---
schema_version: "1"
id: 860501c47404dfc3de21e2b5005542ab5788d08d07dfce34e41fdacca4dd7443
title: Migrate from Customer-Managed Encryption Keys to External KMS
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/to_external_kms_migrate.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/to_external_kms_migrate.htm
source_site: help.tableau.com
content_type: documentation
content_hash: da3d5b538409fc59d385f7952f5fc0df524b65e800267923abfce674c0748332
description: "Note: Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can't be undone"
---
[Skip to main content](#main-content)

# Migrate from Customer-Managed Encryption Keys to External KMS

> [!WARNING]
> 
> **Note:** Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can't be undone. For more information on using an external KMS, see [Use an External KMS for Key Management](https://help.tableau.com/v0.0/online/en-us/to_external_kms.htm).

Migrating from customer-managed encryption keys (which use Salesforce's KMS) to an external KMS is simple, but it's permanent and can't be undone. After the change, you’ll manage your keys in the external KMS instead of Salesforce's KMS. Be sure that you understand how to perform basic key functions in the external KMS before you migrate from customer-managed encryption keys to an external KMS.

After the migration, the key derived from the external KMS will write new extracts. The Salesforce KMS key will continue to read extracts that it wrote, until the extracts are refreshed with the external KMS-based key.

For more information on customer-managed encryption keys and the Salesforce KMS, see [Customer-Managed Encryption Keys](https://help.tableau.com/v0.0/online/en-us/to_customer_managed_encryption_keys.htm).

To migrate from customer-managed encryption keys to an external KMS:

1. Log in to your Tableau Cloud site.
2. Select Settings in the left navigation pane.
3. Select the Security tab.
4. Under the Extract Encryption section, change the selection from Use the Salesforce KMS to Use an external KMS.
5. Read the warning, then select Switch to External KMS.