on Key Vaults (Azure Administrators)
Set the Purge Request flag using PowerShell
Send in the signed and notarized Data Deletion Document
Microsoft deletes the Recovery Key
All data that falls under that policy is unrecoverable

27. Exchange Revocation Demonstrate Key Unavailable Experience
7/17/2018 5:00 AM
Exchange Revocation
Demonstrate Key Unavailable Experience
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. A mailbox under a DEP where both Customer Keys are unavailable

29. SharePoint Revocation
7/17/2018 5:00 AM
SharePoint Revocation
On an already revoked tenant, demonstrate user experience
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. Recap and Key Takeaways
Value of Service Encryption and Customer Key 1
How to onboard 2
How to exercise revocation 3
Microsoft’s commitment and your recovery options 4

31. Resources Technical Documents to get started Customer Key FAQ
7/17/2018 5:00 AM
Resources
Technical Documents to get started 
Customer Key FAQ
Encryption in the Microsoft Cloud Whitepaper  
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

32. Other recommended sessions
7/17/2018 5:00 AM
Other recommended sessions
Title
Time
SaaS Encryption: lies, damned lies, and hard truths
Thursday, September 28 2:00 PM - 2:45 PM OCCC West Hall F3-4
Implementing Bring Your Own Key with Azure Information Protection and Azure Key Vault
Hands on Labs Room
Encryption key management strategies for compliance
Thursday, September 28 10:15 AM - 11:00 AM OCCC W240
Protect and control your sensitive s with new Office 365 Message Encryption capabilities
Tuesday, September 26 4:00 PM - 5:15 PM OCCC West Hall B4
Taming the Beast - How We Secure the World's Largest Enterprise Cloud Service
Wednesday, September 27 4:30 PM - 5:15 PM OCCC W205
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. Please evaluate this session
Tech Ready 15
7/17/2018
Please evaluate this session
From your
Please expand notes window at bottom of slide and read. Then Delete this text box.
PC or tablet: visit MyIgnite
Phone: download and use the Microsoft Ignite mobile app
Your input is important!
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

34. 7/17/2018 5:00 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.