How to Automate Microsoft Double Key Encryption with Power Automate
Question details
The user is attempting to set up an automated workflow to apply Double Key Encryption to documents stored in SharePoint.
- Product
- Microsoft Power Automate
- Device & OS
- not provided
- Scenario
- Automating document protection and encryption processes for sensitive files uploaded or stored in SharePoint.
- Observed behavior
- Double Key Encryption is not available as an automated action in Power Automate or Azure for SharePoint documents.
Ensure you have Microsoft Purview compliance administrator permissions and verify if your organization's security policies allow substituting Double Key Encryption with automated Sensitivity Labels.
Use Auto-Labeling with Sensitivity Labels as an Alternative
Since Double Key Encryption requires on-premises key access that prevents cloud automation, configuring automatic sensitivity label application is the recommended Microsoft alternative for SharePoint documents.
Double Key Encryption (DKE) uses a secondary encryption key held outside of Microsoft's cloud infrastructure. Because of this, cloud-based services like Power Automate and SharePoint cannot automatically encrypt or decrypt the content in the background.
To achieve automated compliance and protection, Microsoft recommends utilizing auto-labeling policies with standard sensitivity labels. These can automatically scan and protect documents based on sensitive information types.
Sign in to the Microsoft Purview compliance portal using an account with the required administrative permissions.
In the left navigation pane, select 'Information protection' and then click on the 'Auto-labeling' tab.
Click on 'Create auto-labeling policy'. Choose the sensitive information templates (like financial, medical, or privacy data) that match the documents you want to protect.
Specify the SharePoint sites or OneDrive accounts where the documents are stored. Configure the exact rules and conditions that will trigger the label.
Choose the sensitivity label you want to apply when the conditions are met. Run the policy in simulation mode first, then turn it on to begin automating document protection.
Manage and Protect Your Documents Locally with WPS Office
While enterprise automation like Power Automate requires complex Microsoft 365 cloud setups and strict compliance policies, WPS Office provides a free, lightweight, and user-friendly alternative for daily document creation and local file security. Enjoy high compatibility with Microsoft formats without the heavy enterprise overhead.
- 1. Download WPS Office: Visit the official WPS website and download the free WPS Office suite for your operating system.
- 2. Open Existing Documents: Launch WPS Office and open your existing Microsoft Office documents seamlessly to continue your work.
- 3. Apply Local Encryption: Navigate to the 'Menu' > 'Document Encryption' > 'Encryption' to set passwords and protect your sensitive local files without relying on cloud automation.
Frequently Asked Questions
Why can't I find Double Key Encryption actions in Power Automate?
Double Key Encryption uses a secondary key that remains completely outside of Microsoft's cloud infrastructure. Because Power Automate operates in the cloud and cannot access your local key, it cannot automatically encrypt or decrypt DKE files.
Can I automatically apply Double Key Encryption to files uploaded to SharePoint?
No. DKE requires user interaction through the Azure Information Protection (AIP) client in Office desktop applications. It cannot be fully automated in the background for SharePoint uploads.
What is the difference between Sensitivity Labels and Double Key Encryption?
Sensitivity Labels classify and protect data using cloud-based keys managed by Microsoft or your tenant, allowing for cloud automation. DKE adds a second encryption layer where you retain exclusive control of the key locally, prioritizing extreme security over automation capabilities.
How do auto-labeling policies work in SharePoint without Power Automate?
Microsoft Purview auto-labeling policies natively scan files at rest in SharePoint and OneDrive. When they detect predefined sensitive information, they automatically apply the appropriate sensitivity label without needing a custom Power Automate flow.
