In Early 2017 Microsoft announced that all new Dynamics 365 instances will be encrypted at the SQL Server level using Transparent Data Encryption (TDE) as described in https://technet.microsoft.com/en-us/library/jj134930.aspx#BKMK_Securing. Shortly after the announcement Microsoft enabled a feature to allow its customers to control the TDE key through the Dynamics 365 Administration Centre. By default, the key will be defined by Microsoft until an administrator changes it.
In order to change the key, you will need an instance of Dynamics 365 with a Plan 1 or Plan 2 subscription (sandbox or production). You also need a user with either Office 365 Dynamics service administrator (or higher, such as global administrator) or with the Dynamics 365 System Administrator security role.