Fortanix Data Security Manager with Double Key Encryption for Microsoft 365

1.0 Introduction

This article describes how to integrate Fortanix Data Security Manager (DSM) with Microsoft 365 Double Key Encryption (DKE). It also contains the information that a user needs to:

  • Create Encryption Key in Fortanix DSM.
  • Configure and deploy the DKE Service in Microsoft Azure/IIS.
  • Create Sensitivity label with DKE encryption enabled in Microsoft 365 account.
  • Use Double Key Encryption labels to protect data.

2.0 Prerequisites

  • A Fortanix DSM Account.
  • Access to the following services in the Microsoft Azure Portal:
    • App Services (if deploying DKE service on Azure)
    • Active Directory
    • App Registration
  • Microsoft Compliance Center
  • For Microsoft (MS) Office end-user: Microsoft 365 Apps for enterprise version 2009 or later installed on your Windows Desktop.
    • Make sure Microsoft Active Directory Rights Management Services Client file msipc.dll is installed at one of these locations.
      • C:\Program Files (x86)\Microsoft Office\root\Office16\MSIPC
      • C:\Program Files\Microsoft Office\root\Office16\MSIPC
    • If not present, try reinstalling MS Office.

3.0 Configuring Fortanix Data Security Manager

An asymmetric encryption key is required to be created in Fortanix DSM in your organization’s account. This key would later be exposed through REST API to DKE Service for consumption by Microsoft 365. Following are the steps to configure the key:

  1. Log in to your organization’s Fortanix DSM account. For testing purposes, a trial account can be created here
  2. Go to the Security Objects page and click the + button to create a new key.
  3. Enter the Security Object name. In this document, the key name used is MicrosoftDKEServiceKey.
  4. Assign the key to an existing group or create a new group.
  5. Select GENERATE to generate a new key.
  6. Select the key type as RSA. MicrosoftDKE1.png MicrosoftDKE2.png Figure 1: Create an RSA key
  7. In the same group as the new security object, create a new App. Copy the API Key on this app. Refer to the Fortanix DSM Getting Started Guide for steps to create an App. This would be required while deploying the DKE Service. MicrosoftDKE3.pngFigure 2: Copy the API key of the App

4.0 Deploy DKE Service

A Double Key Encryption Service is required to be deployed, which exposes the external key for use by Microsoft 365 services. Microsoft provides a sample DKE Service code which works with local encryption key file

Fortanix provided DKE Service is enhanced to add support for Fortanix DSM Keys. This now serves keys and offloads decryption operations to Fortanix DSM, instead of operating on local key files.

The DKE service can be easily installed as Azure App Service or on your on-premises IIS Server.

4.1 Deploy on IIS

  • Download the DKE Service deployment bundle from here
  • Unzip this zip file into the IIS wwwroot folder. For example: C:\inetpub\wwwroot\AspNetCore46
    • Edit the appsettings.json file and add configurations as per Section 4.3.
    • Load your application.
    Make sure that the IIS deployment is accessible over the internet to your Microsoft Office end-user. This is because Microsoft Apps directly access DKE Service for Key access and decryption.

4.2 Deploy on Azure App Service

  1. Download the DKE Service deployment bundle from here
  2. Unzip this zip file locally into some temporary folder. Edit the appsettings.json file and add configurations as per Section 4.3. Zip the folder again and keep it ready for Section 4.2.1.
  3. In your browser, sign in to the Microsoft Azure portal and go to App Services > Create.
  4. Select your subscription and resource group and define your instance details.
  5. Enter the Name which will form the DKE Service endpoint.
  6. For the Publish field, select code.
  7. For the Runtime stack field, select .NET Core 3.1 (LTS).
  8. At the bottom of the page, click Review + create, and then select Add. MicrosoftDKE4.pngFigure 3: Create web app

4.2.1 Publish Code

After the Web App is created, the actual DKE Service can be installed by uploading the DKE service artifact zip file as following:

  1. Go to “https://<WebAppName>".
    For example:
  2. Drag and drop the DKE service zip file as per Step 2 of Section 4.2.

