AWS XKS Encryption
Keep using AWS KMS in applications, while an external key store holds the authority Amazon lacks.
Product demo
Watch DuoKey for DKE Demo
Experience true data security for Microsoft 365
Protect board papers
Double Key Encryption keeps a second key outside Microsoft, so the most sensitive labelled content in Microsoft 365 cannot be opened by Microsoft alone.
Two keys, one outside Microsoft
Opening a DKE-protected file needs Microsoft's key and yours. Your key never sits in Azure.
Access decided by context
Every unwrap is checked against user, IP, location, time, Azure groups and MFA.
Rotation without relabelling
Rotate the second key with a configurable cache window, without creating new Purview labels.
Microsoft cannot open it alone.
A Purview sensitivity label protects the content twice. Azure RMS checks the user's rights, and the DuoKey DKE service checks the user before it unwraps your key.
- Works in Word, Excel, PowerPoint, Outlook and Adobe Acrobat.
- For the small labelled slice that must stay out of reach; Customer Key covers the rest.
Every unwrap is a decision.
Attribute-based policies evaluate each request before the second key is used, so a valid label is not enough on its own.
- User, IP range, country, time window, Azure group and MFA conditions.
- Every request recorded with who, from where and with what outcome.
Rotate the key, keep the labels.
Rotation keeps a configurable cache window so protected documents stay readable while the new key takes over, without a new Purview label.
- Automatic Azure app registration through Microsoft Graph.
- Partner domains and dedicated issuers for B2B and multi-tenant set-ups.
Your second key, split with MPC.
The DuoKey key is held as shards on independent nodes in a dedicated tenant and vault. No single node, operator or provider holds it whole.
- No HSM appliance to run for DKE.
- Keys in an HSM or software vault remain available in the same Cockpit.
Word / Excel / PowerPoint
Outlook
Adobe Acrobat
DuoKey DKE
Microsoft Purview
Entra ID
SharePoint / OneDrive
Where Double Key Encryption applies.
DKE protects labelled files and mail in the Microsoft 365 apps people already use. Features that need Microsoft to read the content, such as eDiscovery, search indexing and Copilot, do not work on DKE-protected items.
- Licensing: included with Microsoft 365 E5.
- Pair it with Customer Key for service encryption of everything else.
Key features
Contextual ABAC
User, IP, location, time, Azure groups and MFA on every key unwrap.
Rotation with continuity
Configurable cache window, no new Purview label needed.
Graph provisioning
Automatic Azure app registration through Microsoft Graph.
Multi-tenant and B2B
Partner domains and dedicated issuers.
MPC-distributed keys
A second key Microsoft cannot use alone, split across independent nodes.
Dedicated tenant and vault
Your second key in its own tenant and vault.
Start where your sensitive content is
Begin with one label for the content that must never leave your control, then extend.
Proof in practice
Where teams deploy this
Deep dives
Field guides for your programme
Compliance
Frameworks this product supports
Trust
Assurance and customer programmes
Customer programmes
Keep the last key to your most sensitive content.
See Double Key Encryption with contextual access on your own Microsoft 365 tenant.
Products
Related products
View product