Automation Suite on EKS/AKS installation guide

Last updated Mar 31, 2026

Configuring encryption key per tenant

To configure the encryption key per tenant, take the following steps:

Update the Orchestrator parameters. In the configuration file, under orchestrator, add the encryption_key_per_tenant section. For more details, see Configuring Orchestrator parameters.
```
"orchestrator": {
  "enabled": true,
  "encryption_key_per_tenant": {
      "certificate_base_64": "",
      "certificate_password": "",
      "client_id": "",
      "directory_id": "",
      "vault_address": ""
  }
}
"orchestrator": {
  "enabled": true,
  "encryption_key_per_tenant": {
      "certificate_base_64": "",
      "certificate_password": "",
      "client_id": "",
      "directory_id": "",
      "vault_address": ""
  }
}
```
You must convert the certificate to base64 before using it as a parameter override. To do that, run the following command:
- PowerShell
  [convert]::ToBase64String((Get-Content -path "path_to_certificate" -Encoding byte))[convert]::ToBase64String((Get-Content -path "path_to_certificate" -Encoding byte))
- Shell
  base64 [_path_to_certificate_]base64 [_path_to_certificate_]
Apply the new configuration, and then wait for the Orchestrator ArgoCD app to synchronize.
Enable the EncryptionKeyPerTenant feature by setting the following keys in appSettings:
```
"EncryptionKeyPerTenant.Enabled": "true", "EncryptionKeyPerTenant.KeyProvider": "AzureKeyVault",
"EncryptionKeyPerTenant.Enabled": "true", "EncryptionKeyPerTenant.KeyProvider": "AzureKeyVault",
```
For more on updating appSettings, see Configuring appSettings.

Note:
SMTP settings in Identity Server are not encrypted with the per-tenant key. After enabling encryption key per tenant, make sure to re-enter the SMTP password in the Automation Suite portal.

Was this page helpful?

PREVIOUSConfiguring credential stores

NEXTCleaning up the Orchestrator database