Key provisioning using [MS-KPP]: Key Provisioning Protocol

Anonymous

I am trying to find an official specification to enroll NGC Keys into AD and Azure AD.

Is this the right specification to follow for provisioning keys in Hybrid Azure AD Environment?

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kpp/25ff7bd8-50e3-4769-af23-bcfd0b4d4567

Is the provisioning server mentioned in this documents part of Azure AD Connect?

I appreciate any insight into this.

Anonymous

2021-08-12T16:18:12.44+00:00

@AmanpreetSingh-MSFT or @Andy David - MVP
I
I appreciate your response to this question.
David Mulder 0 Reputation points

2024-03-04T18:01:09.6666667+00:00

I tried adding an NGC key for Azure AD, and the MS-KPP protocol spec does appear to be correct. You can discover the correct endpoint for key enrollment by calling GET https://enterpriseregistration.windows.net/{tenant_id}/Discover?api-version=1.9
You need to set the headers Bearer (to your access token), ocp-adrs-client-name (to some client name), and ocp-adrs-client-version (the client version). The KeyProvisioningService is what you're looking for in the response. The resource_id in that KeyProvisioningService is the resource you'll need to request via MSAL when getting an access token for this service.