---
schema_version: "1"
id: a98341c05ddb31932d161749bdfba36b77853fcff474fe622d45a3af7300298a
title: Migrate from Customer-Managed Encryption Keys to External KMS
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/online/to_external_kms_migrate.md
canonical_url: https://help.tableau.com/current/online/en-us/to_external_kms_migrate.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 08000d02f7ef84fe4a1eb6c18febb9009a8f945ca609971ae2c598c47e5b6023
description: "Note: Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can't be undone"
---
[Skip to main content](#main-content)

# Migrate from Customer-Managed Encryption Keys to External KMS

> [!WARNING]
> 
> **Note:** Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can't be undone. For more information on using an external KMS, see [Use an External KMS for Key Management](https://help.tableau.com/current/online/en-us/to_external_kms.htm).

Migrating from customer-managed encryption keys (which use Salesforce's KMS) to an external KMS is simple, but it's permanent and can't be undone. After the change, you’ll manage your keys in the external KMS instead of Salesforce's KMS. Be sure that you understand how to perform basic key functions in the external KMS before you migrate from customer-managed encryption keys to an external KMS.

After the migration, the key derived from the external KMS will write new extracts. The Salesforce KMS key will continue to read extracts that it wrote, until the extracts are refreshed with the external KMS-based key.

For more information on customer-managed encryption keys and the Salesforce KMS, see [Customer-Managed Encryption Keys](https://help.tableau.com/current/online/en-us/to_customer_managed_encryption_keys.htm).

To migrate from customer-managed encryption keys to an external KMS:

1. Log in to your Tableau Cloud site.
2. Select Settings in the left navigation pane.
3. Select the Security tab.
4. Under the Extract Encryption section, change the selection from Use the Salesforce KMS to Use an external KMS.
5. Read the warning, then select Switch to External KMS.