Skip to main content

Configure Microsoft 365 journal report decryption for encrypted email capture

This article shows you how to configure your Microsoft 365 environment to enable journal report decryption so that MCO eComms can capture and archive email messages protected by Microsoft Purview sensitivity labels.

Overview

Journal report decryption is a Microsoft 365 feature that attaches a decrypted copy of a rights-protected message to the journal report. MCO eComms reads this decrypted copy to make the full message content available for compliance archiving and review.

This article covers activating Azure Rights Management (RMS), configuring Exchange Online IRM settings, validating the configuration, creating the journaling mail contact, creating the journal rule, and verifying sensitivity label settings.

Note: This feature supports Microsoft Purview Message Encryption (RMS-based sensitivity labels) only. S/MIME and third-party encryption methods are not supported.

Prerequisites

Before you begin, confirm you have the following:

  • Microsoft 365 Global Administrator or Exchange Administrator role

  • Compliance Administrator role (required for the AIPService module in Step 1)

  • A Windows machine running Windows PowerShell 5.1 (required for Step 1 only — the AIPService module does not support PowerShell 7)

  • Exchange Online PowerShell V3 module installed (compatible with both PowerShell 5.1 and PowerShell 7)

  • Microsoft 365 E3 or E5 subscription (required for Information Rights Management)

  • The MCO eComms journaling address for your organization (provided by MCO during account setup)

Note: All steps in this article are performed in Microsoft 365. The role requirements above refer to Microsoft 365 roles, not MCO eComms roles.

Steps

Step 1: Activate Azure Rights Management

This step must be completed in Windows PowerShell 5.1. The AIPService module is not compatible with PowerShell 7.

Open Windows PowerShell 5.1 as Administrator — search for "Windows PowerShell" in the Start menu. Do not use Windows Terminal or PowerShell 7 for this step.

  1. Install the AIPService module and connect to the RMS service:

    Install-Module -Name AIPService -Force # If prompted about execution policy: Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser Import-Module AIPService Connect-AipService

  2. Check the current RMS status:

    Get-AipService

  3. If the output shows Disabled, activate RMS:

    Enable-AipService 
    # Confirm activation 
    Get-AipService 
    # Expected output: Enabled

Important: On tenants where RMS has never previously been activated, the backend provisioning process can take 4–6 hours or longer before Exchange Online can use the RMS service. Do not proceed to Step 3 validation until provisioning is complete. The Microsoft 365 admin center no longer provides a UI option to activate RMS — PowerShell is the only supported method.

Step 2: Configure Exchange Online IRM

These commands can be run in Windows PowerShell 5.1 or PowerShell 7 using the Exchange Online PowerShell V3 module.

  1. Install and connect to Exchange Online PowerShell:

    Install-Module -Name ExchangeOnlineManagement -Force Connect-ExchangeOnline

  2. Configure all required IRM settings:

    Set-IRMConfiguration -AzureRMSLicensingEnabled $true Set-IRMConfiguration -InternalLicensingEnabled $true Set-IRMConfiguration -JournalReportDecryptionEnabled $true Set-IRMConfiguration 
    -TransportDecryptionSetting Mandatory Set-IRMConfiguration 
    -AutomaticServiceUpdateEnabled $true

  3. Verify the configuration:

    Get-IRMConfiguration | Select AzureRMSLicensingEnabled, InternalLicensingEnabled, JournalReportDecryptionEnabled, TransportDecryptionSetting, AutomaticServiceUpdateEnabled, LicensingLocation

All boolean values should show True. LicensingLocation should show a URL — for example, https://xxxxxxxx.rms.na.aadrm.com/_wmcs/licensing. If LicensingLocation is empty ({}), RMS provisioning is not yet complete. Wait and recheck before proceeding.

Step 3: Validate RMS and IRM configuration

Run the following end-to-end test from your Exchange Online PowerShell session:

Test-IRMConfiguration -Sender [email protected] -Recipient [email protected]

Replace [email protected] with a valid mailbox in your organization.

A successful result shows all checks passing:

Acquiring RMS Templates      PASS Verifying encryption         PASS Verifying decryption         PASS Verifying IRM is enabled     PASS OVERALL RESULT: PASS

Important: Do not proceed until this test passes. If the test fails on "Failed to acquire RMS templates," RMS provisioning is not yet complete — wait and retry. If the failure continues after 6 or more hours, contact Microsoft Support and request that they investigate RMS backend provisioning for your tenant.

