Microsoft Purview: eDiscovery – CMK (Customer managed key) for eDiscovery direct export

Microsoft Purview eDiscovery Direct Export will support Customer-managed key (CMK) encryption for tenants with Data Encryption Policies via MDEP. Starting May 2026, export packages will be automatically encrypted with tenant-owned keys without changing the user experience. Enablement requires Microsoft Support assistance and proper CMK setup. To strengthen customer control over sensitive investigation data, Microsoft is extending Customer-managed key (CMK) protection to Microsoft Purview eDiscovery Direct Export. For tenants that have configured Data Encryption Policies (DEPs) using the Microsoft 365 Data-at-Rest Encryption Platform (MDEP), eDiscovery export packages will now be automatically encrypted using your organization’s CMK. This helps ensure exported investigation data remains protected under customer-controlled encryption policies throughout the export lifecycle, without changing the existing eDiscovery user experience. This message is associated with Microsoft 365 Roadmap ID 557684. When this will happen: Public Preview: We will begin rolling out early May 2026 and expect to complete by early June 2026. General Availability (Worldwide):  We will begin rolling out mid-June 2026 and expect to complete by mid-July 2026. How this affects your organization: Who is affected: Microsoft 365 tenants with Customer-managed keys enabled through Data Encryption Policies (DEPs), and request that Microsoft Support enable this feature for Purview eDiscovery Direct Export in their tenant Admins and investigators using Microsoft Purview eDiscovery Direct Export What will happen: eDiscovery Direct Export packages for CMK‑enabled tenants will be encrypted at rest using tenant‑owned keys. Encryption is applied automatically based on existing DEP configuration. CMK configuration is dynamically validated through MDEP at export time. No change to the eDiscovery user experience. Only enabled for specific tenants by request to Microsoft Support  What you can do to prepare: To use CMK encryption for eDiscovery Direct Export, your organization must complete the following steps: Configure Customer Key (self-service) Your Microsoft 365 administrator must have Customer Key enabled through the Microsoft 365 Data-at-Rest Encryption Platform (MDEP) with a DEP in PolicyAssigned status. This requires: Two Azure subscriptions dedicated to Customer Key Azure Key Vault(s) with RSA keys provisioned A DEP created and assigned to your tenant Follow the setup guidance here: Create two new Azure subscriptions | Microsoft Learn Request […]

The post Microsoft Purview: eDiscovery – CMK (Customer managed key) for eDiscovery direct export appeared first on M365 Admin.