cmek-azure-key-vault changedmanage-claude/cmek-azure-key-vault
Nearest release: v2.1.309, published 13 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+110added
Lines−566removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits14to this page, all time
## Before you start ## In Azure: create the key ### Check the vault ### Add the organization tag to a key you already have ## In Claude: add and attach the key ## Prerequisites ## Anthropic app information ## Encryption key setup ### Check your vault configuration ## Register the key with Anthropic ## Troubleshoot validation ## Terraform
The whole hunk
from line 1, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 1
11---
2title: Configure Azure Key Vault for CMEK
2title: Set up CMEK with Azure Key Vault
33url: https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault
4description: Use Azure Key Vault to provide an encryption key for your organization.
4description: Create an Azure Key Vault key, give Anthropic access to it, and put it to use in Claude Platform or Claude Enterprise.
55---
66
77Let Claude Code set up this feature for you
from line 10
1010/claude-api help me configure a customer-managed encryption key with Azure Key Vault
1111```
1212
13This guide shows how to use an Azure Key Vault key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
14
15<Warning>
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
17</Warning>
18
19## Prerequisites
20
21* An Azure Key Vault with these settings:
22
23 * RBAC authorization is enabled (`enableRbacAuthorization: true`).
24 * Public network access is allowed. Private endpoints are not supported.
25 * Purge protection is enabled (`enablePurgeProtection: true`). You can't turn off purge protection after you enable it.
26 * Diagnostic settings route the `AuditEvent` log category to Log Analytics, a storage account, or an event hub. Without them, you have no audit trail of Anthropic's key operations, such as `KeyWrap`, `KeyUnwrap`, and `KeyGet`.
27
28* Permissions to create keys in the vault and to assign RBAC roles on it.
29
30* Permissions to create service principals in your Entra tenant (`Application Administrator`, `Cloud Application Administrator`, or an equivalent custom role).
31
32* The [`az` CLI](https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) installed and authenticated, or Cloud Shell in the Azure portal. Some steps have no portal equivalent.
33
34* To register the key through the API, an Anthropic Admin API key for your organization.
35
36## Anthropic app information
37
38You give the following Anthropic multitenant application access to your key. The application requests no Microsoft Graph permissions.
39
40| Field | Value |
41| ------------------------------ | -------------------------------------- |
42| Multitenant app client ID (US) | `8635ae1a-3e5d-44e8-a4ed-e0f614466f87` |
43| App display name | `anthropic-cmek-client-us` |
44
45<Warning>
46 Use only this published client ID and display name. Never trust an identifier provided over email, chat, or any onboarding channel.
47</Warning>
48
49## Encryption key setup
50
51The key must meet these requirements:
52
53* **Type:** RSA, 3072-bit or larger. For an HSM-backed key, use `RSA-HSM`, which requires a Premium-SKU vault.
54* **Permitted operations:** `wrapKey` and `unwrapKey`. The steps in this guide turn off every other operation, so Anthropic can only read the key and wrap and unwrap with it.
55* **Organization tag:** `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. Replace `<ORGANIZATION_UUID>` with your Anthropic organization ID in lowercase. Validation fails without the tag.
56* **Access:** the `Key Vault Crypto User` role for Anthropic's service principal, assigned on the key.
57
58<Note>
59 **Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
60
61 * **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
62 * **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
63 * **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
64</Note>
13## Before you start
14
15In Claude:
16
17* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
18* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
19* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
21* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
22
23In Azure:
24
25* You can create keys in your key vault and assign RBAC roles on it.
26* You can create service principals in your Entra tenant (Application Administrator, Cloud Application Administrator, or an equivalent custom role).
27* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic's key operations leave no audit trail.
28
29## In Azure: create the key
30
31After a failed **Verify** or **Add**, see the [fixes for Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
32
33These steps give Anthropic's multitenant application access to your key:
34
35* **Name:** `anthropic-cmek-client-us`
36* **Client ID:** `8635ae1a-3e5d-44e8-a4ed-e0f614466f87`
37
38Use only this client ID and name, never ones sent by email or chat. The application requests no Microsoft Graph permissions.
