m365DataAtRestEncryptionPolicies

Data-at-Rest Encryption Policies. Customer Key policies that encrypt Microsoft 365 data at rest. The m365DataAtRestEncryptionPolicies entity set lives under /exchange/v1.0/m365DataAtRestEncryptionPolicies in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/m365DataAtRestEncryptionPolicies`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-M365DataAtRestEncryptionPolicy, New-M365DataAtRestEncryptionPolicy, Set-M365DataAtRestEncryptionPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/m365DataAtRestEncryptionPolicies`	List M365 data-at-rest encryption policies (CMK BYOK) - references to Azure Key Vault keys used to encrypt mailbox + SP/OneDrive data.	`OrganizationConfig.Read`	Community
POST	`/exchange/v1.0/m365DataAtRestEncryptionPolicies`	POST /m365DataAtRestEncryptionPolicies - provision a new tenant-wide encryption policy. Required: name + azureKeyIDs (list of Azure Key Vault key URIs). Returns 201 + Location.	`OrganizationConfig.ReadWrite`	Enterprise
GET	`/exchange/v1.0/m365DataAtRestEncryptionPolicies/{key}`	Get a single M365 data-at-rest encryption policy by Identity. Returns 404 if absent.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/m365DataAtRestEncryptionPolicies/{key}`	PATCH /m365DataAtRestEncryptionPolicies/{key} - update enabled/description/name; pass { “refresh”: true } in the body to re-fetch the Azure Key Vault key (RefreshKey parameter set). Returns 200 + post-Set policy.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/m365DataAtRestEncryptionPolicies

List M365 data-at-rest encryption policies (CMK BYOK) - references to Azure Key Vault keys used to encrypt mailbox + SP/OneDrive data.

Backing cmdlet: Get-M365DataAtRestEncryptionPolicy. Role: OrganizationConfig.Read (Community).

List tenant-wide M365 data-at-rest encryption policies

Returns the Customer Key data-at-rest encryption policies provisioned for the tenant. On tenants where no Customer Key policy has been configured, the collection is empty.

GET /exchange/v1.0/m365DataAtRestEncryptionPolicies HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#m365DataAtRestEncryptionPolicies",
  "value": []
}

POST /exchange/v1.0/m365DataAtRestEncryptionPolicies

POST /m365DataAtRestEncryptionPolicies - provision a new tenant-wide encryption policy. Required: name + azureKeyIDs (list of Azure Key Vault key URIs). Returns 201 + Location.

Backing cmdlet: New-M365DataAtRestEncryptionPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required
`azureKeyIDs`	body		yes
`name`	body		yes
`description`	body
`enabled`	body
`dryRun`	query	bool (switch)

Create a tenant-wide Customer Key policy

Provision a tenant-wide M365 data-at-rest encryption (Customer Key) policy via New-M365DataAtRestEncryptionPolicy. Required: name + azureKeyIDs (list of Azure Key Vault key URIs - typically two for HA, one in each Key Vault region). After create, assign the policy to a workload via PATCH /m365DataAtRestEncryptionPolicyAssignments with { dataEncryptionPolicy: <name> }. There is no Remove cmdlet - once created, policies are immutable (rotate by creating a new policy + reassigning).

POST /exchange/v1.0/m365DataAtRestEncryptionPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "Contoso-Tenant-Encryption-2026",
  "azureKeyIDs": [
    "https://contoso-kv-westus.vault.azure.net/keys/customer-key/abc123",
    "https://contoso-kv-eastus.vault.azure.net/keys/customer-key/def456"
  ],
  "description": "Tenant-wide Customer Key policy - two HA keys across regions.",
  "enabled": true
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/m365DataAtRestEncryptionPolicies/Contoso-Tenant-Encryption-2026

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#m365DataAtRestEncryptionPolicies/$entity",
  "Id": "policy-tenant-encryption-2026",
  "Name": "Contoso-Tenant-Encryption-2026",
  "Identity": "policy-tenant-encryption-2026",
  "Description": "Tenant-wide Customer Key policy - two HA keys across regions.",
  "Enabled": true,
  "Mode": "Tenant",
  "AzureKeyIDs": [
    "https://contoso-kv-westus.vault.azure.net/keys/customer-key/abc123",
    "https://contoso-kv-eastus.vault.azure.net/keys/customer-key/def456"
  ]
}

GET /exchange/v1.0/m365DataAtRestEncryptionPolicies/{key}

Get a single M365 data-at-rest encryption policy by Identity. Returns 404 if absent.

Backing cmdlet: Get-M365DataAtRestEncryptionPolicy. Role: OrganizationConfig.Read (Community).

PATCH /exchange/v1.0/m365DataAtRestEncryptionPolicies/{key}

PATCH /m365DataAtRestEncryptionPolicies/{key} - update enabled/description/name; pass { “refresh”: true } in the body to re-fetch the Azure Key Vault key (RefreshKey parameter set). Returns 200 + post-Set policy.

Backing cmdlet: Set-M365DataAtRestEncryptionPolicy. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Description
`description`	body
`enabled`	body
`name`	body
`refresh`	body	boolean (switch)
`dryRun`	query	bool (switch)
`force`	query	bool (switch)	Bypass tenant-side safety check (Set-* -Force).

Update an M365 data-at-rest encryption policy

Updates a tenant-wide Customer Key (BYOK) data-at-rest encryption policy via Set-M365DataAtRestEncryptionPolicy. Accepts a partial body of writable fields (name, description, enabled).

PATCH /exchange/v1.0/m365DataAtRestEncryptionPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "description": "EXONAUT sample data-at-rest encryption policy",
  "enabled": true,
  "name": "exonaut-sample-m365DataAtRestEncryptionPolicies"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-m365DataAtRestEncryptionPolicies",
  "Identity": "exonaut-sample-m365DataAtRestEncryptionPolicies",
  "Name": "exonaut-sample-m365DataAtRestEncryptionPolicies",
  "Description": "EXONAUT sample data-at-rest encryption policy",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.