SafeNet Luna Key Broker for Microsoft DKE

For organizations that demand absolute control over their encryption keys in Microsoft 365, the SafeNet Luna Key Broker for Microsoft DKE stands apart from generic key management tools. It integrates directly with Microsoft Double Key Encryption, ensuring that sensitive data remains inaccessible even to cloud service providers. Built on FIPS 140-2 Level 3 validated hardware security modules, this solution delivers hardware-grade key protection, enabling compliance with strict data sovereignty regulations while maintaining seamless user workflows.

Highlights

• Customer-managed keys for Microsoft DKE, ensuring full control over data access.
• Hardware-secured key storage in tamper-resistant SafeNet Luna HSMs.
• FIPS 140-2 Level 3 validated cryptographic boundary for maximum trust.
• Supports Microsoft Purview Information Protection, Exchange Online, SharePoint Online, and OneDrive for Business.
• Flexible deployment: on-premises with Luna Network HSMs or cloud via Thales Luna Cloud HSM.
• Comprehensive key lifecycle management: generation, rotation, and destruction.
• High availability and scalability for enterprise workloads.

In daily use

The Luna Key Broker operates transparently in the background, enforcing DKE policies without disrupting user productivity. Administrators manage keys through a centralized interface with multi-factor authentication, while detailed audit logs provide visibility into every key operation. Whether deployed in a private data center or a hybrid cloud environment, the broker ensures that encrypted content remains protected against unauthorized access, even from privileged insiders. Its support for PKCS#11 and KMIP APIs allows integration with existing enterprise key management workflows, reducing operational overhead and accelerating compliance initiatives.

Full specifications

• Solution type: Cryptographic Key Broker & Management Solution
• Primary integration: Microsoft Double Key Encryption (DKE)
• Supported Microsoft services: Microsoft 365 (Exchange Online, SharePoint Online, OneDrive for Business), Azure Information Protection (AIP), Microsoft Purview Information Protection
• Underlying HSM platform: Thales SafeNet Luna Network HSMs or Thales Luna Cloud HSM
• HSM security level: FIPS 140-2 Level 3 validated
• Key management: Customer-managed keys for DKE
• Key storage: Hardware-secured, tamper-resistant
• Key lifecycle management: Generation, storage, usage, rotation, and destruction
• API support: PKCS#11, KMIP, Microsoft DKE API
• Deployment options: On-premise (with physical Luna HSMs) or Cloud (via Thales DPoD/Luna Cloud HSM)
• High availability: Redundant key services for continuous operation
• Scalability: Enterprise-grade for large deployments
• Auditing & logging: Comprehensive audit trails of all key operations
• Compliance facilitation: Supports GDPR, HIPAA, CCPA, PCI DSS
• Authentication: Multi-factor authentication for key access and administration
• Supported cryptographic algorithms: RSA, ECC, AES, SHA (via underlying HSMs)
• Operating system compatibility: Windows Server, Linux (specific versions depend on deployment)
• Licensing model: Subscription-based or perpetual license

Final note

The SafeNet Luna Key Broker for Microsoft DKE is the definitive answer for enterprises that refuse to compromise on data privacy. By combining military-grade hardware security with seamless Microsoft integration, it empowers organizations to embrace the cloud without relinquishing control of their most critical asset: their encryption keys.