Commands › Exchange Online

Set-M365DataAtRestEncryptionPolicy

Exchange Online ExchangeOnlineManagement Set-*

Modify Microsoft 365 data-at-rest encryption policies in Exchange Online.

Quick start script

# Set-M365DataAtRestEncryptionPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-M365DataAtRestEncryptionPolicy
$before | Format-List

# 3. Make the change (dry run first)
Set-M365DataAtRestEncryptionPolicy -AzureKeyIDs <MultiValuedProperty> -Identity <DataEncryptionPolicyIdParameter> -Replace <SwitchParameter> -WhatIf
Set-M365DataAtRestEncryptionPolicy -AzureKeyIDs <MultiValuedProperty> -Identity <DataEncryptionPolicyIdParameter> -Replace <SwitchParameter>

# 4. Verify and diff
$after = Get-M365DataAtRestEncryptionPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 3 parameter sets

TenantAdminPurgeKeyRequest

Set-M365DataAtRestEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

RefreshKey

Set-M365DataAtRestEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Name <String>]
 [-Refresh]
 [-WhatIf]
 [<CommonParameters>]

ReplaceKey

Set-M365DataAtRestEncryptionPolicy [-Identity] <DataEncryptionPolicyIdParameter> -AzureKeyIDs <MultiValuedProperty> -Replace
 [-Confirm]
 [-Description <String>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (11)

Parameter	Type	Required	What it controls
-AzureKeyIDs	MultiValuedProperty	yes	{{ Fill AzureKeyIDs Description }}
-Identity	DataEncryptionPolicyIdParameter	yes	The Identity parameter specifies the data-at-rest encryption policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
-Replace	SwitchParameter	yes	{{ Fill Replace Description }}
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies an optional description for the policy.
-DomainController	Fqdn		This parameter is reserved for internal Microsoft use.
-Enabled	Boolean		The Enabled parameter specifies whether the policy is enabled or disabled. Valid values are:
-Force	SwitchParameter		The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-Name	String		The Name parameter specifies a unique name for the Microsoft 365 data-at-rest encryption policy. If the value contains spaces, enclose the value in quotation marks (").
-Refresh	SwitchParameter	yes	Use the Refresh switch to update the Microsoft 365 data-at-rest encryption policy in Exchange Online after you rotate any of the associated keys in the Azure Key Vault. You don't need to specify a value with this switch.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.