Enabling Office 365 Built-In Email Encryption via PowerShell (Business Premium)

Overview

Microsoft 365 Business Premium includes built-in email encryption through Azure Information Protection (AIP) and Exchange Online's Information Rights Management (IRM). This guide walks through enabling these services using PowerShell — even when the tenant shows as "disabled" by default.

Prerequisites: You must be a Global Administrator in your Microsoft 365 tenant, and PowerShell must be running as Administrator.

---

Step 1: Install the Required PowerShell Modules

Open Windows PowerShell as Administrator, then install the three modules needed: Microsoft Graph, AIPService, and ExchangeOnlineManagement.

Install Microsoft Graph

Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force

If prompted to install the NuGet provider, type Y and press Enter.

Install AIPService

Install-Module -Name AIPService
Update-Module -Name AIPService

Install ExchangeOnlineManagement

Install-Module -Name ExchangeOnlineManagement

---

Step 2: Set Execution Policy

If you encounter errors importing Microsoft Graph modules, set the execution policy to allow scripts to run:

Set-ExecutionPolicy Bypass

When prompted, type A (Yes to All).

Then import the authentication module:

Import-Module Microsoft.Graph.Authentication

---

Step 3: Connect to Microsoft Graph and AIP

Connect to Microsoft Graph

connect-mggraph

If prompted about running software from an untrusted publisher, type A (Always run). A browser window will open — sign in with your Global Admin credentials.

Connect to Azure Information Protection

connect-aipservice

You should see: A connection to the Azure Information Protection service was opened.

---

Step 4: Enable Azure Information Protection

Check the current AIP status:

get-aipservice

If the result is Disabled, enable it:

enable-aipservice

You should see a success message:

The Azure Information Protection service has been successfully enabled although additional configuration of other services might be required.

Verify it's now enabled:

get-aipservice

The result should now read Enabled.

---

Step 5: Connect to Exchange Online

connect-exchangeonline

Sign in with your Global Admin credentials when the browser prompt appears.

---

Step 6: Configure IRM Settings

Enable Azure RMS licensing in Exchange Online IRM:

Set-IRMConfiguration -AzureRMSLicensingEnabled $True

Note: Don't forget the hyphen before the parameter name. Without it, PowerShell will throw a positional parameter error.

Verify the IRM configuration:

Get-IRMConfiguration

You should see:

Setting	Value
InternalLicensingEnabled	False
ExternalLicensingEnabled	True
AzureRMSLicensingEnabled	True

---

Step 7: Test IRM Configuration (Initial)

Run the IRM test to see if encryption is working:

Test-IRMConfiguration -Sender sender@yourdomain.com -Recipient user@yourdomain.com

If the result is FAIL with the message "Failed to acquire RMS templates", you need to configure the licensing location — continue to Step 8.

---

Step 8: Fix Licensing Location and Internal Licensing

If the test failed, retrieve the AIP service configuration and apply the licensing URL:

$RMSConfig = Get-AipServiceConfiguration
$LicenseUri = $RMSConfig.LicensingIntranetDistributionPointUrl
Set-IRMConfiguration -LicensingLocation $LicenseUri
Set-IRMConfiguration -InternalLicensingEnabled $true

This links Exchange Online's IRM to the Azure Information Protection licensing endpoint and enables internal licensing.

---

Step 9: Re-Test and Verify

Run the test again:

Test-IRMConfiguration -Sender sender@yourdomain.com -Recipient recipient2@yourdomain.com

If everything is configured correctly, you should see:

Results : Acquiring RMS Templates ...
- PASS: RMS Templates acquired. Templates available: Confidential \ All Employees, Highly Confidential \ All Employees, Encrypt, Do Not Forward.

Verifying encryption ...
- PASS: Encryption verified successfully.

Verifying decryption for recipient: recipient2@yourdomain.com ...
- PASS: Decryption verified successfully.

Verifying IRM is enabled ...
- PASS: IRM verified successfully.

OVERALL RESULT: PASS

Once you see OVERALL RESULT: PASS, email encryption is fully enabled for your tenant.

---

Step 10: Disconnect Sessions

Clean up your PowerShell sessions when finished:

disconnect-mggraph
disconnect-exchangeonline

Type A when prompted to confirm the Exchange Online disconnect.

---

Summary

Step	Command	Purpose
1	Install-Module	Install Graph, AIPService, ExchangeOnlineManagement
2	Set-ExecutionPolicy Bypass	Allow module imports
3	connect-mggraph / connect-aipservice	Authenticate to services
4	enable-aipservice	Turn on Azure Information Protection
5	connect-exchangeonline	Connect to Exchange Online
6	Set-IRMConfiguration -AzureRMSLicensingEnabled $True	Enable Azure RMS licensing
7	Test-IRMConfiguration	Verify encryption is working
8	Set-IRMConfiguration -LicensingLocation / -InternalLicensingEnabled $true	Fix RMS template acquisition
9	Test-IRMConfiguration	Confirm PASS result
10	disconnect-*	Clean up sessions

After completing these steps, users with Business Premium licenses can send encrypted emails using Outlook's Encrypt and Do Not Forward options, and the available RMS templates (Confidential, Highly Confidential, Encrypt, Do Not Forward) will be active across the tenant.