1654 - How to switch your company KMS to Azure Key Vault

This article shows you how to switch your company from CyberSentriq-managed encryption to encryption using your own Azure Key Vault, enabling you to hold the master key that protects your backup encryption keys.

PAGE CONTENTS

• Before you begin
  • What your IT / Azure admin needs to prepare
  • Assigning the Key Vault Crypto User role to the CyberSentriq service principal
  • What you need in RedApp
• How to switch to Azure Key Vault
• Verifying your tenants
• Common issues
• What to do next

Before you begin

What your IT / Azure admin needs to prepare

1. An Azure Key Vault in your Azure tenant containing an RSA key (this must be a key and not a secret, which refers to a different concept in Azure).
2. Someone with the Global Administrator or Privileged Role Administrator role in Microsoft Entra ID, available to grant tenant-wide admin consent during setup.
3. After consent is granted, the Azure admin must assign the Key Vault Crypto User role to the CyberSentriq KMS Connector service principal on the vault (see the steps below).
4. Two values to paste into RedApp:
   • Vault URI: a URI in the format https://your-vault-name.vault.azure.net/
   • Key Name: the name of the RSA key inside the vault (not the full URL)

Assigning the Key Vault Crypto User role to the CyberSentriq service principal

Once admin consent is granted in RedApp as part of KMS setup (see Article 1651), a service principal called CyberSentriq KMS Connector will appear in your Azure tenant. The service principal can be found by searching for it in Entra ID > Enterprise applications.

Your Azure admin must now assign this service principal the Key Vault Crypto User role on your Key Vault, using either the Azure CLI or the Azure Portal. Instructions for both can be found below.

Azure CLI:

# Get the service principal object ID by display name
SP_OBJECT_ID=$(az ad sp list --display-name "CyberSentriq KMS Connector" --query "[0].id" -o tsv)

# Assign Key Vault Crypto User role scoped to the vault
az role assignment create \
  --assignee-object-id "$SP_OBJECT_ID" \
  --assignee-principal-type ServicePrincipal \
  --role "Key Vault Crypto User" \
  --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.KeyVault/vaults/<vault-name>"

Replace <subscription-id>, <resource-group>, and <vault-name> with your own values.

Azure Portal:

1. In the Azure Portal, search for and open Key Vaults, then select your vault.
2. In the left menu, select Access control (IAM).
3. Click + Add > Add role assignment.
4. On the Role tab, search for Key Vault Crypto User and select it. Click Next.
5. On the Members tab:
   • Set Assign access to = User, group, or service principal.
   • Click + Select members.
   • Search for CyberSentriq KMS Connector.
   • Select the service principal from the results and click Select.
6. Click Review + assign twice to confirm.
7. Verify the assignment appears in the Role assignments tab under Key Vault Crypto User.

What you need in RedApp

• You are signed in as a Partner Admin or Company Admin.
• Your company has an active encryption provider (CyberSentriq-managed, AWS KMS, or another customer-managed vault). You can switch directly to Azure Key Vault from any provider.

How to switch to Azure Key Vault

A summary of the steps for switching to Azure Key Vault is provided below. For more detailed instructions, see Article 1651.

1. In RedApp, open Key Management and choose Manage KMS. Confirm the current provider shows as CyberSentriq-Managed.
2. Choose Switch to Azure Key Vault.
3. Enter your Vault URI and Key Name, then Click Test Connection. RedApp redirects your Global Administrator (or Privileged Role Admin) to Microsoft's sign-in and consent page. The admin signs in and approves CyberSentriq's access to your tenant. This creates the CyberSentriq KMS Connector service principal in your Azure tenant.
4. Your Azure admin then assigns the Key Vault Crypto User role to the CyberSentriq KMS Connector service principal on your Key Vault or the individual key itself (this is only done once, in Azure — see the steps in the prerequisites section above).
5. Back in RedApp, click Completed on the popup once. Wait for the green success confirmation before continuing.
6. Click Save. RedApp shows the list of Microsoft 365 and Google Workspace tenants found in your backup sets — each one must be verified before the switch can finish.
7. Verify each discovered tenant (see the next section).
8. When every tenant is verified, RedApp automatically finishes the switch: your backup encryption keys are re-protected with your Azure Key Vault key, and the KMS status flips to Azure Key Vault.

Verifying your tenants

Before RedApp can switch your encryption, it needs to confirm you actually own every Microsoft 365 or Google Workspace tenant that appears in your backup sets. This protects your data from being re-keyed by an unauthorised party. 

• Microsoft 365 tenants are verified by having a Global Administrator or Privileged Role Administrator grant admin consent. To check a user's role: sign into the Microsoft Entra admin center, go to Users > All users, select the user, and look under Assigned roles.
• Google Workspace tenants are verified by having a Super Admin authorise CyberSentriq. Delegated admins will not work. To check a user's role: sign into the Google admin center and go to Account > Admin roles > Super Admin.

If a new backup set is added during the KMS setup, its tenant will show up as unverified on the list of tenants. You will need to also verify this tenant before the switch can complete.

Common issues

What to do next

Once the switch completes, you will have one opportunity to export a copy of your company encryption key without having to re-verify your tenants. If you'd like an off-platform copy for safe-keeping, export the encryption key now by following the steps in Article 1655.