4.3 Configure DKE Service

The DKE service requires a few configurations to be set up as explained in the sections below. Set the deployment configuration in the file appsettings.json as following:

4.3.1 Tenant ID

Edit the section ValidIssuers and update the value:<tenantid>/

where <tenantid> is the Azure Active Directory tenant ID. For example:

"AzureAd": {
"Instance": "",
"ClientId": "[Client_id-of-web-api-eg-2ec40e65-ba09-4853-bcde-bcb60029e596]",
"TenantId": "common",
"Authority": "",
"TokenValidationParameters": {
"ValidIssuers": [
" a7d9-e7b500002d4b/"

4.3.2 JWT Audience

Edit the section JwtAudience with the endpoint of the IIS server or Azure App Service endpoint. For example:

"JwtAudience" : ""

4.3.3 DSM API Endpoint

Edit the section FortanixDSMConfig:ApiEndpoint with the endpoint of the Fortanix DSM cluster. For example:

"FortanixDSMConfig": {
"ApiEndpoint": ""

4.3.4 DSM API Key

Edit the section FortanixDSMConfig:ApiKey with the authentication DSM API Key copied from Section 3. For example:

"FortanixDSMConfig": {
"ApiKey": "BJ0oijJYHYU78h6g...05KGkh84GJLK"

4.3.5 Authorized Email Addresses

This is an optional configuration.

Add section AuthorizedEmailAddress with the list of specific users allowed to use Fortanix DSM Keys for decryption. If this is empty or not present, then all the users from your Azure AD tenant are allowed access. For example:

"AuthorizedEmailAddress": ["", ""]

4.3.6 Final Configuration

The following is an example of the final appsettings.json file:

"AzureAd": {
"Instance": "",
"ClientId": "[Client_id-of-web-api-eg-2ec40e65-ba09-4853-bcde-bcb60029e596]",
"TenantId": "common",
"Authority": "",
"TokenValidationParameters": {
"ValidIssuers": [""]
"Logging": {
"LogLevel": {
"Default": "Information"
"EventLog": {
"LogLevel": {
"Default": "Information"
"AllowedHosts": "*",
"JwtAuthorization": "",
"JwtAudience" : "",
"AuthorizedEmailAddress": ["", ""],
"FortanixDSMConfig": {
"ApiEndpoint": "",
"ApiKey": "BJ0oijJY...0kh84GJLK"

4.4 Register DKE App in Azure AD

The deployed DKE Service must be registered for Microsoft 365 access. This registration allows Microsoft apps to generate authentication tokens for the DKE service.

  1. In your browser, open the Microsoft Azure portal, and go to All Services > Other > App registrations.
  2. Select New registration and enter a meaningful name.
  3. Select an account type from the options displayed (usually the value to be selected is “Single tenant”). MicrosoftDKE6.pngFigure 4: Register application
  4. At the bottom of the page, select Register to create the new App Registration.
  5. In your new App Registration, in the left pane, under Manage, select Authentication.
  6. In the Platform configurations, click Add a platform.
  7. On the Configure platforms popup, select Web.
  8. Under Redirect URIs, enter the URI of your double key encryption service. Enter the DKE Service Endpoint URL, For example:
  9. Under Implicit grant and hybrid flows, select the ID tokens check box.
  10. Click Configure to save your changes.
  11. On the left pane, select Expose an API, then next to Application ID URI, click Set. Enter the DKE Service endpoint URL, For example: Click Save.
  12. On the Expose an API page, in the Scopes defined by this API section, select Add a scope. In the new scope form:
    1. Define the Scope name as user_impersonation.
    2. Select the administrators and users who can consent.
    3. Define any remaining values required.
    4. Click Add scope to save your changes.
  13. On the Expose an API page, in the Authorized client applications section, select Add a client application. In the new client application:
    1. Define the Client ID as d3590ed6-52b3-4102-aeff-aad2292ab01c (Please use this exact value). This value is the Microsoft Office client ID which enables Office to obtain an access token against the DKE Service.
    2. Under Authorized scopes, select the user_impersonation
    3. Click Add application to save your changes.
  14. Repeat the above steps for another Client ID as c00e9d32-3c8d-4a7d-832b-029040e7db99 (Please use this exact value). This value is the client ID for Microsoft Azure Information Protection Client.

4.5 Create Sensitivity Labels using DKE

In the Microsoft 365 compliance center:

  1. Create a new sensitivity label and apply encryption as you would otherwise.
  2. Select Use Double Key Encryption and enter the endpoint URL for your key. For example:
    Where MicrosoftDKEServiceKey is the name of the Fortanix DSM Key created in Section 3.0. MicrosoftDKE7.pngFigure 5: New sensitivity label

    Any DKE labels that you add will start appearing for users in the latest versions of Microsoft 365 Apps for the enterprise.

    Now you can apply these labels to the Microsoft Documents. Once these labels are applied, the document is kept encrypted using Fortanix DSM Keys.

5.0 References

  1. Double Key Encryption for Microsoft 365:
  2. Double Key Encryption Troubleshooting guide by Microsoft:
  3. Fortanix DSM Getting started:
Was this article helpful?
0 out of 0 found this helpful