Admin, Security & Settings · Synthetic Property 1

External Systems & Add-ons

Customer-configurable optional connections and paid add-ons.

Setup guide · External Customer-Managed Keys

Customer key vault for tenant encryption keys

A key service you control, with a key created for this product and permission to use it.

Find your provider's instructions for the keys (opens a web search). Look for words like API keys, integrations or developer settings in your provider's admin area.

If you don't have a provider yet, the built-in feature keeps working. Your own provider's help is the source of truth.

Open External Systems & Add-ons, Marketplace and choose External Customer-Managed Keys.
Get the details above from your provider. Keep them private; never put them in a message or note.
Paste them into the connection form. They are stored separately for Test and Live.
Allow only what this connection needs: Customer key vault for tenant encryption keys.
Match your provider's names to ours on the Mapping tab, then press Test.
It shows Connected only after the test passes. Watch its Health, and use Safe Disable to turn it off at any time.

Technical steps from the build package

Settings > External Systems & Add-ons > Marketplace: activate External Customer-Managed Keys (paid add-on where applicable).
Enter the credentials your provider gives you (kept separate per environment).
Grant only these permissions: Customer key vault for tenant encryption keys.
Map codes and fields on the Mapping tab.
Run Test; status becomes Connected only after a pass.
Watch Health; use Safe Disable to turn it off.

Without this connection: Platform-managed tenant keys.

Degraded: warnings, partial sync, fallback for impaired functions. Down: Platform-managed tenant keys; queued writes replay safely on recovery.