Configuring Microsoft Purview and Azure

To use the DKE module, you must create an application in Azure, then a Microsoft Purview sensitivity label in the Microsoft administration.

Creating the application in Azure

To enable Double‑Key Encryption (DKE), you first need to register a new application in Azure. For more information, follow the procedure in the Microsoft documentation.

When you reach the Expose an API section, next to Application ID URI, enter the BASE_URL (i.e., the value of the kacls_url parameter) that you specified in the authentication section. For more information, see the authentication table.

Creating a sensitivity label with DKE encryption

The sensitivity label determines which content should be protected using Double Key Encryption. You can give it any name of you choice, as it does not correspond directly to any Stormshield KMaaS parameter.

  1. From the Microsoft Purview portal, create a new sensitivity label.

  2. In the Encryption panel, check the Use Double Key Encryption option.

  3. Enter the public key endpoint URL exposed by the Stormshield KMaaS:
    /api/v1/{tenantid}/dke/{keyId}.

This endpoint must return a public RSA key in JWK format.

For more information, refer to the Microsoft documentation.