dataEncryptionPolicies

Customer Key Encryption. Customer Key data-at-rest encryption policies for mailbox content. The dataEncryptionPolicies entity set lives under /exchange/v1.0/dataEncryptionPolicies in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/dataEncryptionPolicies`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-DataEncryptionPolicy, New-DataEncryptionPolicy, Set-DataEncryptionPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/dataEncryptionPolicies`	List mailbox data-encryption policies (CMK BYOK for mailbox data, Azure Key Vault references).	`OrganizationConfig.Read`	Community
POST	`/exchange/v1.0/dataEncryptionPolicies`	POST /dataEncryptionPolicies - create a per-mailbox Customer Key encryption policy. Required: name + azureKeyIDs. Returns 201 + Location.	`OrganizationConfig.ReadWrite`	Enterprise
GET	`/exchange/v1.0/dataEncryptionPolicies/{key}`	Get a single mailbox data-encryption policy by Identity. Returns 404 if absent.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/dataEncryptionPolicies/{key}`	PATCH /dataEncryptionPolicies/{key} - partial update. Pass { “refresh”: true } in the body to re-fetch the key after rotating an associated Azure Key Vault key. Pass permanentDataPurgeReason/Contact + permanentDataPurgeRequested: true to initiate a customer-key purge (irreversible - see MS Customer Key docs). Returns 200 + post-Set policy.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/dataEncryptionPolicies

List mailbox data-encryption policies (CMK BYOK for mailbox data, Azure Key Vault references).

Backing cmdlet: Get-DataEncryptionPolicy. Role: OrganizationConfig.Read (Community).

List mailbox data-encryption policies

Lists the tenant’s Customer Key per-mailbox data-encryption policies (BYOK references to Azure Key Vault keys). Returns an empty collection on tenants where Customer Key has not been provisioned.

GET /exchange/v1.0/dataEncryptionPolicies HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#dataEncryptionPolicies",
  "value": []
}

POST /exchange/v1.0/dataEncryptionPolicies

POST /dataEncryptionPolicies - create a per-mailbox Customer Key encryption policy. Required: name + azureKeyIDs. Returns 201 + Location.

Backing cmdlet: New-DataEncryptionPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required
`azureKeyIDs`	body		yes
`name`	body		yes
`description`	body
`enabled`	body
`dryRun`	query	bool (switch)

Create a per-mailbox Customer Key policy

Provision a Customer Key per-mailbox encryption policy via New-DataEncryptionPolicy. Required: name + azureKeyIDs (Azure Key Vault key URIs). Once created, assign the policy to mailboxes via PATCH /mailboxes/{key} with { dataEncryptionPolicy: <name> }. There is no Remove cmdlet - disable via PATCH { enabled: false } or initiate a permanent key purge via PATCH { permanentDataPurgeReason, permanentDataPurgeContact, permanentDataPurgeRequested: true } (irreversible - see MS Customer Key docs).

POST /exchange/v1.0/dataEncryptionPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "Contoso-VIP-Encryption",
  "azureKeyIDs": [
    "https://contoso-kv-westus.vault.azure.net/keys/vip-key/abc123",
    "https://contoso-kv-eastus.vault.azure.net/keys/vip-key/def456"
  ],
  "description": "Per-mailbox Customer Key policy for VIP users.",
  "enabled": true
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/dataEncryptionPolicies/Contoso-VIP-Encryption

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#dataEncryptionPolicies/$entity",
  "Id": "policy-vip-encryption",
  "Name": "Contoso-VIP-Encryption",
  "Identity": "policy-vip-encryption",
  "Description": "Per-mailbox Customer Key policy for VIP users.",
  "Enabled": true,
  "Mode": "Mailbox",
  "AzureKeyIDs": [
    "https://contoso-kv-westus.vault.azure.net/keys/vip-key/abc123",
    "https://contoso-kv-eastus.vault.azure.net/keys/vip-key/def456"
  ]
}

GET /exchange/v1.0/dataEncryptionPolicies/{key}

Get a single mailbox data-encryption policy by Identity. Returns 404 if absent.

Backing cmdlet: Get-DataEncryptionPolicy. Role: OrganizationConfig.Read (Community).

PATCH /exchange/v1.0/dataEncryptionPolicies/{key}

PATCH /dataEncryptionPolicies/{key} - partial update. Pass { “refresh”: true } in the body to re-fetch the key after rotating an associated Azure Key Vault key. Pass permanentDataPurgeReason/Contact + permanentDataPurgeRequested: true to initiate a customer-key purge (irreversible - see MS Customer Key docs). Returns 200 + post-Set policy.

Backing cmdlet: Set-DataEncryptionPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Description
`description`	body
`enabled`	body
`name`	body
`permanentDataPurgeContact`	body
`permanentDataPurgeReason`	body
`permanentDataPurgeRequested`	body	boolean (switch)
`refresh`	body	boolean (switch)
`dryRun`	query	bool (switch)
`force`	query	bool (switch)	Bypass tenant-side safety check (Set-* -Force).

Update a mailbox data-encryption policy

Partial update of a Customer Key per-mailbox encryption policy via Set-DataEncryptionPolicy. Send only the fields you want to change; the response echoes the post-Set policy.

PATCH /exchange/v1.0/dataEncryptionPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "description": "EXONAUT sample Customer Key policy for contoso.com mailboxes",
  "enabled": true
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-dataEncryptionPolicies",
  "Identity": "exonaut-sample-dataEncryptionPolicies",
  "Name": "exonaut-sample-dataEncryptionPolicies",
  "Description": "EXONAUT sample Customer Key policy for contoso.com mailboxes",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.