39
40### Check the vault
41
42For the lowest latency, use a vault in `northcentralus` or `eastus2`. Run this first, in the Azure CLI or Cloud Shell:
43
44```bash
45az keyvault show --name <your-vault-name> \
46 --query "{rbac:properties.enableRbacAuthorization, purge:properties.enablePurgeProtection, pub:properties.publicNetworkAccess, net:properties.networkAcls.defaultAction, ipRules:properties.networkAcls.ipRules, uri:properties.vaultUri, tenantId:properties.tenantId}"
47```
48
49| Field | Must be |
50| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
51| `rbac` | `true` |
52| `purge` | `true`. If it's `false` or `null`, turn on purge protection first. You can't turn it off again. |
53| `pub` | `"Enabled"`. Private endpoints aren't supported. |
54| `net` | `"Allow"`, or `"Deny"` with [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
55
56Copy `uri` (the vault URI) and `tenantId`.
6557
6658### Create the key and grant access
59
60On this page, `<ORGANIZATION_UUID>` is your [Anthropic organization ID](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#prerequisites) in lowercase. To use a key you already have, [add the organization tag](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#organization-tag) first.
6761
6862<Tabs>
6963 <Tab title="Azure portal">
from line 131
137131 On the **Review + assign** tab, click **Review + assign**.
138132 </Step>
139133 </Steps>
140
141 To use a key you already have, follow these steps instead of steps 3 to 6, then continue from step 7:
142
143 1. In your key vault, select **Keys** and open the key. Open its current version.
144 2. Click the link next to **Tags**.
145 3. Add the organization tag and click **OK**.
146 4. Under **Permitted operations**, clear every checkbox except **Wrap Key** and **Unwrap Key**.
147 5. Click **Save**.
148134 </Tab>
149135
150136 <Tab title="Azure CLI">
from line 186
200186 * **`<your-key-name>`:** the name of the key
201187 </Step>
202188 </Steps>
203
204 To use a key you already have, run this command instead of step 2:
205
206 ```bash
207 az keyvault key set-attributes \
208 --vault-name <your-vault-name> \
209 --name <your-key-name> \
210 --ops wrapKey unwrapKey \
211 --tags anthropic-org-<ORGANIZATION_UUID>=true
212 ```
213
214 This replaces the version's existing tags. Add each existing tag to `--tags` as `name=value`.
215189 </Tab>
216190</Tabs>
217191
218<Note>
219 **Optional:**
220
221 * To share one key among several Anthropic organizations, add one organization tag for each. A key version can carry at most 15 tags, including your own.
222 * If the vault holds only this key, you can assign the role on the vault instead of the key.
223</Note>
224
225### Check your vault configuration
226
227Run this command with the Azure CLI or in Cloud Shell. Replace `<your-vault-name>` with the name of your key vault.
192Whoever adds the key in Claude needs the vault URI, the key name, and the tenant ID.
193
194### Add the organization tag to a key you already have
195
196Verification fails without the organization tag. The key must be RSA, 3072-bit or larger.
197
198Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version's tags, so list any you want to keep in `--tags` as `name=value`.
228199
229200```bash
230az keyvault show --name <your-vault-name> \
231 --query "{rbac:properties.enableRbacAuthorization, purge:properties.enablePurgeProtection, pub:properties.publicNetworkAccess, net:properties.networkAcls.defaultAction, ipRules:properties.networkAcls.ipRules, uri:properties.vaultUri, tenantId:properties.tenantId}"
201az keyvault key set-attributes \
202 --vault-name <your-vault-name> \
203 --name <your-key-name> \
204 --ops wrapKey unwrapKey \
205 --tags anthropic-org-<ORGANIZATION_UUID>=true
232206```
233207
234Confirm these values:
235
236* `rbac`: `true`
237* `purge`: `true`. If it's `false` or `null`, enable purge protection before you continue.
238* `pub`: `"Enabled"`. If it's `"Disabled"`, turn on public network access.
