We are currently attempting to introduce BYOK in our Fabric Capacity to support Power BI Premium. We have been able to successfully run the Add-PowerBIEncryptionKey command to add the key to the Power BI tenant. When we run the validation step Get-PowerBIEncryptionKey we can see that the key has been associated with the Power BI tenant.
Does anyone know whether successfully completing this step means PowerBI has been able to successfully connect with the key within Azure Key Vault or is it just storing the URI of the key at this point?
When we then go onto trying to enable BYOK on the Fabric capacity, we execute the Set-PowerBICapacityEncryptionKey command, however we don't get any output in PowerShell. The documentation for the command suggests there should be an output in the format System.Object. As mentioned we don't get any response. We are not clear whether this means the step has worked or hasn't worked. Does anyone know how we can validate whether a Fabric Capacity is using BYOK or not? The validation command Get-PowerBIWorkspaceEncryptionStatus seems to suggest it could be used, however this just seems to give an encryption status for each semantic model. I don't understand how this can indicate if BYOK has been enabled successfully on a Fabric Capacity.