m365DataAtRestEncryptionPolicyAssignments

Data-at-Rest Encryption Assignments. Bind data-at-rest encryption policies to the tenant. The m365DataAtRestEncryptionPolicyAssignments entity set lives under /exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-M365DataAtRestEncryptionPolicyAssignment, Set-M365DataAtRestEncryptionPolicyAssignment

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments`	List M365 data-at-rest encryption policy assignments - per-workload bindings of an active encryption policy.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments`	PATCH /m365DataAtRestEncryptionPolicyAssignments - assign a tenant-wide data-at-rest encryption policy. Body: { “dataEncryptionPolicy”: “<policyName>” }. Returns 204.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments

List M365 data-at-rest encryption policy assignments - per-workload bindings of an active encryption policy.

Backing cmdlet: Get-M365DataAtRestEncryptionPolicyAssignment. Role: OrganizationConfig.Read (Community).

PATCH /exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments

PATCH /m365DataAtRestEncryptionPolicyAssignments - assign a tenant-wide data-at-rest encryption policy. Body: { “dataEncryptionPolicy”: “<policyName>” }. Returns 204.

Backing cmdlet: Set-M365DataAtRestEncryptionPolicyAssignment. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dataEncryptionPolicy`	body		yes
`dryRun`	query	bool (switch)

Assign a tenant-wide M365 data-at-rest encryption policy

Sets the active tenant-wide Microsoft 365 data-at-rest encryption policy assignment by calling Set-M365DataAtRestEncryptionPolicyAssignment. This is a singleton-style PATCH on the collection (no key): there is exactly one active assignment per tenant.

PATCH /exchange/v1.0/m365DataAtRestEncryptionPolicyAssignments HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "dataEncryptionPolicy": "exonaut-sample-m365DataAtRestEncryptionPolicyAssignments"
}

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.