Dynamics 365 CE Online 8.2 currently supports BYOK scenarios while using an Azure Key Vault in the back (operated by Microsoft). Possibilities to bring your own key ere are limited to creatin a software key offline (PFX) or a hardware generated key (BYOK) via HSM.

Enterprise Customers expect more management and automation capabilities to manage the encryption key from their proper AKV (Azure Key Vault) this to enable further monitoring and logging where needed; https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault.

Also this will facilitate automation of key management operations like rotating the keys when needed.