Microsoft Purview Message Encryption not working in Exchange Online: test, fix and verify

Microsoft Purview Message Encryption is usually switched on automatically, so when it breaks, admins are often unsure where to look. The cause is nearly always one of a few things: the Azure Rights Management service isn't active, the IRM configuration in Exchange Online is incomplete, or a mail flow rule doesn't do what people think. In this post I'll show how to test each layer, fix what fails and verify that encrypted mail reaches people outside the organization.

Symptoms#

Test-IRMConfiguration in Exchange Online PowerShell fails at the first step:

Results : Acquiring RMS Templates ...
- FAIL: Failed to acquire RMS templates. This failure may cause features such as Transport Protection Rules, IRM in OWA, and IRM in EAS to not work.

OVERALL RESULT: FAIL

• Get-IRMConfiguration shows AzureRMSLicensingEnabled : False.
• When you build a mail flow rule, the RMS template list under Apply Office 365 Message Encryption and rights protection is empty.
• Following an older guide, Import-RMSTrustedPublishingDomain -RMSOnline returns This cmdlet is deprecated. The Trusted Publishing Domain (TPD) for your organization is managed in Microsoft Azure Rights Management.
• External recipients still get the old HTML-attachment format instead of the current experience.
• A rule meant to encrypt incoming mail does nothing, or on-premises users' mail goes out unencrypted.

Why it happens#

Message Encryption is built on the Azure Rights Management service, the encryption service behind Microsoft Purview Information Protection. Microsoft says that's the only prerequisite. When the service is active, message encryption is enabled automatically, and Azure Rights Management is itself activated automatically for most eligible plans. Things break when:

• Azure Rights Management was disabled or never activated, or the sender has no license that includes it.
• The IRM configuration in Exchange Online is incomplete. AzureRMSLicensingEnabled is off, or the licensing location is missing, so Exchange can't get the templates.
• The tenant still uses AD RMS. Message Encryption isn't compatible with Active Directory Rights Management Services, so you have to migrate to Azure Rights Management first.
• Old rules. Rules that still use Apply the previous version of OME keep sending the legacy format. Microsoft deprecated the legacy Office 365 Message Encryption as of July 1, 2023.
• Expectations that don't match the design. You can't encrypt inbound mail from outside senders; it's delivered unencrypted. In hybrid, on-premises users get encryption only when their mail is routed through Exchange Online.

How to fix it#

1. Check the IRM configuration in Exchange Online.
   PowerShell

   Connect-ExchangeOnline
   Get-IRMConfiguration | Format-List AzureRMSLicensingEnabled, InternalLicensingEnabled, LicensingLocation
   
   # If AzureRMSLicensingEnabled is False
   Set-IRMConfiguration -AzureRMSLicensingEnabled $true

2. Confirm Azure Rights Management is active. Use the AIPService module. If Connect-AipService fails in PowerShell 7, run it in Windows PowerShell 5.1:
   PowerShell

   Install-Module -Name AIPService -Scope CurrentUser
   Connect-AipService
   Get-AipService      # should return Enabled
   Enable-AipService   # only if it returned Disabled

3. Fix "Failed to acquire RMS templates". Microsoft's documented fix copies the licensing URL from the Rights Management configuration into the Exchange Online IRM configuration. Run it in a session that's connected to both services:
   PowerShell

   $RMSConfig = Get-AipServiceConfiguration
   $LicenseUri = $RMSConfig.LicensingIntranetDistributionPointUrl
   Set-IRMConfiguration -LicensingLocation $LicenseUri
   Set-IRMConfiguration -InternalLicensingEnabled $true

   Don't use Import-RMSTrustedPublishingDomain -RMSOnline from older guides. As the error says, Azure Rights Management now manages the trusted publishing domain.
4. Create or update the mail flow rule. In the Exchange admin center, go to Mail flow › Rules. Under Do the following, choose Modify the message security › Apply Office 365 Message Encryption and rights protection and pick a template: Encrypt, Do Not Forward or one of your own. Remove any Apply the previous version of OME action from older rules. In PowerShell:
   PowerShell

   New-TransportRule -Name "Encrypt external [secure] mail" -FromScope InOrganization -SentToScope NotInOrganization `
       -SubjectContainsWords "[secure]" -ApplyRightsProtectionTemplate "Encrypt"

   To take encryption off mail from inside the organization, use Remove Office 365 Message Encryption and rights protection applied by the organization. For rule order and exceptions, see mail flow rules that don't backfire.
5. Check how recipients can open messages. People outside Microsoft 365 open an encrypted message through a portal. They sign in with an account the service supports or request a one-time passcode by email. If they never see the passcode option, check the branding template:
   PowerShell

   Get-OMEConfiguration | Format-List Identity, OTPEnabled, SocialIdSignIn

6. Hybrid: route on-premises mail through Exchange Online. The Exchange Server equivalent, with the RMS connector, is covered in Exchange Server IRM with the RMS connector.

Verify the fix#

Run the test with any two users in your tenant:

Test-IRMConfiguration -Sender securityadmin@contoso.com -Recipient securityadmin@contoso.com

Good looks like this, with your organization's name and template names:

Acquiring RMS Templates ...
- PASS: RMS Templates acquired. Templates available: Contoso - Confidential View Only, Contoso - Confidential, Do Not Forward.
Verifying encryption ...
- PASS: Encryption verified successfully.
Verifying decryption ...
- PASS: Decryption verified successfully.
Verifying IRM is enabled ...
- PASS: IRM verified successfully.

OVERALL RESULT: PASS

• Send a message that matches the rule to an external mailbox you control. It should arrive encrypted and open after sign-in or a one-time passcode.
• In message trace, the message's details should show your mail flow rule acting on it.
• In Outlook on the web, users should see the Encrypt option once their license includes Azure Rights Management.

Key takeaways#

• Check Azure Rights Management first, then AzureRMSLicensingEnabled, then the rules.
• Test-IRMConfiguration with -Sender and -Recipient is the quickest health check. Run it again after every change.
• Rules encrypt outbound and internal mail, not mail arriving from outside.
• Retire legacy OME actions and AD RMS before you troubleshoot anything else.

References#

• Set up Microsoft Purview Message Encryption (Microsoft Learn)
• Define mail flow rules to encrypt email messages (Microsoft Learn)