Configurations on Azure and Microsoft Purview

Follow the procedures below to complete the configurations outside ESKM that are required for the integration.

Register Service with Azure

The following steps enable you to register your ESKM DKE service. Registering your ESKM DKE service is the last step in deploying DKE before you can start creating labels.

To register ESKM DKE service:

1. In your browser, open the Microsoft Azure portal, and go to All Services > Identity > App Registrations.

2. Select New registration and enter a meaningful name.

3. Select an account type from the options displayed either single or multi-tenant.

Register an application

4. At the bottom of the page, select Register to create the new App Registration.

5. In your new App Registration, in the left pane, under Manage, select Authentication.

6. Select Add a platform.

7. On the Configure platforms popup, select Web.

8. Under Redirect URIs, enter the URI of your double key encryption service. Enter the App Service URL, including both the hostname and domain and click on Configure button. For example: https://eskm.utimaco.com

9. Under Implicit grant, select the ID tokens checkbox.

10. Select Save to save your changes.

11. On the left pane, select Expose an API, next to Application ID URI, click on Set and enter your App Service URL, including both hostname and domain and click on Save.

12. Still on the Expose an API page, in the Scopes defined by this API area, select Add a scope. In the new scope:

    1. Define the scope name as user_impersonation.

    2. Select the administrators and users who can consent.

    3. Define any remaining values required.

    4. Select Add scope.

    5. Select Save at the top to save your changes.

13. Still on the Expose an API page, in the Authorized client applications area, select Add a client application. In the new client application:

    1. Define the Client ID as d3590ed6-52b3-4102-aeff-aad2292ab01c. This value is the Microsoft Office client ID and enables Office to obtain an access token for your key store.

    2. Under Authorized scopes, select the user_impersonation scope.

    3. Select Add application.

    4. Select Save at the top to save your changes.

    5. Repeat these steps, but this time, define the client ID as c00e9d32-3c8d-4a7d-832b-029040e7db99.

This value is the Azure Information Protection unified labeling client ID.

Create Sensitivity Labels using DKE

In the Microsoft Purview portal, navigate to the Information Protection section.

1. On Sensitivity Labels page, select + Create to start the new sensitivity label configuration.

2. On Provide basic details for this label, specify the following:

   1. Name – The name used to identify the sensitivity label in Microsoft Purview.

   2. Display name – The name displayed to users in applications where the label is published.

   3. Description for users – A description that helps users understand the purpose of the sensitivity label.

   4. Description for admins – A description for administrators who manage the sensitivity label.

Create label

3. Click on Next button.

4. On Define the scope for this label, select the required scope for the sensitivity label. For example, select Files & other data assets and click on Next button.

Define the scope for this label

5. On Choose protection settings for the types of items you selected, select Control access to configure permissions for content to which the label is applied. Since the primary purpose of this procedure is to secure the files, configure the appropriate access control settings. Select Apply content marking, and then select Next.

Choose protection settings

6. On Access control, configure the access settings as follows:

   1. Assign permissions now or let users decide? – Select Assign permissions now.

   2. User access to content expires – Select Never to allow users to access protected files without an expiration period.

   3. Allow offline access – Select Always.

   4. Under Assign permissions to specific users and groups, select Assign permissions and specify the users or groups that require access to the protected content.

   5. Select Use Double Key Encryption and enter the appropriate DKE Key URL obtained from the ESKM Cloud UI and select Next.

Use the DKE Key URL from the ESKM Cloud UI. Refer to Section Viewing Microsoft DKE Key Information.

Access control

7. On Content marking, configure how the sensitivity label is displayed on protected content. Enable Content marking, and configure the required watermark, header, and footer settings. Select Next.

Content marking settings

8. On Auto-labeling for files and emails, enable Auto-labeling for files and emails. Configure the required conditions for detecting content and select the action to be performed when the content matches the specified conditions. Then select Next.

Auto-labeling for files and emails

9. On Define protection settings for groups and sites, configure the required protection settings for groups and sites. These settings apply to teams, groups, and sites, and not directly to the files stored in them. Then select Next.

Define protection settings for groups and sites

10. On Review your settings and finish, review the configured settings and make any required changes. Select Create label to create the sensitivity label, and then select Done.

Review label settings

Publish the Sensitivity Label

After the sensitivity label is created, it must be published to make it available to users.

1. On Your sensitivity label was created, select Publish label to users' apps, and then select Done.

Sensitivity label created

2. On Publish label, select Create new label policy to create a new publishing policy, or select an existing Label Policy if an appropriate policy is already available.

Publish label

3. On Choose sensitivity labels to publish, select Choose sensitivity labels to publish, select the sensitivity label created earlier, and then select Add, and then select Next.

Choose sensitivity labels to publish

4. On Publish to users and groups, specify the users or groups for which the sensitivity label should be available, and then select Next.

Publish to users and groups

5. On Policy settings, configure the required policy settings as applicable:

   1. Users must provide a justification to remove a label or lower its classification.

   2. Require users to apply a label to their emails and documents.

   3. Require users to apply a label to their Fabric and Power BI content.

   4. Provide users with a link to a custom help page.

Then select Next.

Policy settings

6. Configure the default label settings for Documents, Emails, Meetings, and Fabric and Power BI as required on the subsequent pages, selecting Next after each configuration.

Default settings for documents

Default settings for emails

Default settings for meetings and calendar events

Default settings for Fabric and Power BI content

7. On Name your policy, enter a Name for the sensitivity label policy and, optionally, provide a Description. Select Next.

Name your policy

8. On Review and finish, review the policy configuration and make any required changes. Select Submit to create the policy.

Review and finish

9. On New policy created, verify that the policy was created successfully, and then select Done.

New policy created

Install Azure Information Protection Unified Labelling Client

Please ensure that the Azure Information Protection Unified Labeling Client is installed on each client machine. Use the following URL to download the Azure Information Protection Unified Labeling Client:

https://www.microsoft.com/en-us/download/details.aspx?id=53018

Verify Encryption and Decryption with DKE on Microsoft 365 Client

1. Log in to the client machine as a user for whom access has been provided while creating the key in Microsoft DKE instance. Refer to Creating a Key on Microsoft DKE.

2. Create a word document and assign a sensitivity label. (e.g., DKE).

Word Document

Encrypted word document

3. Save this file to any location.

4. Copy this file to another client machine and user with allowed access to this sensitivity label and DKE.

5. Open the file and verify that this authorized user is able to open the document.

Encrypted Word Document

6. Copy the same file to another client machine with a user who is not authorized to this sensitivity label and DKE.

7. Try to open the document. You will get an error with the below permission message.

Access denied message