---
title: "New-VBREncryptionOptions"
description: "This cmdlet creates the VBREncryptionOptions object that defines encryption options."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/new-vbrencryptionoptions.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Microsoft EntraID Support > Tenant Backup Jobs > New-VBREncryptionOptions"
dateModified: "2026-08-20"
---

# New-VBREncryptionOptions

## Short Description
Defines encryption settings.

**Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax

This cmdlet provides the following parameter sets:

<ul class="syntax-sets">
  <li>
    <p><code>Disabled (Default)</code></p>

```
New-VBREncryptionOptions [-EnableEncryption] [<CommonParameters>]
```
  </li>
  <li>
    <p><code>PasswordDecryption</code></p>

```
New-VBREncryptionOptions [-EnableEncryption] -EncryptionKey <VBREncryptionKey> [<CommonParameters>]
```
  </li>
  <li>
    <p><code>KmsDecryption</code></p>

```
New-VBREncryptionOptions [-EnableEncryption] -KMSServer <VBRKMSServer> -KMSSourceName <String> [<CommonParameters>]
```
  </li>
</ul>

## Detailed Description
This cmdlet creates the `VBREncryptionOptions` object that defines encryption options.

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableEncryption</span></p>
        </td>
        <td>
          <p>Enables encryption.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EncryptionKey</span></p>
        </td>
        <td>
          <p>Specifies an encryption key. Veeam Backup & Replication will use this key to encrypt backup files.</p><p>Accepts the <code>VBREncryptionKey</code> object. To get this object, run the <a href="get-vbrencryptionkey.md"><code>Get-VBREncryptionKey</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>VBREncryptionKey</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">KMSServer</span></p>
        </td>
        <td>
          <p>Specifies the KMS server you want to use to encrypt the data.</p><p>Accepts the <code>VBRKMSServer</code> object. To get this object, run the <a href="get-vbrkmsserver.md"><code>Get-VBRKMSServer</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrkmsserver.md"><code>VBRKMSServer</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">KMSSourceName</span></p>
        </td>
        <td>
          <p>Specifies the displayed name for the key. The cmdlet will create a key and include this name into the key name on the KMS server.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
The cmdlet returns the [`VBREncryptionOptions`](vbrencryptionoptions.md) object that defines encryption options.

## Examples

::: example
### Example 1. Creating Encryption Options with Encryption Key

This example shows how to define encryption options with the encryption using an encryption key.

```
$encKey = Get-VBREncryptionKey -Description "For Entra ID encryption"
$encOptions = New-VBREncryptionOptions -EnableEncryption -EncryptionKey $encKey
```

Perform the following steps:

1. Run the [`Get-VBREncryptionKey`](get-vbrencryptionkey.md) cmdlet. Specify the `Description` parameter value. Save the result to the `$encKey` variable.
2. Run the `New-VBREncryptionOptions` cmdlet. Provide the `EnableEncryption` parameter. Set the `$encKey` variable as the `EncryptionKey` parameter value. Save the result to the `$encOptions` variable.

:::

::: example
### Example 2. Creating Encryption Options with KMS

This example shows how to define encryption options with the encryption using a KMS server.

```
$kmsServer = Get-VBRKMSServer -Name "thales.tech.local"
$encOptions = New-VBREncryptionOptions -EnableEncryption -KMSSourceName "EntraIDKey" -KMSServer $kmsServer
```

Perform the following steps:

1. Run the [`Get-VBRKMSServer`](get-vbrkmsserver.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$kmsServer` variable.
2. Run the `New-VBREncryptionOptions` cmdlet. Specify the following settings:

   - Provide the `EnableEncryption` parameter. 
   - Specify the `KMSSourceName` parameter.
   - Set the `$kmsServer` variable as the `KMSServer` parameter value.
   - Save the result to the `$encOptions` variable.

:::

## Related Commands

- [`Get-VBREncryptionKey`](get-vbrencryptionkey.md)
- [`Get-VBRKMSServer`](get-vbrkmsserver.md)