239* `net`: `"Allow"`, or `"Deny"` with Anthropic's outbound IP ranges in `ipRules`. For the ranges, see [Outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses).
240
241Copy these values to register the key:
242
243* `uri`: the vault URI
244* `tenantId`: the ID of the tenant that governs the vault
245
246## Register the key with Anthropic
208You still need the service principal and role assignment steps.
209
210## In Claude: add and attach the key
211
212To script this part on Claude Platform, [use the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api) instead.
247213
248214<Tabs>
249215 <Tab title="Claude Platform">
250 <Tabs>
251 <Tab title="Claude Console">
252 <Steps>
253 <Step title="Open the encryption key settings">
254 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
255 </Step>
256
257 <Step title="Add the key">
258 Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **Azure Key Vault**. Click **Continue**.
259 </Step>
260
261 <Step title="Enter the key details">
262 The dialog box shows an **Organization tag**. Check that your key has this tag. Enter these values:
263
264 * **Vault URI:** the `uri` value that you copied
265 * **Key name:** the name of the key
266 * **Tenant ID:** the `tenantId` value that you copied
267
268 Click **Add**.
269 </Step>
270
271 <Step title="Validate the key">
272 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation) for common causes.
273 </Step>
274
275 <Step title="Attach the key to a workspace">
276 Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
277
278 On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
279 </Step>
280
281 <Step title="Confirm the change">
282 Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
283 </Step>
284 </Steps>
285 </Tab>
286
287 <Tab title="API">
288 <Steps>
289 <Step title="Create the external key">
290 Replace the placeholders:
291
292 * **`<friendly-name>`:** a display name for the key
293 * **`<your-vault-name>`:** the name of your key vault
294 * **`<your-key-name>`:** the name of the key
295 * **`<your-tenant-id>`:** the `tenantId` value that you copied
296
297 <CodeGroup>
298 ```bash cURL
299 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
300 -H "x-api-key: $ANTHROPIC_API_KEY" \
301 -H "anthropic-version: 2023-06-01" \
302 -H "content-type: application/json" \
303 -d '{
304 "display_name": "<friendly-name>",
305 "geo": "us",
306 "provider_config": {
307 "type": "azure",
308 "vault_uri": "https://<your-vault-name>.vault.azure.net/",
309 "key_name": "<your-key-name>",
310 "tenant_id": "<your-tenant-id>"
311 }
312 }'
313 ```
314
315 ```bash CLI
316 ant organization:external-keys create <<'YAML'
317 display_name: "<friendly-name>"
318 geo: us
319 provider_config:
320 type: azure
321 vault_uri: "https://<your-vault-name>.vault.azure.net/"
322 key_name: "<your-key-name>"
323 tenant_id: "<your-tenant-id>"
324 YAML
325 ```
326
327 ```python Python
328 client = anthropic.Anthropic()
329
330 external_key = client.organization.external_keys.create(
331 display_name="<friendly-name>",
332 geo="us",
333 provider_config={
334 "type": "azure",
335 "vault_uri": "https://<your-vault-name>.vault.azure.net/",
336 "key_name": "<your-key-name>",
337 "tenant_id": "<your-tenant-id>",
338 },
339 )
340
341 print(f"id: {external_key.id}")
342 print(f"display_name: {external_key.display_name}")
343 ```
344
345 ```typescript TypeScript
346 const client = new Anthropic();
347
348 const externalKey = await client.organization.externalKeys.create({
349 display_name: "<friendly-name>",
350 geo: "us",
