2.0.0 1.0.0
Auto Light Dark
Auto Light Dark
2.0.0 1.0.0
Breadcrumbs

Introduction

Enterprise Secure Key Manager (ESKM) can be used as an external key manager for
Microsoft Double Key Encryption (DKE) to provide enhanced data protection and key control.
In this setup, Microsoft manages one encryption key, and the second key is securely stored
and managed in ESKM by the organization.
When a user opens DKE-protected content in Microsoft 365, the DKE service connects to
ESKM to request access to organization’s key. ESKM authorizes the request and allows
decryption only if the organization approves it. This ensures that Microsoft cannot access
the protected data without the organizations consent.

image-20260317-094017.png


Azure DKE

Using ESKM as the external key manager allows organizations to:

  • Maintain full control over encryption keys.

  • Enforce internal security and access policies.

  • Meet compliance and data requirements.