Commands › Exchange Online

Set-IRMConfiguration

Exchange Online ExchangeOnlineManagement Set-*

Configure Information Rights Management (IRM) features on your organization. Configuring and using IRM features in an on-premises Exchange organization requires Active Directory Rights Management Services (AD RMS).

Quick start script

# Set-IRMConfiguration — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-IRMConfiguration
$before | Format-List

# 3. Make the change (dry run first)
Set-IRMConfiguration  -WhatIf
Set-IRMConfiguration

# 4. Verify and diff
$after = Get-IRMConfiguration
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-IRMConfiguration [-Identity <OrganizationIdParameter>]
 [-AutomaticServiceUpdateEnabled <Boolean>]
 [-AzureRMSLicensingEnabled <Boolean>]
 [-ClientAccessServerEnabled <Boolean>]
 [-Confirm]
 [-DecryptAttachmentForEncryptOnly <Boolean>]
 [-DomainController <Fqdn>]
 [-EDiscoverySuperUserEnabled <Boolean>]
 [-EnablePdfEncryption <Boolean>]
 [-EnablePortalTrackingLogs <Boolean>]
 [-ExternalLicensingEnabled <Boolean>]
 [-Force]
 [-InternalLicensingEnabled <Boolean>]
 [-JournalReportDecryptionEnabled <Boolean>]
 [-LicensingLocation <MultiValuedProperty>]
 [-RefreshServerCertificates]
 [-RejectIfRecipientHasNoRights <Boolean>]
 [-RMSOnlineKeySharingLocation <Uri>]
 [-SearchEnabled <Boolean>]
 [-SimplifiedClientAccessDoNotForwardDisabled <Boolean>]
 [-SimplifiedClientAccessEnabled <Boolean>]
 [-SimplifiedClientAccessEncryptOnlyDisabled <Boolean>]
 [-TransportDecryptionSetting <TransportDecryptionSetting>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (24)

Parameter	Type	What it controls
-Identity	OrganizationIdParameter	This parameter is available only in the cloud-based service.
-AutomaticServiceUpdateEnabled	Boolean	This parameter is available only in the cloud-based service.
-AzureRMSLicensingEnabled	Boolean	This parameter is available only in the cloud-based service.
-ClientAccessServerEnabled	Boolean	This parameter is available only in on-premises Exchange.
-Confirm	SwitchParameter	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DecryptAttachmentForEncryptOnly	Boolean	This parameter is available only in the cloud-based service.
-DomainController	Fqdn	This parameter is available only in on-premises Exchange.
-EDiscoverySuperUserEnabled	Boolean	The EDiscoverySuperUserEnabled parameter specifies whether members of the Discovery Management role group can access IRM-protected messages in a discovery mailbox that were returned by a discovery search. Valid values are:
-EnablePdfEncryption	Boolean	This parameter is available only in the cloud-based service.
-EnablePortalTrackingLogs	Boolean	This parameter is available only in the cloud-based service.
-ExternalLicensingEnabled	Boolean	This parameter is available only in on-premises Exchange.
-Force	SwitchParameter	The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-InternalLicensingEnabled	Boolean	Note: In Exchange Online, this parameter affects both internal and external messages. In on-premises Exchange, this parameter only affects internal messages.
-JournalReportDecryptionEnabled	Boolean	The JournalReportDecryptionEnabled parameter specifies whether to enable journal report decryption. Valid values are:
-LicensingLocation	MultiValuedProperty	The LicensingLocation parameter specifies the RMS licensing URLs. You can specify multiple URL values separated by commas.
-RefreshServerCertificates	SwitchParameter	This parameter is available only in on-premises Exchange.
-RejectIfRecipientHasNoRights	Boolean	This parameter is available only in the cloud-based service.
-RMSOnlineKeySharingLocation	Uri	This parameter is available only in the cloud-based service.
-SearchEnabled	Boolean	The SearchEnabled parameter specifies whether to enable searching of IRM-encrypted messages in Outlook on the web (formerly known as Outlook Web App). Valid values are:
-SimplifiedClientAccessDoNotForwardDisabled	Boolean	This parameter is available only in the cloud-based service.
-SimplifiedClientAccessEnabled	Boolean	This parameter is available only in the cloud-based service.
-SimplifiedClientAccessEncryptOnlyDisabled	Boolean	This parameter is available only in the cloud-based service.
-TransportDecryptionSetting	TransportDecryptionSetting	The TransportDecryptionSetting parameter specifies the transport decryption configuration. Valid values are:
-WhatIf	SwitchParameter	The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.