351 provider_config: {
352 type: "azure",
353 vault_uri: "https://<your-vault-name>.vault.azure.net/",
354 key_name: "<your-key-name>",
355 tenant_id: "<your-tenant-id>"
356 }
357 });
358
359 console.log(`id: ${externalKey.id}`);
360 console.log(`display_name: ${externalKey.display_name}`);
361 ```
362
363 ```csharp C#
364 using Anthropic.Models.Organization.ExternalKeys;
365
366 AnthropicClient client = new();
367
368 var externalKey = await client.Organization.ExternalKeys.Create(new()
369 {
370 DisplayName = "<friendly-name>",
371 Geo = Geo.Us,
372 ProviderConfig = new AzureExternalKeyConfigParam
373 {
374 VaultUri = "https://<your-vault-name>.vault.azure.net/",
375 KeyName = "<your-key-name>",
376 TenantID = "<your-tenant-id>"
377 }
378 });
379
380 Console.WriteLine($"id: {externalKey.ID}");
381 Console.WriteLine($"display_name: {externalKey.DisplayName}");
382 ```
383
384 ```go Go
385 client := anthropic.NewClient()
386
387 externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
388 DisplayName: anthropic.String("<friendly-name>"),
389 Geo: anthropic.OrganizationExternalKeyNewParamsGeoUs,
390 ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
391 OfAzure: &anthropic.AzureExternalKeyConfigParam{
392 VaultURI: "https://<your-vault-name>.vault.azure.net/",
393 KeyName: "<your-key-name>",
394 TenantID: "<your-tenant-id>",
395 },
396 },
397 })
398 if err != nil {
399 log.Fatal(err)
400 }
401
402 fmt.Printf("id: %s\n", externalKey.ID)
403 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
404 ```
405
406 ```java Java
407 import com.anthropic.models.organization.externalkeys.AzureExternalKeyConfigParam;
408 import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
409
410 void main() {
411 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
412
413 var params = ExternalKeyCreateParams.builder()
414 .displayName("<friendly-name>")
415 .geo(ExternalKeyCreateParams.Geo.US)
416 .providerConfig(AzureExternalKeyConfigParam.builder()
417 .vaultUri("https://<your-vault-name>.vault.azure.net/")
418 .keyName("<your-key-name>")
419 .tenantId("<your-tenant-id>")
420 .build())
421 .build();
422 var externalKey = client.organization().externalKeys().create(params);
423
424 IO.println("id: " + externalKey.id());
425 IO.println("display_name: " + externalKey.displayName().orElseThrow());
426 }
427 ```
428
429 ```php PHP
430 use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
431 // ...
432
433 $client = new Client();
434
435 $externalKey = $client->organization->externalKeys->create(
436 displayName: '<friendly-name>',
437 geo: Geo::US,
438 providerConfig: [
439 'type' => 'azure',
440 'vaultURI' => 'https://<your-vault-name>.vault.azure.net/',
441 'keyName' => '<your-key-name>',
442 'tenantID' => '<your-tenant-id>',
443 ],
444 );
445
446 echo "id: {$externalKey->id}\n";
447 echo "display_name: {$externalKey->displayName}\n";
448 ```
449
450 ```ruby Ruby
451 client = Anthropic::Client.new
452
453 external_key = client.organization.external_keys.create(
454 display_name: "<friendly-name>",
455 geo: :us,
456 provider_config: {
457 type: :azure,
458 vault_uri: "https://<your-vault-name>.vault.azure.net/",
459 key_name: "<your-key-name>",
460 tenant_id: "<your-tenant-id>"
461 }
462 )
463
464 puts "id: #{external_key.id}"
465 puts "display_name: #{external_key.display_name}"
466 ```
467 </CodeGroup>
468
469 The `id` field of the response contains the external key ID. Copy it for the next two steps:
470
471 ```json
472 {
473 "type": "external_key",
474 "id": "ekey_<id>",
475 "display_name": "<friendly-name>"
