Microsoft certification badges banner
Headshot of Michael Korting

Blog

Microsoft 365 • Security • Compliance

2026‑05‑23 • Microsoft Purview • Exchange Online • Message Encryption

Enable Microsoft Message Encryption (MME) & IRM — Why Older M365 Tenants Must Verify This

Microsoft 365 tenants created before mid‑2019 may not have Message Encryption and Information Rights Management enabled by default. This post walks through how to check, enable, validate, and troubleshoot the configuration using PowerShell.

Why this matters (especially for older tenants)

If your tenant was created before mid‑2019, it may not have been initially configured with Microsoft Message Encryption and Information Rights Management (IRM) enabled. That means users may not see expected encryption options in Outlook/OWA, and compliance features that depend on the Rights Management service can fail or behave inconsistently until the tenant-side prerequisites are turned on.

In practical terms: you can assign the “right” licenses and configure the “right” policies — and still find that encryption, protected messages, and IRM-based behaviors don’t work until the foundational service is enabled and Exchange IRM is configured.

What you’re enabling (at a high level)

  • Azure Information Protection / Rights Management service (often abbreviated as AIP / RMS) for your tenant.
  • Exchange Online IRM configuration so Exchange can use RMS for licensing and protection workflows.
  • Simplified client access in Exchange if the Encrypt button does not appear after a successful configuration test.

Prerequisites

  • You’ll need an account that can authenticate with appropriate admin permissions (commonly Global Admin for tenant-level enablement steps).
  • PowerShell execution policy and module installation must be permitted on your admin workstation.
  • Expect propagation delays. Some changes may take up to 24 hours to reflect fully in clients and services.

Step-by-step: Enable Microsoft Message Encryption & IRM

1) Install the Azure Information Protection Service PowerShell module

The AIPService module is used to connect to the tenant’s Rights Management service and check/enable it. 

Install-Module -Name AipService
Import-Module -Name AipService

2) Connect to the Azure Information Protection service

Authenticate when prompted (commonly using Global Admin credentials).

Connect-AipService

3) Check whether the AIP / Rights Management service is enabled

Get-AipService

If the service is disabled, enable it and check again. In some environments, the enablement can take time to fully propagate (up to 24 hours). 

Enable-AipService
Get-AipService

Note: If it shows enabled after running the command, continue immediately with Exchange IRM checks. In some tenants, enabling the service may be sufficient — but in many cases you’ll still need the Exchange IRM steps below.

4) Install the Exchange Online PowerShell module

Install-Module -Name ExchangeOnlineManagement
Import-Module -Name ExchangeOnlineManagement

5) Connect to Exchange Online

Connect-ExchangeOnline

6) Check the IRM configuration in Exchange

Get-IRMConfiguration

7) Ensure Azure RMS licensing and internal licensing are enabled

If either of the following values are False, set them to True:

  • AzureRMSLicensingEnabled
  • InternalLicensingEnabled
Set-IRMConfiguration -AzureRMSLicensingEnabled $true
Set-IRMConfiguration -InternalLicensingEnabled $true

Validation: Test the configuration

This test attempts to validate IRM end-to-end for a sender mailbox. Replace the sender value with a real mailbox in your environment. 

Test-IRMConfiguration -sender user@domain.com

If this test passes, you can typically proceed to user validation (Outlook/OWA encrypt options). If it fails, the most common next step is to set the Exchange IRM licensing location using the tenant’s AIP configuration.

If Test-IRMConfiguration fails: Set the IRM licensing location

8) Reconnect to the AIP service

Connect-AipService

9) Retrieve the licensing URL and set it in Exchange IRM configuration

This sequence retrieves the intranet distribution point URL from AIP configuration, then applies it to Exchange IRM. 

$RMSConfig = Get-AipServiceConfiguration
$LicenseUri = $RMSConfig.LicensingIntranetDistributionPointUrl
Set-IRMConfiguration -LicensingLocation $LicenseUri

10) Test IRM configuration again

Test-IRMConfiguration -sender user@domain.com

If the test passes at this point, allow up to 24 hours for the change to propagate across services and clients.

If the IRM test passes but the “Encrypt” button still doesn’t appear

In some cases, even after a successful IRM test, Outlook on the web may not show the Encrypt option within 24 hours. When that happens, enable simplified client access in Exchange IRM configuration and wait again. 

Connect-ExchangeOnline
Set-IRMConfiguration -SimplifiedClientAccessEnabled $true

After enabling simplified client access, allow another 24 hours for UI and service behavior to update.

Operational guidance: what to check in a health review for older tenants

  • Tenant age / legacy configuration: If the tenant predates mid‑2019, explicitly verify AIP/RMS is enabled.
  • Service enablement: Confirm Get-AipService reflects the service as enabled.
  • Exchange IRM toggles: Confirm AzureRMSLicensingEnabled and InternalLicensingEnabled are true.
  • End-to-end validation: Run Test-IRMConfiguration and address licensing location if it fails.
  • User experience validation: Confirm Encrypt appears in Outlook on the web; enable simplified client access if it doesn’t.
  • Propagation timing: Plan for up to 24 hours after changes — sometimes longer in complex tenants.

Common troubleshooting notes

  • “I enabled AIP but nothing changed” — Exchange IRM configuration can still be disabled and must be checked separately.
  • Test-IRMConfiguration fails — Setting the licensing location via AIP configuration is often required.
  • Test passes but Encrypt doesn’t show — Use -SimplifiedClientAccessEnabled $true and allow time for propagation.

Closing thoughts

Message Encryption is one of those features that “should just work,” but older tenants can carry legacy defaults that prevent modern encryption experiences from showing up reliably. The good news is that verification and remediation are straightforward: enable the Rights Management service, validate Exchange IRM settings, and confirm behavior end-to-end with a real sender mailbox test.

Tip: If you’re doing a baseline security/compliance review for a long-lived tenant, add these checks to your standard runbook — it’s an easy win that prevents confusion during policy rollouts and user adoption.

← Back to Blog