Default time is 24 hours.Įnter the URL that the environment will be called on. How long Microsoft can use a DKE public key before they ask the PK Endpoint Manager for a new one. Alternatively, this can be left blank for pre-defined PK Endpoint Manager administrator permissions to be enforced for the configuration. Specifically define administrators who can edit or delete the DKE Configuration. Make sure to configure the MIP/Applications and MIP/Config page before continuing through this section to populate labels. In order for labels to appear in the label table they must be added from the "Import" button or added manually from the "Add" button. Once Labels are added to the Labels table shown on this page, they can be used in the MIP labels dropdown as a remediations option. This page allows administrators to view and import security Labels from Microsoft into the PK Endpoint Manager. After the import, you will see the imported DKE Keys in the DKE table list.Save the generated Key Transfer file to a convenient location.You may uncheck the box next to any keys you don't want to export. In Select Keys to Export, all existing Communities are checked by default.In the Upload Public Key to Target Server, browse to the JSON file saved in Step 3.On server One that has the DKE keys, go to DKE.Save the generated JSON file to a convenient location. Start on Server 2 that does not have the DKE keys yet, go the DKE page.Our manager allows you to export the existing keys from one server (server 1) to another server (server 2). Import & Export: Transferring DKE KeysĪt some point, you may need to move keys used for DKE from one environment to another. Note: Be sure to provide a unique name for a new DKE key. Please see Microsoft documentation for creating a sensitive label with DKE enabled for where to paste this within the Microsoft Compliance Center.Ĭlick the "Add" button to create a new DKE key. This link can be copied at the "Copy Link" option on the right most side of the table. The URL double key encryption service path that is used by administrators for defining the location of the key service. DKE Keysīoolean variable (yes or no) defining whether encryption with this key is enabledīoolean variable (yes or no) defining whether decryption with this key is enabled If a user tries to right-click Microsoft’s “Classify and Protect” in Explorer or select a label within an Office application, the DKE label will be available. When an end user authenticates with their Azure Active Directory, the unified labeling client will retrieve the appropriate DKE keys from the PEM service. Once the key and the users/groups associated with that key are created, the PEM will generate a URL that must be given to the Microsoft Information Protection label with DKE encryption. With that DKE controlled by the PEM, an administrator sets what users and groups should have access to the DKE key. The second key that customers control is managed by a cloud or on-premises instance of the PKWARE Enterprise Manager (PEM).
Without having both keys, Microsoft cannot decrypt files encrypted with DKE.
PKWARE OFFICE FULL
Microsoft Azure stores one key and the customer holds the second key, which means customers can finally maintain full control of one their keys. Microsoft DKE uses two keys to access protected content. Double key encryption allows organizations to utilize the seamless experiences with encrypted Office file types while also giving customers the benefit of knowing no one else outside their organization can decrypt their files, including Microsoft. Microsoft allows for customers to choose between different types of key management capabilities around their Information Protection suite Microsoft Managed Key, Bring Your Own Key, and Double Key Encryption. Administrators managing Microsoft’s Information Protection around double key encryption with PKWARE don’t have to worry about the aspects that come from enterprise key management scalability, auditability, durability, security, and high availability.
PKWARE key management support for Microsoft Double Key Encryption (DKE) provides organizations with a simple and seamless experience for administrators.