You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: power-platform/admin/manage-encryption-key.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -130,15 +130,15 @@ Use this procedure to set the manage key feature the first time for an environme
130
130
2. Select **Create**, and then select the created file notification on your browser.
131
131
3. The encryption key .PFX file is downloaded to your web browser's default download folder. Save the file in a secure location (we recommend that this key is backed up along with its password).
132
132
133
-
To perform this task using PowerShell, see [Get-CRMGenerateProtectionkey](/powershell/module/microsoft.xrm.onlinemanagementapi/Get-CrmGenerateProtectionKey?view=dynamics365ce-ps) and [Set-CrmTenantProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmtenantprotectionkey?view=dynamics365ce-ps).
133
+
<!--To perform this task using PowerShell, see [Get-CRMGenerateProtectionkey](/powershell/module/microsoft.xrm.onlinemanagementapi/Get-CrmGenerateProtectionKey?view=dynamics365ce-ps) and [Set-CrmTenantProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmtenantprotectionkey?view=dynamics365ce-ps).-->
134
134
135
135
#### Upload a key (.pfx or .byok)
136
136
1. Select **Upload the Key**, select the .pfx or .byok<sup>1</sup> file, and then select **Open**.
137
137
2. Enter the password for the key, and then select **Create**.
138
138
139
139
<sup>1</sup> For .byok encryption key files, make sure you use the subscription ID as shown on the screen when you export the encryption key from your local HSM. More information: [How to generate and transfer HSM-protected keys for Azure Key Vault](/azure/key-vault/key-vault-hsm-protected-keys).
140
140
141
-
To perform this task using PowerShell, see [New-CRMImportProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/new-crmimportprotectionkey?view=dynamics365ce-ps) and [Set-CrmTenantProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmtenantprotectionkey?view=dynamics365ce-ps).
141
+
<!--To perform this task using PowerShell, see [New-CRMImportProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/new-crmimportprotectionkey?view=dynamics365ce-ps) and [Set-CrmTenantProtectionKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmtenantprotectionkey?view=dynamics365ce-ps).-->
142
142
143
143
> [!NOTE]
144
144
> To reduce the number of steps for the administrator to manage the key process, the key is automatically activated when it is uploaded the first time. All subsequent key uploads require an additional step to activate the key.
@@ -159,7 +159,7 @@ Once the key is activated, the following occurs:
159
159
- All encrypted environments automatically get encrypted with the active key (there is no downtime with this action).
160
160
- When activated, the encryption key will be applied to all environments that are changed from Microsoft-provided to self-managed encryption key.
161
161
162
-
To perform this task using PowerShell, see [Set-CrmProtectWithTenantKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmprotectwithtenantkey?view=dynamics365ce-ps).
162
+
<!--To perform this task using PowerShell, see [Set-CrmProtectWithTenantKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmprotectwithtenantkey?view=dynamics365ce-ps).-->
163
163
164
164
> [!IMPORTANT]
165
165
> To streamline the key management process so that all environments are managed by the same key, the active key can't be updated when there are locked environments. All locked environments must be unlocked before a new key can be activated. If there are locked environments that don't need to be unlocked, they must be deleted.
@@ -191,7 +191,7 @@ By default, each environment is encrypted with the Microsoft-provided encryption
191
191
1. For production environments, confirm the environment by entering the environment's name.
192
192
2. Select **Confirm** to return to standard encryption key management.
193
193
194
-
To perform this task using PowerShell, see [Set-CrmProtectWithMicrosoftKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmprotectwithmicrosoftkey?view=dynamics365ce-ps).
194
+
<!--To perform this task using PowerShell, see [Set-CrmProtectWithMicrosoftKey](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmprotectwithmicrosoftkey?view=dynamics365ce-ps).-->
195
195
196
196
#### Lock the tenant
197
197
Since there is only one active key per tenant, locking the encryption for the tenant *disables all the environments* that are in the tenant. All locked environments remain inaccessible to everyone, including [!INCLUDE[cc_Microsoft](../includes/cc-microsoft.md)], until a Power Platform admin in your organization unlocks it by using the key that was used to lock it.
@@ -214,7 +214,7 @@ Since there is only one active key per tenant, locking the encryption for the te
214
214
4. On the right pane select **Upload active key**, browse to and select the key, enter the password, and then select **Lock**.
215
215
5. When prompted, enter the text that is displayed on your screen to confirm that you want to lock all environments in the region, and then select **Confirm**.
216
216
217
-
To lock a tenant using the PowerShell cmdlet, see [Set-CrmLockTenantProtectedInstances](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmlocktenantprotectedinstances?view=dynamics365ce-ps).
217
+
<!--To lock a tenant using the PowerShell cmdlet, see [Set-CrmLockTenantProtectedInstances](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmlocktenantprotectedinstances?view=dynamics365ce-ps).-->
218
218
219
219
#### Unlock locked environments
220
220
To unlock environments you must first [upload](#upload-a-key-pfx-or-byok) and then [activate](#activate-an-encryption-key-for-a-tenant) the tenant encryption key with the same key that was used to [lock the tenant](#lock-the-tenant). Please note that locked environments do not get unlocked automatically once the key has been activated. Each locked environment has to be unlocked individually.
@@ -252,7 +252,7 @@ To unlock environments you must first [upload](#upload-a-key-pfx-or-byok) and th
252
252
5. Select **Confirm** to confirm that you want to unlock the environment.
253
253
6. Repeat the previous steps to unlock additional environments.
254
254
255
-
To unlock an environment using the PowerShell cmdlet, see [Set-CrmUnlockTenantProtectedInstance](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmunlocktenantprotectedinstance?view=dynamics365ce-ps).
255
+
<!--To unlock an environment using the PowerShell cmdlet, see [Set-CrmUnlockTenantProtectedInstance](/powershell/module/microsoft.xrm.onlinemanagementapi/set-crmunlocktenantprotectedinstance?view=dynamics365ce-ps).-->
256
256
257
257
258
258
## Environment database operations
@@ -281,7 +281,7 @@ A customer tenant can have environments that are encrypted using the Microsoft m
281
281
> When an encryption key is activated or changed, all administrators receive an email message alerting them of the change. This provides a means to allow other administrators to verify and confirm that the key was updated by an authorized administrator. Since it takes time to activate the key and to encrypt all the environments, and to send out the email notification, an encryption key can only be updated once every 24 hours.
0 commit comments