Commands › Exchange Online

Set-DataEncryptionPolicy

Exchange Online ExchangeOnlineManagement Set-*

Modify data encryption policies in Exchange Online.

Quick start script

# Set-DataEncryptionPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-DataEncryptionPolicy
$before | Format-List

# 3. Make the change (dry run first)
Set-DataEncryptionPolicy -AzureKeyIDs <MultiValuedProperty> -Identity <DataEncryptionPolicyIdParameter> -PermanentDataPurgeContact <String> -WhatIf
Set-DataEncryptionPolicy -AzureKeyIDs <MultiValuedProperty> -Identity <DataEncryptionPolicyIdParameter> -PermanentDataPurgeContact <String>

# 4. Verify and diff
$after = Get-DataEncryptionPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 4 parameter sets

DCAdminPurgeKeyRequest

Set-DataEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> -PermanentDataPurgeReason <String> [-PermanentDataPurgeContact <String>]
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

TenantAdminPurgeKeyRequest

Set-DataEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> -PermanentDataPurgeContact <String> -PermanentDataPurgeReason <String>
 [-PermanentDataPurgeRequested]
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

RefreshKey

Set-DataEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter>
 [-Refresh]
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

ReplaceKey

Set-DataEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> -AzureKeyIDs <MultiValuedProperty> -Replace
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	Required	What it controls
-AzureKeyIDs	MultiValuedProperty	yes	{{ Fill AzureKeyIDs Description }}
-Identity	DataEncryptionPolicyIdParameter	yes	The Identity parameter specifies the data encryption policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
-PermanentDataPurgeContact	String	yes	The PermanentDataPurgeContact parameter specifies a contact for the purge of all data that's encrypted by the data encryption policy. If the value contains spaces, enclose the value in quotation marks.
-PermanentDataPurgeReason	String	yes	The PermanentDataPurgeReason parameter specifies a descriptive reason for the purge of all data that's encrypted by the data encryption policy. If the value contains spaces, enclose the value in quotation marks.
-PermanentDataPurgeRequested	SwitchParameter	yes	The PermanentDataPurgeRequested switch specifies whether to initiate the deletion of all data that's encrypted by the data encryption policy. You don't need to specify a value with this switch.
-Refresh	SwitchParameter	yes	Use the Refresh switch to update the data encryption policy in Exchange Online after you rotate any of the associated keys in the Azure Key Vault. You don't need to specify a value with this switch.
-Replace	SwitchParameter	yes	{{ Fill Replace Description }}
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies an optional description for the data encryption policy. If the value contains spaces, enclose the value in quotation marks.
-DomainController	Fqdn		This parameter is reserved for internal Microsoft use.
-Enabled	Boolean		The Enabled parameter enables or disable the data encryption policy. Valid values are:
-Force	SwitchParameter		The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-Name	String		The Name parameter specifies the unique name for the data encryption policy. If the value contains spaces, enclose the value in quotation marks.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.