---
title: "Key Move"
slug: "fortanix-dsm-key-move"
updated: 2026-04-01T08:01:23Z
published: 2026-01-24T03:26:34Z
canonical: "support.fortanix.com/fortanix-dsm-key-move"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Move

## 1.0 Introduction

This article describes the steps to move a key from one Fortanix-Data-Security-Manager (DSM) group to another, thereby modifying the group that the key belongs to.

## 2.0 Move Key

The **Key Move** feature of Fortanix DSM will allow users to move a Security-object from a standard Fortanix DSM will allow users to move a security object from one standard Fortanix DSM group to another.

The following actions will happen as part of the key move operation:

- The key will be moved from the source group to the target group: The new key retains the same key material as the original key.
- The key links will remain with the source group and are not transferred to the target group. You must update the key links to reference the new group where the key material now resides.
- The Key Rotation Policy is transferred to the target group along with the key.

> [!NOTE]
> NOTE
> 
> - The key move operation is applicable only for keys in Fortanix DSM groups.
> - It supports all the key types.
> - Keys can be moved only between two Fortanix DSM groups.
> - The key must comply with the target group’s Cryptographic-policy for the move to be successful.
> - You must have “write” access to both the source and target groups to perform the key move operation.
> - A key can be moved in any state except the `DELETED` state.
> - If a quorum policy is associated with the source group, it will be enforced during the move. Otherwise, the group change is immediate.
> - If the key is moved to a group with a different Key undo policy, the target group’s policy will apply.
> - If the target group has no Key undo policy, the existing policy from the source group remains in the source group.
> - Users, apps, and plugins of the source group will no longer have access to the key after it is moved to the target group.

Perform the following steps to move a key:

1. Go to the detailed view of a security object and in the **INFO** tab, click **CHANGE GROUP** under the **Group** section to initiate the key move operation.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768859442409.png)

**Figure 1: Initiate key move**
2. In the **CHANGE GROUP** dialog box, **Select destination group** to which you want to move the key to.
3. Select the check box to confirm your understanding about the action.
4. Click **SAVE** to move the key to the new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SO_Change_Dialog_Box.png)

**Figure 2: Change group**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

The Fortanix DSM supports cryptographic policies that can be set on accounts or groups to restrict what kind of keys can be created and the permitted operations. Policies are specified at the Account or Group level.

## Related

- [Fortanix DSM - Quickstart](/fortanix-data-security-manager-quickstart.md)
- [Logging](/fortanix-dsm-logging.md)
- [Authorization - User](/fortanix-dsm-authorization-user.md)
- [Group Quorum Policy](/fortanix-dsm-group-quorum-policy.md)
- [Fortanix DSM with Oracle TDE - Introduction](/using-fortanix-dsm-with-oracle-tde-introduction.md)