When talking about encryption in Microsoft Purview, for example when enabling ‘access control’ inside sensitivity labels, it’s actually the Azure Rights Management Service (Azure RMS) doing the heavy lifting. The Azure RMS service is part of Azure Information Protection and can be managed with the ‘AIPService‘ cmdlets.

The cmdlets can be used to perform actions like:

• Activate or deactivate the AIPService
• Perform tenant key management, for example to set up Bring Your Own Key (BYOK)
• Manage the super user account
• Manage (legacy) RMS Templates
• Manage delegated administration
• Perform logging and tracking
• Control which OS you support for consuming protected content
• Restrict protection to specific users/groups during a rollout
• Troubleshooting label encryption

ARM-based Windows clients

However, when you tried to import the ‘AIPService’ module on an ARM-based Windows client, you were in bad luck. Depending on the version of PowerShell you used, one of the following errors appeared:

Windows PowerShell (5.1.2600.8115):

Import-Module : Could not load file or assembly ‘file:///C:\Program Files\WindowsPowerShell\Modules\aipservice\3.0.0.1\AipService.dll’ or one of its dependencies. An attempt was made to load a program with an incorrect format.

PowerShell 7 (7.6.0, technically not supported for AIPService Module version 3.0.0.1, but it shows more information):

Import-Module: Could not load file or assembly ‘C:\Program Files\WindowsPowerShell\Modules\aipservice\3.0.0.1\AipService.dll’. The assembly architecture is not compatible with the current process architecture.

Message Encryption is a powerful component of Microsoft Purview that enables your users to send encrypted email. In this article, I explain how to configure message encryption, which licenses are required, and what the differences are between the standard and advanced variants.

Version History and blockers

Purview Message Encryption (PME) is a successor to the product Outlook Message Encryption (OME) and exists alongside the product IRM in AD RMS (Information Rights Management in Active Directory Rights Management Services), which is an on-premise service and only works for internal recipients.

Do note however, that if you’re using hybrid identities (identities that are synced from your on-premise environment to Entra ID) and you also utilize AD RMS, Purview Message Encryption cannot be used.

Also, if you want to utilize Bring Your Own Key (BYOK) to setup a customer-managed key to protect your mail messages there are a few prerequisite steps you should take care of before configuring Purview Message Encryption. This article however, makes use of a Microsoft Managed Key for the setup.

Licensing

To be able to use Microsoft Purview (Advanced) Message Encryption, you have to have one of the following licenses:

Rights Management Template errors are frustrating to come across when you are deploying sensitivity labels. The following errors are most common:

• We were not able to find the Information Rights Management template. Please contact your administrator.
• De Information Rights Management-sjabloon kan niet worden gevonden. Neem contact op met de beheer. (Dutch).
• Failed to get Information Rights Management Template
• Failed to acquire RMS templates

This article explains the role of the Rights Management Service in a sensitivity label deployment and outlines several methods for resolving related errors.

First, some terminology

Let’s start with Azure Rights Management Service (Azure RMS). Think of it as the engine behind encryption: it’s the underlying technology that protects information whenever a sensitivity label with encryption is applied.

Azure RMS handles the actual cryptographic work: encrypting content, issuing usage licenses, and enforcing the rights attached to protected content. In practice, this means it can stop recipients from forwarding or printing a document, or automatically expire access to it after a set period of time.

Azure Information Protection (AIP) was the client and management layer built on top of Azure RMS. The labeling client has since been folded into the Microsoft 365 (Office) apps, giving users a unified experience, so a separate AIP client is no longer necessary. The management layer has likewise been migrated into Microsoft 365 sensitivity labels. One holdout remains, though: the AIP PowerShell module is (unfortunately) still needed for troubleshooting, which we will see in the upcoming section.

Another term you might come across is Information Rights Management (IRM). IRM is largely legacy terminology for protection controls built into services like Exchange Online or SharePoint Online. This older technology dates back to the days of on-premises Active Directory Rights Management Services (AD RMS). Most environments today apply protection through Purview sensitivity labels instead of relying on IRM to contact the AIP (or AD RMS) service.

Since you’re now up to speed on terminology, let’s continue with troubleshooting!

Setting up our tools of the trade

We will troubleshoot using the ExchangeOnlineManagement and AIPService PowerShell Modules. Install them both using the following cmdlets. I recommend using at least PowerShell 7.5 to ensure everything is running smoothly:

Install-Module ExchangeOnlineManagement, AIPService

Do note that the ‘AIPService’ PowerShell Module does not work on ARM-based devices, so you will need to use a device that runs on the x86 architecture.

Troubleshooting Time

Since the management of Exchange Message Records Management (MRM) policies has been moved to the Microsoft Purview console and marked prominently as ‘legacy’, I frequently receive questions from clients asking whether they should migrate their MRM policies to Purview Data Lifecycle Management (DLM). And the answer is: it depends. First of all, Microsoft states the following when navigating to said management console:

We do not recommend using this option except for moving items from a primary to an archive mailbox and applying retention or deletion settings to default folders. We recommend that you use ‘Retention policies’ in Microsoft 365 to protect content in SharePoint, OneDrive, Exchange and Microsoft 365 Groups.

Second, you should look at the functionality Purview DLM offers and whether it matches your requirements.

Common pitfalls

So with that, let’s first take a look at some common pitfalls when migrating Exchange MRM to Purview DLM.

Data does not move by itself; people move data.

This statement may seem simple, but it contains an important insight into data security: technology is only part of the solution. For robust information security, a proper balance is needed between technology that aligns with your organization and employees who know how to handle data securely. In this blog, I’ll share three practical tips to structurally strengthen the human aspect of data security, based on experience in various projects.

1. Form a Diverse Working Group

For your data security initiative, assemble a working group with people from different departments, roles, and backgrounds. Include data owners, department heads, the Chief Information Security Officer (CISO), and representatives from the Central Data Office (CDO), information security, and Document Information Management. This provides insight into information and information flows within your organization. Additionally, expand the group with representatives from IT and functional support.

After all, these are the people that have the real insight on what data is sensitive to your company, and what the specifications or properties of that data are.

2. Make End Users Part of the Design

Automatic detection of sensitive data and targeted alerts for risky actions help raise awareness among end users and support the adoption of data security. However, successful implementation depends on involving users. Start with training that strengthens both knowledge and desired behavior.