Enable or Disable Transport Decryption


Applies to: Exchange Online, Exchange Server 2013

Topic Last Modified: 2016-12-09

Enabling transport decryption allows the Transport Rules agent on Microsoft Exchange Server 2013 Mailbox servers to access content in messages protected by Information Rights Management (IRM). As a result, other transport agents can access message content and possibly make changes to it. For example, the Transport Rules agent may need to inspect message content and apply transport rules (such as rules that apply a disclaimer to the message). To successfully decrypt IRM-protected messages, you must add the Federated Delivery mailbox to the super users group configured on your Active Directory Rights Management Services (AD RMS) server.

Members of the super users group are granted an owner use license when they request a license from the AD RMS cluster. This allows them to decrypt all RMS-protected content created by that AD RMS cluster.

When enabling transport decryption, you can specify the following settings:

  • Mandatory   Rejects messages that can't be decrypted and returns a non-delivery report (NDR) to the sender.

  • Optional   Uses a best-effort approach to decryption. If possible, messages are decrypted, but they're delivered even if decryption fails. This is the default setting.

To learn more about transport decryption, see Transport decryption.

For additional management tasks related to IRM, see Information Rights Management procedures.

  • Estimated time to complete: 5 minutes.

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Rights protection" entry in the Messaging policy and compliance permissions topic.

  • An AD RMS server exists in the Active Directory forest and is accessible.

  • The Federated Delivery mailbox has been added to the AD RMS super users group. For details, see Add the Federation Mailbox to the AD RMS Super Users Group.

  • You can't use the Exchange Administration Center (EAC) to enable transport decryption. You must use the Shell.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Server, Exchange Online, or Exchange Online Protection.

This example enables transport decryption for the Exchange 2013 organization. Messages that can't be decrypted are rejected and an NDR is returned to the sender.

Set-IRMConfiguration -TransportDecryptionSetting Mandatory

For detailed syntax and parameter information, see Set-IRMConfiguration.

This example disables transport decryption for the Exchange 2013 organization.

Set-IRMConfiguration -TransportDecryptionSetting Disabled

For detailed syntax and parameter information, see Set-IRMConfiguration.

To verify that you have enabled or disabled transport decryption, use the Get-IRMConfiguration cmdlet and check the value of the JournalDecryptionEnabled property.

For an example of how to check the IRM configuration, see Examples in Get-IRMConfiguration.