Step 4: Create the MCO eComms journaling address as a mail contact

Before creating a journal rule, you must add the MCO eComms journaling address as a mail contact in Exchange Online. Pointing a journal rule directly to an SMTP address will fail.

Run the following command in Exchange Online PowerShell:

New-MailContact -Name "MCO eComms Journal" `     -ExternalEmailAddress "[email protected]"

Replace [email protected] with the journaling address provided by MCO during your account setup.

Step 5: Create the journal rule

Option A — PowerShell

New-JournalRule -Name "MCO eComms Journaling" -JournalEmailAddress "MCO eComms Journal" -Recipient "[email protected]" -Scope Global -Enabled $true

Set -Recipient to the user or distribution group whose emails should be journaled. Use -Scope Global to capture both sent and received messages.

Option B — Exchange Admin Center

  1. Go to admin.exchange.microsoft.com > Compliance management > Journal rules

  2. Click New rule

  3. In Send journal reports to, search for and select the mail contact created in Step 4

  4. Set the scope and recipient as required

  5. Click Save

Step 6: Verify sensitivity label configuration

If your organization uses Microsoft Purview sensitivity labels with encryption, verify the following before testing end-to-end.

Check the permissions model for each label:

  1. In the Microsoft Purview portal, open each sensitivity label used for email encryption

  2. Go to Access control

  3. Confirm the setting is Configure access control settings with Assign permissions now selected

Labels configured with Let users assign permissions when they apply the label do not reliably enforce encryption on Outlook for Mac or Outlook on the Web, and may prevent journal decryption from working.

Check for archived RMS templates:

Connect-IPPSSession Get-Label -Identity "Your Label Name" | Format-List LabelActions

In the output, confirm "templatearchived","Value":"False". If the value is True:

  1. In the Purview portal, open the label

  2. Set Access control to Remove access control settings if already applied to items and save

  3. Open the label again and reconfigure Access control with Assign permissions now and save

If the archived template persists after these steps, delete the label and recreate it with a new name. Archived templates cannot be reliably repaired by editing the label in place.

Step 7: Validate end-to-end journal decryption

Before relying on MCO eComms for production traffic, confirm journal decryption is working:

  1. Create a second temporary journal rule pointing to a personal external email address (such as Gmail), set up as a mail contact in Exchange

  2. Send a test email with a sensitivity label applied

  3. Check the external mailbox for the journal report

A correctly functioning journal report contains two forwarded message sections:

  • The first section shows the OME-wrapped encrypted message

  • The second section shows the readable plaintext message body

If only the OME wrapper section is present, recheck Steps 1–3 and confirm Test-IRMConfiguration passes before continuing.

Expected outcome

After completing this configuration:

  • Emails sent with sensitivity labels are delivered to recipients encrypted — no change to end-user experience

  • MCO eComms receives journal reports containing a decrypted copy of the message body, available for compliance review and supervision in the Reviewer Queue

  • Messages display as readable text in both archived messages and alerts

Limitations

  • Only encryption originating from your own Microsoft 365 tenant is supported — messages encrypted by external organizations cannot be decrypted by this feature

  • S/MIME and third-party encryption methods are not supported

  • Sensitivity labels that restrict decryption to specific named users only (rather than all organization users) may prevent Exchange Online transport from decrypting the journal copy — use organization-wide permissions when configuring labels intended for journaling

  • The AIPService module (Step 1) requires Windows PowerShell 5.1 — PowerShell 7 is not supported for that step. All other steps are compatible with PowerShell 7 via Exchange Online PowerShell V3

Troubleshooting

Get-AipService or Enable-AipService is not recognized

This command belongs to the AIPService module — it cannot be run in Exchange Online PowerShell. Open a separate Windows PowerShell 5.1 session, install the AIPService module (Install-Module -Name AIPService -Force), and run the command there.

Test-IRMConfiguration fails on "Failed to acquire RMS templates"

RMS provisioning is not yet complete. On tenants where RMS has never been activated, this process can take 4–6 hours or longer. Wait and retry. If the failure continues after 6 or more hours, contact Microsoft Support.

LicensingLocation is empty in Get-IRMConfiguration output

RMS is not yet provisioned. Wait for provisioning to complete before proceeding with IRM configuration or testing.

Journal rule creation fails with "The JournalEmailAddress can only be a mail user, a mail contact or an external address"

The journaling address has not been added as a mail contact in Exchange Online. Complete Step 4 before creating the journal rule.

Related Articles
Did this answer your question?