---
schema_version: "1"
id: 48d813e121a8a0a487440157dfccd41a6a353c035ad89d9ad454fa71b407a8f1
title: Revoke an Encryption Key
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_revoke_byok.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_revoke_byok.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e729e0f0b8f02e06c84218259046066500939754882d23ba645250560455fd67
description: When you revoke an active key, Marketing Cloud Engagement deletes the key and you can't log in to your account. Nobody can access the data in your database after revocation.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Revoke an Encryption Key

When you revoke an active key, Marketing Cloud Engagement deletes the key and you can't log in to your account. Nobody can access the data in your database after revocation.

Save the KeyID, restore token, original RSA 2048 private key, wrapped AES wrapping key, and the wrapped RSA key value used during the key import process. To regain access to your account and your data, use the Restore app to restore the revoked key within two weeks of revoking it. Downtime due to key revocation doesn’t count against any applicable SLA for uptime.

To restore the key, keep a copy of the existing key at the time of revocation and provide that exact value. Keep this value in a safe, secure location. If you can’t provide the exact key value for restoration, all accounts in your organization and all of your data in those accounts remain inaccessible.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png)

Note

This feature is a limited availability program. Contact your account executive for more information about participation in this program. Data at Rest Encryption is a prerequisite for this feature.

1. Hover over your name and click **Setup**.
2. Type Bring Your Own Key in the search field and click **Bring Your Own Key**.
3. Click **Revoke**.
4. Copy the KeyID and the Restore Token values to a separate file. You need these values, in addition to the wrapped AES wrapping key and the wrapped RSA key value, to restore the key. Ensure that you keep these values in a safe place.
5. Review the warning information about the revocation process.
6. Enter the requested phrase and click **Revoke and Disable Account**.
    
    To bring a database online, you must restore the revoked key within two weeks. You can’t restore a key after two weeks elapse.

If revocation is successful, you’re logged out and unable to access your account.