How to open an Excel file that has an IRM protection, but the old tenant is closed

Autumn Ng 0 Reputation points
2026-11-03T03:48:06.93+00:00

I have the Excel file that has an IRM access control, but the old tenant is closed. How can I open or remove the IRM setting?

Moved from Microsoft 365 and Office | Excel | Other | Windows

Microsoft 365 and Office | Excel | For business | Windows
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jade Ng 16,535 Reputation points Microsoft External Staff Moderator
    2026-11-03T05:21:24.1+00:00

    Dear Autumn Ng,

    Thank you very much for reaching out. I sincerely apologize for the difficulty you are experiencing with this Excel file, and I fully understand how stressful it can be to lose access to an important document. I would like to help you as best I can, and so that I can better understand your situation, I would be grateful if you could kindly clarify the following:

    1. What do you mean by "the old tenant is closed"? Has the tenant been deleted, or are you no longer employed by that organization?
    2. Who created the file? Was it created and protected by you, or by another person?
    3. Where is the file stored? Is it saved in SharePoint or OneDrive within your former organization's tenant, or do you have a local copy?
    4. What happens when you attempt to open the file?

    If you are a former employee and the old tenant still exists, the IRM protection is tied to your former organization's account and rights service. In that case, you may wish to contact the IT administrator of your former organization and ask whether your account can be temporarily reactivated, provided it has not been inactive for too long. If this is possible, the administrator can reset the password so that you can sign in, open the file, and remove the restriction. The account can then be deactivated again afterward. Please note that I am unable to confirm whether this option is available in your situation, as it depends on the current status of the old tenant and your account.

    If your situation is different from the scenario described above, please provide the information I requested earlier and describe your issue in more detail, so that I can better understand it and assist you further.

    Thank you very much for your time and your cooperation.

    Was this answer helpful?

  2. AI answer

    2026-11-03T03:49:01.48+00:00

    An IRM-protected workbook can be opened or decrypted only through the originating tenant’s authorization service—or recovery material preserved from that tenant—so there is no supported local bypass if the tenant and its keys are permanently gone.

    IRM encryption remains attached when a file is copied or moved. Excel must obtain a use license for an authorized identity before exposing the workbook’s contents.^1^

    If the old tenant still exists

    A closed subscription does not necessarily mean the tenant has already been permanently deleted. Microsoft notes that an expired tenant can remain available for consuming encrypted content for an extended period.^2^

    1. In desktop Excel, sign out of the current Microsoft 365 account.
    2. Sign in using an identity from the old tenant that was originally granted access.
    3. Open a copy of the workbook.
    4. If the account has Full Control and the workbook opens, select: File → Info → Protect Workbook → Restrict Access → Remove IRM.
    5. Save the decrypted workbook under a new name.^3^

    If Remove IRM is unavailable, the signed-in account does not have the necessary control, or the protection was applied through an encrypted sensitivity label requiring administrative recovery.

    If an administrator can still access the old tenant

    The old tenant’s administrator can enable Azure Rights Management’s super-user feature, assign a recovery account, and then use that account to open and remove encryption. A super user receives Full Control over content encrypted by that tenant, including content protected before the role was assigned.^4^

    From PowerShell, an appropriately authorized old-tenant administrator can use the documented AIPService commands:

    Connect-AipService
Enable-AipServiceSuperUserFeature
Add-AipServiceSuperUser -EmailAddress [Email]
Get-AipServiceSuperUser
Disconnect-AipService

    Use the recovery account to open the workbook in desktop Excel and remove IRM. After recovery, remove the assignment or disable the super-user feature because it grants access to all content encrypted by that tenant.

    For multiple files, the administrator can use the Microsoft Purview Information Protection client and Set-FileLabel to remove encryption in bulk.^4^

    If the tenant was decommissioned with recovery material

    Recovery remains possible if the organization retained its Azure Rights Management root key and a suitable trusted publishing domain (TPD). Microsoft’s decommissioning process requires preserving both before the subscription expires; they can then be imported into an on-premises AD RMS deployment for continued access or decryption.^2^

    Ask the former tenant administrator, liquidator, migration provider, or IT service provider whether they retained:

    • The Azure Rights Management root key.
    • A suitable TPD export.
    • A BYOK/HSM key backup.
    • Access to the old tenant or an existing super-user recovery account.

    If neither tenant access nor recovery material exists

    If the old tenant has been permanently deleted and no root key/TPD was preserved, the available Microsoft documentation provides no supported way to decrypt the workbook. Renaming the file, changing its extension, copying it elsewhere, reinstalling Excel, or using password-removal software does not remove IRM because this is rights-management encryption, not ordinary workbook or worksheet password protection.

    If the tenant’s deletion was recent, open a Microsoft support request through Microsoft 365 Admin Center → Support → Help & Support and ask whether the former tenant can still be restored or its Rights Management service remains recoverable.^5^ Recovery is not guaranteed; provide the former tenant domain and proof of organizational ownership through the private support case, not in a public forum.

    References

    1. Learn about the Azure Rights Management encryption service
    2. Decommission and deactivate the Azure Rights Management service
    3. I own an excel document that has IRM enabled and can't remove it - Microsoft Q&A
    4. Configure Azure Rights Management super users for discovery services or data recovery
    5. Externally shared files appear to have Information Rights Management (IRM) applied automatically - Microsoft Q&A
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.