Exchange Server IRM with the RMS connector: fixing Test-IRMConfiguration failures

With the Microsoft Rights Management (RMS) connector, Exchange Server can use the cloud Azure Rights Management service for IRM: opening protected mail in Outlook on the web, decrypting journal reports and running transport protection rules. When that breaks, Test-IRMConfiguration shows which step fails. Here's how the pieces connect, how to read the output and how to fix each failing step.

Errors this guide fixes

Failed to acquire a use licenseTest-IRMConfiguration
The attempt to discover the location of the administration service and organization failed.RMS connector setup wizard

Jump to the fix Browse the Exchange Server error library

At a glance: how this guide is organised · 6 fix steps · 5 key tools

Symptoms#

Users can encrypt mail with sensitivity labels in Outlook, but Outlook on the web and mobile users with on-premises mailboxes can't open protected messages, journal reports stay encrypted, or transport protection rules don't apply.
Test-IRMConfiguration -Sender user@contoso.com reports FAIL on one of its steps. This is the run Microsoft's KB 2805976 shows, every step passing until the use license (its example uses AD RMS host names; you'll see your own):

Text

Results : Checking Exchange Server ...
              - PASS: Exchange Server is running in Enterprise.
          Loading IRM configuration ...
              - PASS: IRM configuration loaded successfully.
          Retrieving RMS Certification Uri ...
              - PASS: RMS Certification Uri: https://rms.contoso.com/_wmcs/certification.
          Verifying RMS version for https://rms.contoso.com/_wmcs/certification ...
              - PASS: RMS Version verified successfully.
          Retrieving RMS Publishing Uri ...
              - PASS: RMS Publishing Uri: https://rms.contoso.com/_wmcs/licensing.
          Acquiring Rights Account Certificate (RAC) and Client Licensor Certificate (CLC) ...
              - PASS: RAC and CLC acquired.
          Acquiring RMS Templates ...
              - PASS: RMS Templates acquired.
          Retrieving RMS Licensing Uri ...
              - PASS: RMS Licensing Uri: https://rms.contoso.com/_wmcs/licensing.
          Verifying RMS version for https://rms.contoso.com/_wmcs/licensing ...
              - PASS: RMS Version verified successfully.
          Creating Publishing License ...
              - PASS: Publishing License created.
          Acquiring Prelicense for 'user@contoso.com' from RMS Licensing Uri (https://rms.contoso.com/_wmcs/licensing)...
              - PASS: Prelicense acquired.
          Acquiring Use License from RMS Licensing Uri (https://rms.contoso.com/_wmcs/licensing)...
              - FAIL: Failed to acquire a use license. This failure may cause features such as Transport Decryption,
                Journal Report Decryption, IRM in OWA, IRM in EAS and IRM Search to not work.

In the KB, the FAIL text continues with AD RMS-specific advice about super user rights for the FederatedEmail arbitration account; the cause Microsoft found behind Failed to acquire a use license was stale cached data (step 6).
Installing the connector can stop with: The attempt to discover the location of the administration service and organization failed. Make sure Microsoft Rights Management service is enabled for your organization.

Why it happens#

The chain has four links, and the first FAIL tells you which one is broken:

Tenant: the Azure Rights Management service must be activated, and your Active Directory users and groups must be synchronized to Microsoft Entra ID. Microsoft is explicit that the connector needs synchronized accounts; manually created cloud accounts aren't enough.
Connector: at least two connector servers behind one load-balanced name, with your Exchange servers authorized in the RMS connector administration tool. If onboarding controls limit the protection service to a group, the account you enter in the connector setup wizard must be a member, or you get the "attempt to discover the location" error.
Exchange servers: registry settings written by the server configuration tool, GenConnectorConfig.ps1, redirect Exchange's RMS client to the connector. Microsoft's page covers the Mailbox servers of Exchange 2016 and 2019 (Exchange 2013 needs CU3 or later) and an RMS client that supports Cryptographic Mode 2, which Windows Server 2012 and later include.
Exchange organization: IRM is switched on with InternalLicensingEnabled and ClientAccessServerEnabled.

First failing step	Usual cause	Go to
Retrieving or verifying a Certification, Publishing or Licensing Uri; acquiring the RAC and CLC	Exchange can't reach the connector or isn't authorized: registry not written, one connector server's name instead of the load-balanced name, DNS, firewall or HTTPS trust, leftover AD RMS settings	Steps 2 and 3
Acquiring RMS Templates, or a template missing from `Get-RMSTemplate`	Connectivity as above, or template scope: departmental templates used by transport rules need the application compatibility option	Steps 2 and 5
Prelicense or use license	Stale cached identity or licensing data on the Exchange server, or a test sender that isn't a synchronized user	Step 6

How to fix it#

1. Confirm the tenant side#

PowerShell

Connect-AipService
Get-AipService
Get-AipServiceConfiguration | Format-List LicensingIntranetDistributionPointUrl

Get-AipService should return Enabled. Strip /_wmcs/licensing from the LicensingIntranetDistributionPointUrl value and you have your tenant's Azure Rights Management URL, the address the registry redirection maps to the connector.

