In order to receive the identity token that is used to decrypt DKE, you must register with Azure Entra or the Azure Portal. You must have an account in order to access one of these pages.

To register with Azure Entra

1. Navigate to https://entra.microsoft.com/.

2. Navigate to the App registrations page by clicking on App registrations in the 'Entra ID' section on the left, or by searching for App registrations using the search bar at the top of the page.

3. On the App registrations page, click New registration.

4. On the Register an application page, enter the name to use for the application.

5. Select the supported account type. You must select one of the following:

   • Accounts in this organizational directory only (MSFT only - Single tenant)

   • Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)

6. For the Redirect URI, select Web and enter the FQDN of the service.

7. Click Register.

8. On the App registration page for the application that you just registered, click Expose an API.

9. On the Expose an API page, enter the FQDN in the Application ID URI field, then click Save.

10. Click Add a scope.

11. In the Add a scope window, enter user_impersonation for the Scope name, Admin consent display name, and Admin consent description.

12. Click Add scope to return to the Expose an API page.

13. Click Add a client application.

14. In the Add a client application window, enter the Microsoft Office client ID. 

    d3590ed6-52b3-4102-aeff-aad2292ab01c

15. Check the checkbox for the scope you just added, then click Add application.

16. Click Add a client application again and enter the Azure Information Protection unified labeling client ID. 

    c00e9d32-3c8d-4a7d-832b-029040e7db99

17. Check the checkbox for the scope and click Add application.