For BYOK, the key can create by our own service?

[pennyhoho117]

For BYOK, the key can create by our own service?

[v-aatheeque · Accepted solution]

Hi @pennyhoho117 

Yes, it's perfectly acceptable to use keys generated by your own system and import them into Azure Key Vault if needed. This practice is known as "Bring Your Own Key" (BYOK).

While Azure Key Vault is designed for secure key management, some services allow for BYOK options, enabling you to use your own keys for encryption and access control.

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[Poojara_D12 · Accepted solution]

Hi @pennyhoho117 

Yes, in Microsoft Fabric and Power BI, Bring Your Own Key (BYOK) allows organizations to use their own encryption keys—generated and managed via their own service—to encrypt data at rest, offering greater control over data security and compliance. These keys must be managed in Azure Key Vault, which acts as the trusted key store that Microsoft services can reference. While the key itself can be generated by your organization using your own internal service or security system, it must be uploaded to and managed through Azure Key Vault to be compatible with BYOK in Microsoft 365 services like Power BI or Fabric. Once configured, BYOK ensures that your tenant's sensitive data (e.g., data in workspaces, semantic models, etc.) is encrypted using your customer-managed key (CMK), and access to data becomes dependent on key availability, allowing you to revoke access by disabling or deleting the key. However, setting up BYOK requires strict compliance with Microsoft's prerequisites and should be coordinated with your security, compliance, and Azure administration teams.

[v-aatheeque]

Hi @pennyhoho117 ,

Thanks for reaching out to Microsoft Fabric Community Forum.

@Akash_Varuna Thanks for your prompt response.In addition to that :

Yes, you can create your own key for Bring Your Own Key (BYOK) scenarios.

In the context of Bring Your Own Key (BYOK), we can generate own encryption keys using various methods:

• Options to create and store your own key: Created in Azure Key Vault. Create and store your key in Azure Key Vault as an HSM-protected key or a software-protected key.
• Created on-premises. Create your key on-premises and transfer it to Azure Key Vault using one of the following options:
• HSM-protected key, transferred as an HSM-protected key. The most typical method chosen,While this method has the most administrative overhead, it may be required for your organization to follow specific regulations. The HSMs used by Azure Key Vault have FIPS 140 validation.
  
  

References :
Bring Your Own Key (BYOK) details - Azure Information Protection | Microsoft Learn

https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys-byok?tabs=azure-cli

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[v-aatheeque]

Hi @pennyhoho117 ,

If our response addressed by the community member for your query, please mark it as Accept Answer and click Yes if you found it helpful.

Should you have any further questions, feel free to reach out.
Thank you for being a part of the Microsoft Fabric Community Forum!

[v-aatheeque]

Hi @pennyhoho117 ,

If our response addressed by the community member for your query, please mark it as Accept Answer and click Yes if you found it helpful.

Should you have any further questions, feel free to reach out.
Thank you for being a part of the Microsoft Fabric Community Forum!

[v-aatheeque]

Hi @pennyhoho117 ,

Just checking in to see if you've made any progress with the information provided. If you found the guidance helpful, please click "Accept Answer" and "Yes" to the question "Was this answer helpful?"

And of course, if you have any further questions or need more assistance, feel free to reach out.

Thank you!

[pennyhoho117]

Hi, I means if we want to use our own keys generated by our own system, but not use the key generation from Azure Vault, is it ok?

[v-aatheeque · Accepted solution]

Hi @pennyhoho117 

Yes, it's perfectly acceptable to use keys generated by your own system and import them into Azure Key Vault if needed. This practice is known as "Bring Your Own Key" (BYOK).

While Azure Key Vault is designed for secure key management, some services allow for BYOK options, enabling you to use your own keys for encryption and access control.

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[v-aatheeque]

Hi @pennyhoho117 ,

Since we haven’t heard back from you for a while, we are planning to close this ticket. If you have any further questions or need assistance in the future, please don’t hesitate to reach out by opening a new ticket in the Fabric Community.

Thank you for being an active part of our community we’re always here to help!

[Akash_Varuna]

Hi @pennyhoho117 ,Yes you can create the encryption key using your own service, provided it supports integration with Azure Key Vault
If this post helped please do give a kudos and accept this as a solution
Thanks In Advance