What's New: Customer-Managed Encryption Key & Lockbox (2024 release wave 2)

Overview

The video walks through encrypting Business Central and Power Platform environment databases with a key the customer manages in their own Azure Key Vault, instead of a Microsoft-managed key. It starts with linking a Business Central environment to a Power Platform environment in the Business Central admin center, since the encryption key and lockbox settings are inherited through that link.

It then covers the Azure side: a key vault with soft delete and purge protection, an RSA 2048 key, and an enterprise policy resource with the right role assignment. It closes with downtime during re-encryption, licensing requirements, separation of administrator duties, and how copy, restore, and export behave.

Key points

• A Business Central environment must be linked to a Power Platform managed environment to use a customer-managed key. There is no way to set it up without linking.
• You link environments from the environment details page in the Business Central admin center. The Power Platform environment must be in the same region and of the same type (the example is US and production). Customer-managed key and lockbox settings are inherited through the link.
• If customer-managed key is already enabled on the linked Power Platform environment, Business Central inherits it automatically.
• Setup in Azure: create a Key Vault with soft delete and purge protection enabled and an RSA key of size 2048. Then create an enterprise policy in the same region as the environments and give it the Key Vault Crypto Service Encryption User role assignment.
• An environment administrator for Power Platform environments gets the Reader role on the enterprise policy. They then apply it to the linked environment in the Power Platform admin center.
• Expect some downtime on Business Central and Power Platform environments after the final setup step, while the data is re-encrypted with your own key.
• Unlinking reverts Business Central to a Microsoft-managed encryption key. Copied or restored environments get a Microsoft-managed key and must be linked to a different Power Platform environment to apply the policy. Exported bacpac files are not encrypted with the customer-managed key.

Features

Every feature below: status not stated.

Quotes

• 0:06 “these settings help you secure your environments if you have very advanced”
• 2:51 “after completing this last setup step there could be some downtime on your business center and Power Platform environments”
• 3:31 “if you unlink your environments the business Central environment will revert back to a Microsoft manage encryption key”
• 3:51 “there’s a risk of internal malicious actors if a single administrator has access to all aspects of setting up”
• 3:51 “therefore we recommend that you separate these duties between different persons”
• 4:52 “creates a backpack file in your own storage this backpack file is also not encrypted with the customer manag”

Disclaimers in the video

• 3:11 other: the linked Power Platform managed environment is required so there’s no way to set this up for business Central environment without linking
• 3:31 other: there are specific licensing requirements in Microsoft 365 and Power Platform and these will apply to your business Central environments