What's New: Customer-Managed Encryption Key (2025 release wave 1)

Overview

The video, from the 2025 release wave 1 What’s New series, presents CMK for Business Central. It targets customers with advanced data governance needs who want to encrypt the environment database with their own key instead of a Microsoft-managed key.

It walks through the setup: create a Key Vault and key in the Azure portal, enable the Power Platform resource provider, deploy an Enterprise Policy resource, assign access roles, set up CMK in the Power Platform admin center, and link the Business Central environment. It closes with considerations on licensing, unlinking, copy, restore, export and separation of duties.

Key points

• CMK works only on managed Power Platform environments linked to the Business Central environment. Managed environments need Microsoft 365 and Power Platform licensing beyond the Business Central license.
• The Key Vault region must match the Business Central environment region, and purge protection must be enabled on any Key Vault holding a key used to encrypt an environment database. Other optional Key Vault and key settings are not required.
• The microsoft.powerplatform resource provider is not enabled by default on an Azure subscription. Register it before deploying the Enterprise Policy resource from the custom template sample in the Power Platform documentation.
• The Enterprise Policy location must match the region of the Power Platform and Business Central environments, and the key ID must match the ID of the key resource containing the encryption key.
• Grant the Power Platform admin user the Reader role on the Enterprise Policy, and assign the Key Vault Crypto Service Encryption User role on the Key Vault to the Enterprise Policy’s managed identity (Power Platform type).
• In Power Platform admin center, go to Security > Data and privacy > Customer managed encryption key, edit the policy and add the environment. Encryption starts right away and may take time, so apply it when the environment can be down.
• Business Central environments inherit CMK from their linked Power Platform environment. Linking requires the BC environment to be unlinked elsewhere, in the same region, and of the same type (e.g. both production).

Features

Quotes

• 0:05 “this is a new functionality that uh delivers on a need that we frequently hear from customers with very Advanced uh data governance uh”
• 0:46 “the perge protection this must be enabled on key vaults that contain a key um that will be used to encrypt your environment database”
• 2:47 “the loc must match the location of your power platform and your business central environment”
• 4:37 “I look for the key crypto service encryption user role select that role and then select the managed identity member to assign it to”
• 5:37 “cmk only works on managed environments”
• 6:53 “business Central environments inherit the cmk setting from their linked by platform environment”
• 7:47 “if you unlink your environment after applying cmk your business and for environment will automatically revert to a Microsoft manage encryption key”
• 7:47 “if you copy or restore your environment um while it is encrypted with cmk you create a new environment that will not by default”
• 8:28 “and that is required for ck to work to use a managed environment this comes with”
• 8:48 “in the real word is important to uh separate the duties in setting this up between different users you’d use a key administrator for”

Disclaimers in the video

• 6:33 subject-to-change: review the warning here which warns me that this will start encrypting the database right away which may take some time to complete so make sure that you apply this at a time that the environment can be down while it’s being encrypted