Security documentation (encryption) — Microsoft OneDrive for Business

Cited by

Facts read from this source

• Sharepoint per file keys Report an error

  “All customer files in SharePoint are protected by unique, per-file keys that are always exclusive to a single tenant.”

• Sharepoint aes256 Report an error

  “All customer data stored in SharePoint is encrypted with one or more AES 256-bit keys”

• Sharepoint fips140 2 level2 Report an error

  “Every step of this encryption process is FIPS 140-2 Level 2 validated.”

• Teams storage in sharepoint Report an error

  “Several workloads in Microsoft 365 store data in SharePoint, including Microsoft Teams, which stores all files in SharePoint, and OneDrive, which uses SharePoint for its storage.”

• Sharepoint content database tde Report an error

  “Database access controls and encryption at rest protect the Content Database. Encryption uses Transparent Data Encryption (TDE) in Azure SQL Database.”

• Sharepoint customer key hierarchy Report an error

  “the customer key is stored in Azure Key Vault, and the service uses the key to encrypt a tenant key, which is used to encrypt a site key, which is then used to encrypt the file level keys.”

• Sharepoint sas expiry Report an error

  “These credentials are Azure storage SAS signatures, with separate credentials used to read or write data, and with policy applied so that they auto-expire every 60 days.”

• Sharepoint three store separation Report an error

  “Each of these three storage components – the Azure blob store, the Content Database, and the Key Store – is physically separate.”

• US government azure storage Report an error

  “For Office 365 U.S. Government customers, data blobs are stored in Azure U.S. Government Storage.”

• Sharepoint list items tde Report an error

  “The Content Database (Azure SQL Database) stores list items and protects them with TDE.”

• Sharepoint tls transit Report an error

  “Communication to SharePoint and OneDrive across the Internet uses TLS connections.”

• Sharepoint interdatacenter encryption Report an error

  “While this data is already transmitted by using a private network, it's further protected with best-in-class encryption.”

• Exchange bitlocker Report an error

  “Exchange uses BitLocker for all mailbox data.”

• Exchange service encryption Report an error

  “Service-level encryption encrypts all mailbox data at the mailbox level.”

• Exchange customer key Report an error

  “Microsoft 365 supports Customer Key, which is built on top of service-encryption.”

• Teams tls mtls Report an error

  “Teams uses TLS and MTLS to encrypt instant messages. All server-to-server traffic requires MTLS”

• Teams media srtp Report an error

  “Media traffic is encrypted using Secure RTP (SRTP)”

• Teams turn tls token Report an error

  “Teams uses a credentials-based token for secure access to media relays over TURN. Media relays exchange the token over a TLS-secured channel.”

• Teams fips algorithms Report an error

  “Teams uses FIPS (Federal Information Processing Standard) compliant algorithms for encryption key exchanges.”

• Key store farm key bitlocker Report an error

  “BitLocker certificates, which protect the physical disk volumes on machines in the datacenter, are stored in a secure repository (the SharePoint secret store) that is protected by the Farm key.”

• Exchange customer key admin separation Report an error

  “This method of encryption provides increased protection not afforded by BitLocker because it provides separation of server administrators and the cryptographic keys necessary for decryption of data”

Scores citing this record

• The Agency Producer Encryption, key custody & recovery
• The Architecture Practice Partner Encryption, key custody & recovery
• The Data Protection Officer Encryption, key custody & recovery
• The IT Lead Encryption, key custody & recovery
• The Skeptic Encryption, key custody & recovery
• The Tax Adviser Encryption, key custody & recovery