Outlook Classic cannot open protected emails

Since the same message opens in OWA and your tenant-side IRM checks pass, I’d treat this as a Classic Outlook identity or license-acquisition issue, not an Exchange transport problem.

First, in Outlook go to File > Office Account and confirm the signed-in, activated Microsoft 365 account is the mailbox that received the protected message. Sign out of Office apps, close them, then sign back in and retest. Also try the mailbox on another managed PC or a fresh Windows user profile; that quickly separates an account or Conditional Access issue from a damaged local identity cache.

If the messages come from another tenant, review Entra cross-tenant and Conditional Access policies for Microsoft Rights Management Services (app ID 00000012-0000-0000-c000-000000000000). Microsoft documents that Outlook desktop must reach the AIP/RMS endpoint, while OWA can still work because decryption happens in the service. Check proxy or TLS-inspection logs too. If it fails only on one PC, capture the Office build and sign-in logs for Microsoft support before deleting any RMS or identity caches.