Double Key Encryption (DKE) requires a Microsoft 365 enterprise account at level E5 and Windows desktop versions of Microsoft Office applications.

1. When you save a document in Microsoft Office, you see a menu of labels.
2. When you choose the DKE label, the Office application contacts the URL specified in the label to obtain the public key and a decryption URL.
3. When you open a document with a DKE label, the Microsoft Office application contacts the decryption URL with an identity token. A registered Azure application provides the token and is associated with the decryption URL FQDN.