Skip to content

Remove a BYOK declaration

Withdraw your tenant's own key-protection backend before it is bound, so that the tenant is protected again by the backend above it: its edition's managed tier, or the deployment's.

Who can do it

A tenant administrator or a tenant key manager, or a platform super admin working inside the tenant. The console shows Withdraw declaration to anyone who can read the panel, and makes it unavailable, with the reason, to a person without the permission to manage the tenant's key-protection backend.

Before you start

  • The backend is declared and not yet bound. Withdrawing is possible only in that window. Once the backend is bound, the console says that withdrawing the declaration is no longer available and that there is no self-service way back: your keys then leave your own KMS only through a key custody move (see Move the tenant's keys to another backend).
  • To correct a wrong key coordinate or credential before the bind, you do not have to withdraw: Change backend re-declares the backend, its coordinates and its credential together.

Steps

  1. Open Settings in your tenant's navigation, then the Integrations tab.
  2. On the Key protection row, select its action. The key-protection panel opens over the page.
  3. Select Withdraw declaration.
  4. Read the confirmation Withdraw this tenant's declared backend?, which names the tenant, and select Withdraw and discard.

What you see when it worked

The console reports The declaration was withdrawn. This tenant is protected by the rung above it again. The panel returns to the state where nothing is declared, shows which backend now protects the tenant, and offers Configure a BYOK backend for this tenant again. The sealed credential is discarded with the declaration, and the withdrawal is written to your audit log.

If it fails

What you see Cause What to do
Unavailable for this tenant: the backend is already active, so the declaration can no longer be withdrawn The backend is bound Move the tenant's keys to another backend with a key custody move
Unavailable to you: your role does not include permission to manage this tenant's key-protection backend Your role lacks the permission Ask a tenant administrator or a tenant key manager
The withdrawal is refused when you confirm The backend was bound since the panel was read, or a declaration of the same tenant is still in progress Reload the panel and read its current state

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API DELETE /api/v3/admin/tenants/{tenantId}/key-backend/byok (operation deleteByok)