---
schema_version: "1"
id: 1fac884b3e9b9dff6157691c3b147200a9206197aa9805547c4cbb7a1d5678be
title: Migrate from Customer-Managed Encryption Keys to External KMS
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/online/to_external_kms_migrate.md
canonical_url: https://help.tableau.com/current/online/en-gb/to_external_kms_migrate.htm
source_site: help.tableau.com
content_type: documentation
content_hash: bbdd7a4989ec2910518c8e50c25b6b55697c9b23c34e82045221640a8939742b
description: "Note: Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can’t be undone"
---
[Skip to main content](#main-content)

# Migrate from Customer-Managed Encryption Keys to External KMS

> [!WARNING]
> 
> **Note:** Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can’t be undone. For more information on using an external KMS, see [Use an External KMS for Key Management](https://help.tableau.com/current/online/en-gb/to_external_kms.htm).

Migrating from customer-managed encryption keys (which use Salesforce’s KMS) to an external KMS is simple, but it’s permanent and can’t be undone. After the change, you’ll manage your keys in the external KMS instead of Salesforce’s KMS. Be sure that you understand how to perform basic key functions in the external KMS before you migrate from customer-managed encryption keys to an external KMS.

After the migration, the key derived from the external KMS will write new extracts. The Salesforce KMS key will continue to read extracts that it wrote, until the extracts are refreshed with the external KMS-based key.

For more information on customer-managed encryption keys and the Salesforce KMS, see [Customer-Managed Encryption Keys](https://help.tableau.com/current/online/en-gb/to_customer_managed_encryption_keys.htm).

To migrate from customer-managed encryption keys to an external KMS:

1. Log in to your Tableau Cloud site.
2. Select Settings in the left navigation pane.
3. Select the Security tab.
4. Under the Extract Encryption section, change the selection from Use the Salesforce KMS to Use an external KMS.
5. Read the warning, then select Switch to External KMS.