In multi-tenant environments, a lazy migration plus background re-encryption strategy is used, with data progressively re-encrypted in batches of 100 records, a process that can be paused and resumed with progress saved in the keyring document.