476 }
477 ```
478 </Step>
479
480 <Step title="Validate the key">
481 Replace `ekey_<id>` with the external key ID.
482
483 <CodeGroup>
484 ```bash cURL
485 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
486 -H "x-api-key: $ANTHROPIC_API_KEY" \
487 -H "anthropic-version: 2023-06-01"
488 ```
489
490 ```bash CLI
491 ant organization:external-keys validate --external-key-id "ekey_<id>"
492 ```
493
494 ```python Python
495 client = anthropic.Anthropic()
496
497 validation = client.organization.external_keys.validate("ekey_<id>")
498
499 print(f"status: {validation.status}")
500 print(f"error: {validation.error}")
501 ```
502
503 ```typescript TypeScript
504 const client = new Anthropic();
505
506 const validation = await client.organization.externalKeys.validate("ekey_<id>");
507
508 console.log(`status: ${validation.status}`);
509 console.log(`error: ${validation.error}`);
510 ```
511
512 ```csharp C#
513 AnthropicClient client = new();
514
515 var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
516
517 Console.WriteLine($"status: {validation.Status.Raw()}");
518 Console.WriteLine($"error: {validation.Error}");
519 ```
520
521 ```go Go
522 client := anthropic.NewClient()
523
524 validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
525 if err != nil {
526 log.Fatal(err)
527 }
528
529 fmt.Printf("status: %s\n", validation.Status)
530 fmt.Printf("error: %s\n", validation.Error)
531 ```
532
533 ```java Java
534 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
535
536 var validation = client.organization().externalKeys().validate("ekey_<id>");
537
538 IO.println("status: " + validation.status().asString());
539 IO.println("error: " + validation.error().orElse(""));
540 ```
541
542 ```php PHP
543 $client = new Client();
544
545 $validation = $client->organization->externalKeys->validate(
546 externalKeyID: 'ekey_<id>',
547 );
548
549 echo "status: {$validation->status}\n";
550 echo "error: {$validation->error}\n";
551 ```
552
553 ```ruby Ruby
554 client = Anthropic::Client.new
555
556 external_key_id = "ekey_<id>"
557 validation = client.organization.external_keys.validate(external_key_id)
558
559 puts "status: #{validation.status}"
560 puts "error: #{validation.error}"
561 ```
562 </CodeGroup>
563
564 A successful response looks like this:
565
566 ```json
567 { "type": "external_key_validation", "status": "success", "error": null }
568 ```
569
570 If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
571 </Step>
572
573 <Step title="Attach the key to a workspace">
574 Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
575
576 Replace `<workspace-id>` with the workspace ID and `ekey_<id>` with the external key ID.
577
578 <CodeGroup>
579 ```bash cURL
580 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
581 -H "x-api-key: $ANTHROPIC_API_KEY" \
582 -H "anthropic-version: 2023-06-01" \
583 -H "content-type: application/json" \
584 -d '{
585 "external_key_id": "ekey_<id>"
586 }'
587 ```
588
589 ```bash CLI
590 ant organization:workspaces update \
591 --workspace-id "<workspace-id>" \
592 --external-key-id "ekey_<id>"
593 ```
594
595 ```python Python
596 client = anthropic.Anthropic()
597
598 workspace = client.organization.workspaces.update(
599 "<workspace-id>", external_key_id="ekey_<id>"
600 )
601
602 print(f"id: {workspace.id}")
603 print(f"external_key_id: {workspace.external_key_id}")
604 ```
605
606 ```typescript TypeScript
607 const client = new Anthropic();
608
609 const workspace = await client.organization.workspaces.update("<workspace-id>", {
610 external_key_id: "ekey_<id>"
611 });
612
613 console.log(`id: ${workspace.id}`);
614 console.log(`external_key_id: ${workspace.external_key_id}`);
615 ```
616
617 ```csharp C#
618 AnthropicClient client = new();
619
620 var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
621 {
622 ExternalKeyID = "ekey_<id>"
623 });
624
625 Console.WriteLine($"id: {workspace.ID}");
626 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
627 ```
628
629 ```go Go
630 client := anthropic.NewClient()
631
632 workspace, err := client.Organization.Workspaces.Update(
633 context.Background(),
634 "<workspace-id>",
635 anthropic.OrganizationWorkspaceUpdateParams{
636 ExternalKeyID: anthropic.String("ekey_<id>"),
637 },
638 )
639 if err != nil {
640 log.Fatal(err)
641 }
642
643 fmt.Printf("id: %s\n", workspace.ID)
644 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
645 ```
646
647 ```java Java
648 import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
649
650 void main() {
651 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
652
653 var params = WorkspaceUpdateParams.builder()
654 .externalKeyId("ekey_<id>")
655 .build();
656 var workspace = client.organization().workspaces().update("<workspace-id>", params);
