The TL;DR

Microsoft 365 is marketed as secure. It is. But “secure” is not “zero-knowledge.” Microsoft controls the encryption keys, the processing plane, the identity provider, and the legal jurisdiction. Customer Key gives you a sign on the key rotation door — it does not lock the door. If your CISO says M365 is zero-knowledge, they’re confusing “Microsoft can’t read your data at rest” with “Microsoft can’t read your data in use.”

The Marketing vs. Reality Gap

Microsoft’s security pages present M365 as a fortress. Their encryption diagrams look clean. Customer Key sounds like you own the keys. But here’s what the marketing omits:

M365 is a server-side processing platform by design. Exchange Online scans spam and malware. SharePoint indexes content for search. Purview runs DLP policies. Copilot grounds answers over tenant content. Teams processes messages. All of this requires plaintext (or decrypted) content to flow through Microsoft-controlled systems. Customer Key encrypts data at rest. It does not prevent Microsoft from decrypting content in use for these features.

Customer Key improves control over data at rest. It does not make Microsoft 365 zero-knowledge.

The Evidence Chain

1. Customer Lockbox Proves Microsoft Needs Access

Customer Lockbox exists because there are scenarios where Microsoft engineers need access to customer content to resolve support issues. The existence of a governance control proves there is a technical path to access. Lockbox is accountability, not cryptographic opacity.

Evidence level: Strong — from Microsoft’s own docs.

2. New Outlook Syncs Third-Party Mailboxes Into Microsoft Cloud

When a user syncs a Gmail or Proton account to Outlook, a copy of email, calendar, and contacts is synchronized to Microsoft data centers. This is not a quirk — it’s the architecture. Mailbox.org, Proton, and Heise all reported this. Microsoft’s own support pages confirm it.

Evidence level: Strong — Microsoft docs + independent reporting.

3. The CLOUD Act Has No Geography

Microsoft’s CLOUD Act materials say the Act can seek data “regardless of where the data is stored.” Microsoft France’s legal director acknowledged in a French Senate context that Microsoft could not guarantee that EU customer data would never be transferred to US authorities without French approval.

EU data residency ≠ legal sovereignty. A Swiss company running M365 with data centers in Frankfurt is still subject to US law.

Evidence level: Medium-strong — Microsoft legal docs + Senate testimony.

4. EDPS Ruled EC’s M365 Use Illegal

In March 2024, the European Data Protection Supervisor found that the European Commission’s use of M365 infringed EU data protection law for EU institutions. The EDPS cited purpose limitation violations, insufficient control over processing, risk of unauthorized disclosure in diagnostic workflows, and international transfer concerns.

The EC only came into compliance after corrective measures in July 2025. The regulator did not prove “Microsoft is secretly reading everything.” But it confirmed M365 raised serious legal and governance concerns in an EU context.

Evidence level: Strong — EU regulator.

5. The ICC / Karim Khan Case: Sanctions Can Block M365 Access

When US sanctions hit ICC Chief Prosecutor Karim Khan, he lost access to his Microsoft email account. Microsoft denied actively blocking it — but the account went dark regardless. The ICC is now migrating to openDesk (LibreOffice-based suite).

The mechanism: US executive order → OFAC list → US companies + foreign subsidiaries comply → account inaccessible. The jurisdiction is the vulnerability, not the vendor’s intent.

Evidence level: Medium-strong — AP, Heise, Irish Times.

6. Swiss Data Protection Officers Have Spoken

The Swiss Conference of Data Protection Officers (Privatim) has taken the position that large SaaS solutions, including M365, do not offer true end-to-end encryption excluding provider plaintext access. This creates major restrictions for Swiss public bodies using M365 for sensitive data.

Evidence level: Medium-strong — Swiss authorities + Heise reporting.

7. Storm-0558: Microsoft’s Own Identity Is the Attack Surface

The 2023 Storm-0558 breach used a forged authentication token signed by a key generated by Microsoft to access 22 enterprise organizations including the US Department of State. The US CSRB later criticized Microsoft’s security culture and called the incident preventable.

Microsoft’s own central identity and cloud control plane is a systemic high-value target. Even if Microsoft itself behaves correctly, a compromise of Microsoft-controlled infrastructure exposes customer data.

Evidence level: Strong — Microsoft disclosure + CSRB report.

8. Customer Key’s Hidden Limitation

Customer Key covers Exchange Online, SharePoint Online, OneDrive, Teams, and Windows 365 Cloud PCs. But it does not prevent Microsoft from processing data while M365 services run. Search, indexing, malware scanning, eDiscovery, DLP, Copilot, web editing — all require decrypted content.

To make Customer Key effective, you must disable many M365 features. Most organizations don’t.

Evidence level: Strong — Microsoft docs.

9. Double Key Encryption: Closest to Zero-Knowledge, But Costly

DKE uses two keys: one controlled by Microsoft, one by the customer. Protected content requires both keys — Microsoft cannot decrypt alone. This is the closest Microsoft-native option to true zero-knowledge.

But DKE breaks: full-text search, indexing, web editing, co-authoring, eDiscovery, DLP, Copilot, mobile/browser workflows. It requires a customer-hosted DKE service with high availability.

It’s great for selected content. Impractical for all-tenant use.

Evidence level: Strong — Microsoft docs.

What’s Proven vs. What’s Myth

Proven or Strongly Supported

Claim Evidence
M365 is not zero-knowledge by default Architecture (server-side processing)
Microsoft can process customer content Exchange search, Purview, Copilot
Microsoft support access exists Customer Lockbox
Third-party mail syncs to MS Cloud New Outlook architecture
CLOUD Act applies regardless of storage Microsoft legal docs + French Senate
EU regulator found M365 non-compliant EDPS investigation
Sanctions can interrupt M365 access ICC / Khan case
Swiss DP authorities restrict M365 Privatim position
BYOK/Customer Key doesn’t stop in-use processing Feature requirements

Not Proven Publicly

Claim Status
Microsoft routinely reads enterprise emails manually No evidence
M365 customer content used for ad targeting No evidence
LLM training on commercial M365 data without permission No evidence
Governments have direct live backdoor to M365 No evidence
Microsoft employees browse customer SharePoint freely No evidence
Microsoft arbitrarily blocks enterprise accounts No evidence

The Practical CISO Classification

M365 Is Acceptable For

Normal corporate productivity data with strong controls:

  • Customer Lockbox enabled
  • Customer Key where justified
  • Restricted Copilot rollout
  • Disabled optional connected experiences
  • Purview DLP + sensitivity labels
  • Phishing-resistant MFA for admins

M365 Is High-Risk For

Data where provider-zero-knowledge matters:

  • Legal privilege
  • Government secrets, defense, intelligence
  • Sanctions-sensitive entities
  • Highly confidential corporate IP
  • Data requiring US legal exposure protection

For High-Risk Data, Use

  1. Double Key Encryption (selected content)
  2. External client-side encryption before upload
  3. Keep the data outside M365
  4. Use a zero-knowledge platform (Proton, Tuta, Tresorit)

The Bottom Line

Microsoft 365 protects customer data primarily through contractual, procedural, organizational, and service-security controls — not through a default cryptographic design that makes Microsoft technically unable to access customer content.

The honest CISO conversation is: “We accept Microsoft’s access in exchange for M365’s capabilities, and we’ve implemented controls to minimize the risk.”

That’s not a weak position. It’s a mature one.

The weak position is saying “M365 is zero-knowledge” because Customer Key sounds like you own the keys. You own the sign on the door. Microsoft still has the master key — and they use it every day for features you want.

Sources