Salesforce Docs Portal

Set Up and Manage Bring Your Own Key for Recover (Azure)

Set up, manage, and migrate Bring Your Own Key (BYOK) for enhanced data security in an Azure region.

Download the Own Public Key

Log in to your Own account as the account owner.

  1. Log in to your Own account as the account owner.
  2. At the top right of the screen, click on your username.
  3. In the drop-down menu, select Account Settings.
  4. Select the Key Management tab.
  5. Click Set Up BYOK...
  6. In the dialog box that appears, click Download Public Key.

Generate an Encrypted Key and Passphrase (Azure) Using the Sample Script

We provide a sample script which creates a 256-bit key and passphrase. The script is available for Linux and MacOS and you can download it from the same place you previously downloaded the certificate.

  1. Download the sample script:
    1. Log in to your account as the account’s owner.
    2. At the top right of the screen, click on your email address.
    3. In the drop-down menu, select Account Settings.
    4. Select the Key Management tab.
    5. Click Archive Current Key and Create New Key....
      In the dialog window that appears are instructions on how to download the certificate, as well as the actual script, that will help you generate a 256-bit key and passphrase. In the blue instructions area of the window, click the Download hyperlink to obtain the certificate from the application UI.
    6. Click the MacOS or the Linux hyperlink (as needed) to download and run the sample script and generate the required information.
  2. To generate the key and passphrase on a Mac-based machine:
    1. Open the terminal app, and modify the script file properties to be executable, by changing the text to: chmod +x secretgen-macos.sh.
    2. Run the script as sudo along with the certificate: ./secretgen-macos.sh akm_azure_ob_public.key.
  3. To generate the key and passphrase on a Windows-based machine:
    1. Download GIT for Windows.
    2. Install GIT on Windows using the installation wizard. Choose the default in all the steps.
      The most important value to select is OpenSSL library.
    3. Once GIT is installed, open the git-bash application.
    4. Within git-bash, open the terminal app, and modify the script file properties to be executable, by changing the text to: chmod +x secretgen-linux.sh
    5. Navigate to the directory where the two downloaded files are located (the sample script and relevant crt).
    6. In git-bash, launch the script. Make sure to have a ./ before the script and the crt target: For example: ./secretgen-linux.sh akm_azure_ob_public.key.

After running the script, the terminal app generates the key (as a separate .bin file) and passphrase and displays the output, which is the text string of the required passphrase, similar to the following:

Encrypted Passphrase:

PZHBYNgY+XI/n7l0b1j/E23IiV2gHFAwwzPZs1g1lnrX3Cjva7KkBrqOCk60tDLj PjtFLbOJgZ2s0MQdkNN60w417zsCe2ILjckB/cEnx6GynQ7Zs3EQZ80hMTWHVz9F 5Z1sfks869uZj8XN06e8NUOcLfA6MHR6X0fXIK/WqAhUql/E2HmV8wyWWlspbGhV s28rggZe0HFpAlug79XeJAuRmBRX7udoyUml3skCvlQcqDMtt/Rp+u0mCJBWMWVP P6v8HYsN7FcbvHYrZHPjAzag2YEUpEDOsSU27SbFx7CcDMmbmY7LE8rXw4vlsL2k v3DIgpryBeIb60OTt/uDm1QLwO7LWcjshN1pfIfig8POy/dL4diV88UKYYP2dGcQ 5VDR4FYjQU2qJCNZASp28xbex33g0ZgjuRVNIiNBdJZkwngS3KPGMxrrMFnU6WSd FYNJlpWBwmjTXLjjIYyyQFmuhJqd0ASPVaQtJ7VQ5ERxA2ZLynmkNNZ73M7bVVeK oQWomQXjgIxvkjsXJK08L/RVMznyin4DDddDazhzbiy4RuoKwcsYdDIHjQConBep 6+WFTknZQsYm5c1bfIB2WVkoQSy9KN8fs693FNpr12tkoWl/pjtKVVkWj8B2LVsO I1jf50zE/xrtXWcDsuMkiLXhWysZYJlsE104fzGo1f4=

Upload the Key and Passphrase

For newly created accounts, you must wait at least 10 minutes before attempting to add BYOK, otherwise the validation check may fail.

  1. Sign in to your account as the account’s owner.
  2. At the top right of the screen, click on your email address.
  3. In the drop-down menu, select Account Settings
  4. Select the Key Management tab. The Key Management screen appears.
  5. Click Set Up BYOK.... The Bring Your Own Key dialog window appears.
  6. Click Browse... next to the Wrapped Encryption Key field. Select and upload the key file.
  7. Copy the text string under the Encrypted Passphrase line from the terminal app, and paste it into the Encrypted Passphrase field in the dialog window.
  8. Click Validate Key. If the key is valid, a Completed Successfully message will appear in the dialog window.
  9. Click Activate.

Your key should appear in the table in resource creation status.

If the key supplied doesn't match the passphrase entered, the master encryption key activation will be canceled. Subsequently, a support case will be opened for you, and an email confirming the case will be sent.

Upon successful verification of the validity of the uploaded key against the passphrase supplied, your account data will be moved to a newly-created volume/bucket encrypted with that AES256bit master encryption key. Jobs and backups that were in progress may be interrupted during the migration to the newly encrypted volume/bucket. Once the process completes, you will receive a notification email.

Rotate the Master Encryption Key

Navigate to the Key Management tab, click the three dots menu.

  1. Navigate to the Key Management tab, click the three dots menu.
  2. Click Rotate.
  3. Repeat the upload steps with the new key and Passphrase.

Revoke an Active Master Encryption Key

When revoking a master encryption key: all access to data is immediately blocked; running backups and jobs will fail to complete; and future backups will not happen. More importantly, all data will be rendered inaccessible permanently.

  1. Log in to your account as the account owner.
  2. At the top right of the screen, click on your email address.
  3. In the drop-down menu, select Account Settings.
  4. Select the Key Management tab.
  5. Click the three dots menu, then Revoke. The Revoke key dialog window appears.
  6. To confirm the revocation, manually type the word "revoke" in the text field and click Revoke.

The Key Management screen displays the information that the key has been revoked.

Migrate from BYOK to BYOKV

With Bring Your Own Key Vault (BYOKV), you manage your keys within your own Azure Key Vault. By installing the Own Enterprise application in your Azure account and assigning a role to the application, you can create a storage account encrypted with your key without ever sending, accessing, or exposing the actual key.

The length of the migration process is dependent on the amount of data you have backed up and can take several weeks. Once the switch has started, it can't be stopped.

All data is still accessible and encrypted throughout the migration process.

Migration can only be done 48 hours after BYOK was activated.

  1. Sign in to your account as the account’s owner.
  2. At the top right of the screen, click on your email address.
  3. In the drop-down menu, select Account Settings.
  4. Select the Key Management tab.
  5. Click the three dots menu, then Switch to BYOKV.
  6. A warning message will appear. Accept and click Switch. The key will be in Activating... status in the table.