Office 365 Message Encryption: Error setting DecryptAttachmentFromPortal to $true

Question

Hello everyone,&nbsp;I would like to implement Office 365 Message Encryption using Azure Information Protection. Per default, attachments are being encrypted with the same policy as the email itself. Thanks to&nbsp;VasilMichev, I am aware of the&nbsp;DecryptAttachmentFromPortal attribute for the Information Rights Management (IRM). Setting that to $true results in an automatic decryption of any attachment when downloading it.&nbsp;However, I always get an error when I try to do that:&nbsp;&nbsp;As you can see, the (relatively similar) option&nbsp;DecryptAttachmentForEncryptOnly&nbsp;works perfectly. However, the option&nbsp;DecryptAttachmentFromPortal which I'd like to use doesn't work although the syntax seems to be right and I am referencing on the official Microsoft documentation.&nbsp;Of course, I searched for possible solutions on the internet but only found one hit. The recommendation to create a new administrator and try this process with its (new) credentials did not work for me though.&nbsp;Can anyone help me with this error? Maybe&nbsp;Caroline Shin?&nbsp;I would highly appreciate it.&nbsp;Thanks and have a great day!

carol bailey · Answer

It's the other way around - when you use the DecryptAttachmentForEncryptOnly&nbsp;parameter, encryption is removed for the attachment for all recipients after they have authenticated, no matter what authentication method they used or how they view the email. This makes it a consistent end user experience. Whereas for the older parameter, encryption was removed only if they couldn't be authenticated by Azure AD and therefore had to use the portal.
&nbsp;
The difference is when decryption occurs: For the DecryptAttachmentFromPortal parameter, as the name suggests, decryption happened only in the portal and at the point when somebody requested to download the attachment.&nbsp; For a recipient using Outlook or Outlook on the web (they have an Azure AD account), the attachment would remain encrypted. For the DecryptAttachmentForEncryptOnly, decryption happens as soon as the email is opened (which happens only when the recipient is successfully authenticated). 
&nbsp;
So for your recipients using the portal, they won't see any difference in behavior (the downloaded attachment isn't encrypted).&nbsp;
&nbsp;
Hope you have time to try it out before your Christmas break!

vasilmichev · Answer

Well, I tried it in few tenants I have access to, no luck. It doesn't even seem to be available in the definition of the Set-IRMConfiguration cmdlet, so it's not an issue with user, permissions or licenses. Most likely another case of the documentation being ahead of the actual rollout.
&nbsp;
I've left feedback on the documentation just in case.

carol bailey · Answer

We've just learned that DecryptAttachmentFromPortal is deprecated and instead, you should use the DecryptAttachmentForEncryptOnly parameter.&nbsp; The Azure Information Protection documentation has been updated with this information &amp; I'm told the PowerShell reference documentation update is in progress.

itsnotalakeitsanocean · Answer

Thank you very much for your reply. I've tried it in several tenants as well and luckily, it finally worked in the one where I wanted to implement it (customer).&nbsp;Thank you for reporting it, though. In the end, it needs to work everywhere.

itsnotalakeitsanocean · Answer

Thank you very much for your reply, Carol Bailey. However, as far as I understand, the&nbsp;DecryptAttachmentForEncryptOnly&nbsp;parameter only makes it possible to decrypt attachments for users with an Azure AD account. What's the proper solution if I were to send an encrypted email to a GMail user? After downloading the attachments, he won't be able to open them since he can't authenticate, right? If that's the case, it would be a huge step back for many customers I am in contact with. Or maybe I am missing a point here and you can make me a merry christmas by clarifying this point. ;-)

Forum Discussion

Office 365 Message Encryption: Error setting DecryptAttachmentFromPortal to $true

Share

Resources