Encrypted SAML assertion

Hi,

We are configuring SAML login in our client cloud environment and we have seen in the documentation that Appian allows encryption for the SAML assertion "Appian supports signed, encrypted SAML assertions up to the AES-256 standard" but the information in the documentation is very limited.
The question we have is if we configure encryption with AES-256 in the IDP (Azure AD), how is the decryption key stored in Appian? Do we have to provide the key to Appian to store it internally or register it in the credential store?

Thanks in advance