Manage encrypted keys in Power BI Premium

[Anonymous]

Hi,

The security whitepaper http://go.microsoft.com/fwlink/?LinkId=829185 shows a key vault in the architecture for Power BI premium. Is this a custom managed key vault? If yes, does the key vault contain encrypted keys to encrypt the blob storage and the sql database? 

Regards,

Klaus

[v-qiuyu-msft]

Hi @Anonymous,

You can see this section in white paper which you mentioned: 

Encryption Keys
• The encryption keys to Azure Blob keys are stored, encrypted, in Azure Key Vault.
• The encryption keys for Azure SQL Database TDE technology is managed by Azure SQL itself.
• The encryption key for Data Movement service and on-premises data gateway are stored:
   o In the on-premises data gateway on customer’s infrastructure – for on-premises data sources
   o In the Data Movement Role – for cloud-based data sources

Best Regards,
Qiuyun Yu 

[Anonymous]

Hi Qiuyun,

Thanks. What does it mean in detail for compliance issues?

Are the keys in Azure Key Vault owned and managed by the customer?

If the keys for Azure SQL Database TDE technology is managed by Azure SQL, could Microsoft get access to the business data of the customer in the SQL Database?

Regards,

Klaus

[v-qiuyu-msft]

Hi @Anonymous,

I have consulted this issue internally, will update here once I get any information. 

Best Regards,
Qiuyun Yu 

[v-qiuyu-msft]

Hi @Anonymous,

You can see this in the whitepaper: "Regardless of the encryption method used, Microsoft manages the key encryption on customer's behalf, in either a secret store or in Azure Key Vault.". 

Besides, data and data center access are well protected: Power BI abides by the Microsoft Online Services Terms and Data Processing Terms. 

Best Regards,
Qiuyun Yu