Any success with the new Microsoft 365 LTI?

Question

Has anyone completed the setup for the new Microsoft 365 LTI successfully? The instructions that they provide for setup on the Deploy the Microsoft 365 LTI® app in Brightspace by D2L page are the ones that I followed, BUT I noticed that when registering the new tool there wasn't a keyset URL provided before selecting the extensions (see screenshot of the setup instructions).

D2L requires that a Keyset URL be provided in order to select the Extensions, but when I reached out to Microsoft Support about this they were unable/unwilling (or just didn't understand what I was asking?) to provide a Keyset URL at this stage of the process. Microsoft Support directed me to use the "Brightspace Keyset URL" that you get when creating a deployment, but that results in an "Invalid JWT" error when trying to use the tool.

Has anyone had a different experience with this setup?

Scott.B.223 · Answer

UPDATE: if you use the JWK URLs, it will work for the Keyset URL.

Scott.B.223 · Answer

I've run into the same issue… I guess I'll contact MS and see what they say.

Raquel.B.1893 · Answer

Hi Kira,

You're absolutely right to flag the missing Keyset URL during the initial registration step. According to D2L's documentation on Tool Registration, Deployment, and Links, the Keyset URL is required before you can select any LTI Advantage extensions during tool registration. This is because Brightspace uses the Keyset URL to validate the tool's JWT signature during launch.

The confusion seems to stem from Microsoft's setup guide, which doesn't provide a Keyset URL at the registration stage. Instead, Microsoft support often refers admins to use the Brightspace Keyset URL (which is meant for validating Brightspace's own JWTs), but that’s not appropriate for registering an external tool like Microsoft 365 LTI. Using Brightspace’s Keyset URL in place of the tool’s own results in the “Invalid JWT” error you encountered.

What’s needed is Microsoft’s Keyset URL for the LTI tool itself, which should be hosted on their side and publicly accessible. If Microsoft hasn’t provided this yet, it might be a gap in their documentation or a limitation of the preview release.

You might want to ask Microsoft for:

* The Keyset URL for the Microsoft 365 LTI tool (not Brightspace’s).
* Confirmation that their LTI tool supports Standard Registration with extensions in Brightspace.
* Whether they plan to support Dynamic Registration, which would bypass the need to manually enter the Keyset URL.

Let me know if you have any question about it!

Raquel