Note: Microsoft's connector configuration page was last updated in 2022 and lists Exchange 2013 CU3, 2016 and 2019. It doesn't mention Exchange Server SE (KB 2805976, by contrast, now lists SE), so confirm Microsoft's support position before you rely on the connector for SE servers.

2. Check the connector and its authorization list#

Open the RMS connector administration tool on a connector server and confirm that every Exchange Mailbox server, or the group that contains them, is allowed to use the connector.
From each Exchange server, test the load-balanced name, not a single connector server:

PowerShell

Resolve-DnsName rmsconnector.contoso.com
Test-NetConnection rmsconnector.contoso.com -Port 443

If the connector uses HTTPS, the Exchange servers must trust the certificate presented on that name.

3. Rewrite the registry settings#

Run the server configuration tool on each Exchange Mailbox server, never on the connector servers, with the load-balanced URL. Microsoft's example for Exchange 2016 and 2013:

PowerShell

Get-Help .\GenConnectorConfig.ps1 -Detailed
.\GenConnectorConfig.ps1 -ConnectorUri https://rmsconnector.contoso.com -SetExchange2013

Use Get-Help to confirm which switch your copy of the script expects for Exchange 2019. To check values by hand, use Microsoft's "Registry settings for the Rights Management connector" page; on Exchange 2016 and 2019 these two keys carry the redirection:

PowerShell

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\IRM\LicenseServerRedirection'
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\IRM\CertificationServerRedirection'

Each should hold a value named after your tenant's Azure Rights Management URL whose data is the connector's load-balanced URL. Restart the server only if it was previously configured for AD RMS.

4. Switch IRM on#

PowerShell

Set-IRMConfiguration -InternalLicensingEnabled $true -ClientAccessServerEnabled $true
Get-IRMConfiguration | Format-List InternalLicensingEnabled,ClientAccessServerEnabled,JournalReportDecryptionEnabled,TransportDecryptionSetting,SearchEnabled

ClientAccessServerEnabled lets Exchange open protected mail for Outlook on the web and Exchange ActiveSync clients. Without it, those clients can't display protected messages even when Outlook can.

5. Check the templates transport rules use#

PowerShell

Get-RMSTemplate | Format-Table Name

If a template that a transport protection rule needs is missing, check its scope: Microsoft notes that departmental templates used with Exchange transport rules need Show this template to all users when the applications do not support user identity selected.

6. Reset the cache when the use license fails#

KB 2805976 traces "Failed to acquire a use license" to Exchange using cached identity and licensing data from a deleted and recreated FederatedEmail arbitration mailbox (see recreating arbitration mailboxes). Microsoft's resolution:

PowerShell

Set-IRMConfiguration -InternalLicensingEnabled $false
# Back up, then delete the folders in C:\ProgramData\Microsoft\DRM\Server (hidden system folder)
# Restart the Exchange server, then:
Set-IRMConfiguration -InternalLicensingEnabled $true
Test-IRMConfiguration -Sender user@contoso.com

The KB describes AD RMS deployments. The cache lives on the Exchange server, so the same reset is a reasonable step after a move from AD RMS to the connector, alongside the restart that move needs.

Verify the fix#

Run Test-IRMConfiguration -Sender user@contoso.com again. Good looks like PASS on every step and an overall pass.
Open a protected message in Outlook on the web from a normal workstation. Don't test with Outlook on an Exchange server: Microsoft warns that client applications on servers configured for the connector might not work with RMS.
If you journal and JournalReportDecryptionEnabled is True, new journal reports should carry a decrypted copy of protected messages.
Check the Application log on the connector servers for warnings when Exchange servers connect.

Key takeaways#

Fix the first FAIL first; later steps depend on the earlier ones.
Use the connector's load-balanced name, and keep the authorization list in step with your Mailbox servers.
Re-run the test after each cumulative update and any arbitration mailbox change.
For what IRM adds on top of Purview labels, see Purview DLP and sensitivity labels with Exchange Server.

Exchange Server IRM with the RMS connector: fixing Test-IRMConfiguration failures

Symptoms#

Why it happens#

How to fix it#

1. Confirm the tenant side#

2. Check the connector and its authorization list#

3. Rewrite the registry settings#

4. Switch IRM on#

5. Check the templates transport rules use#

6. Reset the cache when the use license fails#

Verify the fix#

Key takeaways#

References#

Omer Eltayeb

Exchange Server IRM with the RMS connector: fixing Test-IRMConfiguration failures

Symptoms#

Why it happens#

How to fix it#

1. Confirm the tenant side#

2. Check the connector and its authorization list#

3. Rewrite the registry settings#

4. Switch IRM on#

5. Check the templates transport rules use#

6. Reset the cache when the use license fails#

Verify the fix#

Key takeaways#

References#

Omer Eltayeb

More Exchange Server articles

DLP and encryption gateways for Exchange Server (Forcepoint, Trellix): routing and loops

Veeam Backup & Replication with Exchange Server: VSS writer errors and logs not truncating

Veeam Explorer for Microsoft Exchange: ese.dll, Dirty Shutdown and permission errors