A new cmdlet in the SharePoint Online module allows tenant administrators to "unlock" documents protected by a sensitivity label with encryption. You might not need to use this feature often, but you'll be glad it's there when the need arises.
https://petri.com/decrypt-sharepointonline-documents
