This blog post is intended to show how to publish Double Key Encrytion (DKE) reference implementation in an on-premises Windows Server with IIS – keeping full control over the key and the service.
Double Key Encryption (DKE) is a new feature, which enables customers to protect their most confidential content using a key they control, thereby allowing them to comply with regulatory requirements. DKE ensures that Microsoft cannot access their data under any circumstances.
The quickest way to get the DKE reference implementation running is by publishing it to Azure – detailed steps can be found in our documentation . However, many of our customers prefer to test and run DKE on-premises – here we describe the necessary steps to implement this option.
For this post, we assume the server will be reachable under the following URL:
https://aip-dke4.contoso-o365.net
(Make sure the DNS domain of the URL used is registered on your Azure AD tenant.)
Whether the DKE service is published on Azure or on IIS, the following preparation steps from our documentation are required:
By going through the following steps, the virtual machine is provisioned and IIS is installed:
The following steps are needed to complete the DKE implementation (refer again to our documentation)
7. Validate your deployment
8. Register your key store
9. Create sensitivity labels using DKE
10. Enable DKE in your client
11. Migrate protected files from HYOK labels to DKE labels
By publishing the DKE service on an on-premises server with IIS, customers maintain full control over the key used for protecting their most sensitive content.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.