#Preparations

The encryption profile requires some properties of a key vault. Before creating an encryption profile, make sure you have a key vault in Azure. If you do not have any key vaults, refer to the instructions in Create a Key Vault in Azure.

Then, perform the following pre-check on the key vault:

1. Log in to the .

2. Navigate to Key vaults.

3. Click the key vault you prepared.

4. Refer to the instructions below based on your scenario:

   • To check Azure RBAC roles assigned on the key vault, follow the steps below:

     1. In the Key Vault’s menu, click Access control (IAM).

     2. Go to the Role assignments tab.

     3. Use the search bar or filter to find the Key Vault Crypto User role.

     4. Check the list of users, groups, or service principals assigned with this role.

   • To check access policies added on the key vault, follow the steps below:

     1. In the Key Vault’s menu, click Access policies.

     2. Locate the application that is used for your key vault.

     3. In the Key permissions drop-down list, make sure that at least the following operations are selected: Get, Encrypt, and Decrypt.

5. Navigate to the pane for key vault settings and click Keys.

6. Click a key and click a version of the key.

7. In the Permitted operations section, make sure that at least Encrypt and Decrypt are selected.

8. Copy the key identifier that resides in the Properties section. When you create an encryption profile in AvePoint Online Services, you will need to provide this key identifier.

Apart from the pre-checking above, AvePoint Online Services recommends that you back up the key in case the key is deleted accidentally. If a key has been applied to AvePoint Online Services' encryption profile to encrypt data, and the key is deleted with no backup, the encrypted data will be damaged, and AvePoint Online Services will not work for you smoothly.