657
658 IO.println("id: " + workspace.id());
659 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
660 }
661 ```
662
663 ```php PHP
664 $client = new Client();
665
666 $workspace = $client->organization->workspaces->update(
667 workspaceID: '<workspace-id>',
668 externalKeyID: 'ekey_<id>',
669 );
670
671 echo "id: {$workspace->id}\n";
672 echo "external_key_id: {$workspace->externalKeyID}\n";
673 ```
674
675 ```ruby Ruby
676 client = Anthropic::Client.new
677
678 workspace_id = "<workspace-id>"
679 workspace = client.organization.workspaces.update(
680 workspace_id,
681 external_key_id: "ekey_<id>"
682 )
683
684 puts "id: #{workspace.id}"
685 puts "external_key_id: #{workspace.external_key_id}"
686 ```
687 </CodeGroup>
688 </Step>
689 </Steps>
690 </Tab>
691 </Tabs>
216 <Steps>
217 <Step title="Open the encryption key settings">
218 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
219 </Step>
220
221 <Step title="Add the key">
222 Under **Encryption keys**, click **Add key**. Enter a **Display name**, select **Azure Key Vault**, and click **Continue**.
223 </Step>
224
225 <Step title="Enter the key details">
226 Check that your key has the **Organization tag** shown in the dialog box. Enter the **Vault URI**, **Key name**, and **Tenant ID**, leave **Client ID** empty, and click **Add**.
227 </Step>
228
229 <Step title="Verify the key">
230 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If **Connection failed** appears instead, see [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
231 </Step>
232
233 <Step title="Attach the key to a workspace">
234 <Warning>
235 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
236 </Warning>
237
238 1. At the top of the Data retention page, select the workspace from the dropdown menu.
239 2. Under **Encryption key**, select the key and click **Save**.
240 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
241
242 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
243
244 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
245 </Step>
246 </Steps>
692247 </Tab>
693248
694249 <Tab title="Claude Enterprise">
695 On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
250 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
251
252 <Warning>
253 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
254 </Warning>
255
256 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
696257
697258 <Steps>
698259 <Step title="Open the encryption key settings">
from line 265
704265 </Step>
705266
706267 <Step title="Enter the key details">
707 The dialog box shows an **Organization tag**. Check that your key has this tag. Enter these values:
708
709 * **Vault URI:** the `uri` value that you copied
710 * **Key name:** the name of the key
711 * **Tenant ID:** the `tenantId` value that you copied
712
713 Click **Add**.
714 </Step>
715
716 <Step title="Confirm that validation passed">
717 When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#troubleshoot-validation).
268 Check that your key has the **Organization tag** shown in the dialog box. Enter the **Vault URI**, **Key name**, and **Tenant ID**, leave **Client ID** empty, and click **Add**.
269 </Step>
270
271 <Step title="Confirm that the key was added">
272 The check can take up to 30 seconds. When **Encryption key configured.** appears, click **Done**. If **The encryption key couldn’t be added.** appears instead, [find the cause and retry](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-ai-add-fails).
273
274 Your key protects data written from then on. Tell your users [which features changed](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
718275 </Step>
719276 </Steps>
720277 </Tab>
721278</Tabs>
722
723## Troubleshoot validation
724
725If validation fails, common causes are:
726
727* **Wrong organization tag:** Make sure the key's current version has the tag `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. The organization ID must be the bare UUID in lowercase.
728* **RBAC propagation delay:** Role assignments can take a few minutes to take effect. Wait and retry.
729* **Network ACLs blocking Anthropic:** Confirm public network access and `ipRules`, as described in [Check your vault configuration](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#check-your-vault-configuration).
730* **Conditional access policies on workload identities:** If your tenant has conditional access policies that target service principals, exclude the Anthropic service principal. Or add Anthropic's outbound IP ranges to the policy's named locations.
731
732## Terraform
733
734To create the key with Terraform, use the `azurerm` and `azuread` providers.
735279
No line in this hunk matches that.