Externally shared files appear to have Information Rights Management (IRM) applied automatically

Stefan 80 Reputation points
2025-10-23T20:21:05.6733333+00:00

I'm a Microsoft 365 admin at a non-profit with an interesting development in our tenant.

Over the past month, more and more of our employees have reported that external users can no longer open files shared from our tenant, even when those users could access them previously. In many cases, the files appear to have Information Rights Management (IRM) applied automatically, forcing external users to sign in with an account from our tenant, which they don’t have, before they can open the file, even after downloading it.

We have not made any changes to our sharing settings or policies, so this is a surprise to us.

  • All of our sharing settings in our tenant tend toward "Most Inclusive".
  • We do not have any sensitivity labels setup in Purview.

Any ideas on how to go about troubleshooting this?

  • The issue occurs when a file without labels is attached to an email and then encrypted; upon delivery to the end user, it automatically receives an IRM label.
  • To get around this, we are trying to send an "Anyone" link via OneDrive, and that is denying access as well - giving a message that the file is encrypted.
Microsoft 365 and Office | SharePoint | For business | Windows
Answer accepted by question author
Ruby-N 13,345 Reputation points Microsoft External Staff Moderator
2025-10-23T22:59:01.2733333+00:00

Dear @Stefan, 

Thank you for posting your question in the Microsoft Q&A forum.  

Files shared externally from your Microsoft 365 tenant are being unexpectedly protected by Information Rights Management (IRM), even though no sensitivity labels or policy changes have been applied. This behavior is often the result of encryption features such as Azure Rights Management Services (RMS) or Microsoft Purview Message Encryption being enabled. These features can automatically apply IRM protection, causing shared or emailed files to inherit encryption and require authentication, particularly when external recipients do not have valid identities within your tenant. 

Since IRM protection is persistent and travels with the file, even downloaded copies remain encrypted and continue to require authentication. 

Based on your description, I strongly recommend reaching out to the Microsoft Support team directly for further assistance.  

To resolve this, Microsoft’s support team will need to step in. A technical support engineer can perform a remote session to investigate the situation, verify the backend configurations, and run any necessary synchronization tools to resolve the problem. If the issue requires further attention, they can escalate it to a specialized team for deeper analysis.    
As community moderators, we kindly ask for your understanding that our access to internal development details is limited. Our primary role is to guide users toward the appropriate resources and support channels.  

For that reason, the most efficient solution would be to contact Microsoft’s support team directly.     

  User's image

While we may not have visibility into performing deeper backend analysis, we’ll continue doing our best to support you within the scope of our responsibilities. Once you have successfully created a support ticket, feel free to share the ticket tracking ID with me via Private Message. This will allow me to monitor progress on your behalf and help ensure that the issue is addressed in a proper and timely manner.  

User's image

User's image

Thank you for your patience and understanding throughout this process. Should you have any questions or need further assistance, feel free to reach out at any time. 

Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.