Decrypt Microsoft Purview Information Protection (MPIP) files

Overview

Microsoft Purview Information Protection (MPIP, previously Microsoft Information Protection / MSIP and Azure Information Protection / AIP) lets organizations apply sensitivity labels to files. When a label carries an encryption setting, the file is wrapped with Azure Rights Management (Azure RMS) protection: the content is AES-encrypted, and the key needed to open it is held by the Azure RMS service for the tenant that applied the label. Only identities that RMS authorizes can obtain that key.

MetaDefender Core has detected these files, the File Type engine reports them as MSO-ENCRYPTED-MSIP (Office documents), but could not look inside them, so the payload was treated as opaque and could only be allowed or blocked by policy.

Starting with Archive Extraction engine 8.1.0, the Archive Extraction module can decrypt MPIP-protected files in place and hand the original data to the rest of the workflow (Multiscanning, Deep CDR, Proactive DLP, Sandbox, and so on). Decryption uses the Microsoft Information Protection (MIP) File SDK and a service principal that your Microsoft 365 tenant administrator authorizes as an Azure RMS super user.

Scope: the integration decrypts files protected by your own tenant only. Azure RMS scopes super-user rights per tenant by design; files labeled by a partner or customer tenant cannot be opened with your credentials. Multi-tenant organizations must repeat the tenant setup for each tenant and configure a MetaDefender Core instance per tenant.

How MPIP protection and decryption work

The decryption handshake

When the Archive Extraction module receives an MSO-ENCRYPTED-MSIP file with MPIP decryption enabled, the built-in MIP service performs the following sequence. Steps 1–3 happen once at startup and are cached; steps 4–6 run per file.

Security boundary: the document body never leaves the MetaDefender Core host. RMS sees only the publishing license, the content ID, and the authentication token. This is relevant for data-residency and compliance conversations — the integration does not upload customer content to Microsoft.

Why a super user

A normal user can only open files whose publishing license grants them rights. A security gateway must open every file regardless of who it was addressed to. Azure RMS provides the super-user feature for exactly this case: members of the designated super-user group are always granted full use licenses for any content protected by the tenant. The MetaDefender Core service principal is added to that group. Removing it from the group is an instant kill-switch, no change is required on the MetaDefender Core side.

Performance characteristics

Prerequisites

On the Microsoft 365 side

• Global Administrator or Compliance Administrator role on the tenant that protects the files.

• Windows PowerShell 5.1.

• Access to the Microsoft Entra admin center.

• Azure Rights Management activated on the tenant (it is on by default for most Microsoft 365 subscriptions that include Purview Information Protection).

On the MetaDefender Core side

• MetaDefender Core with Archive Extraction engine 8.1.0 or later.

• Outbound HTTPS (443) from the MetaDefender Core server to:

  • login.microsoftonline.com and login.windows.net

  • api.aadrm.com and *.aadrm.com

  • syncservice.o365syncservice.com

Part 1 — Set up the Microsoft 365 tenant

Programmatic decryption requires all four of the following to be true. Skipping any one of them produces an AccessDenied error at scan time that does not say which condition failed, so verify each before troubleshooting MetaDefender Core.

1. An Entra ID application with the right API permissions

2. The Azure RMS super-user feature enabled on the tenant

3. A super-user group designated in RMS

4. The application's service principal added as a member of that group

Step 1 — Register the Entra ID application

1. Sign in to the Entra admin center → Identity → App registrations → New registration.

2. Fill in:

   • Name: MetaDefender-MPIP-Decryptor

   • Supported account types: Accounts in this organizational directory only (single tenant)

   • Redirect URI: leave blank

3. Click Register.

4. From the Overview page, record the Application (client) ID and Directory (tenant) ID. You will enter both in MetaDefender Core.

Step 1a — Create a client secret

1. In the registered app → Certificates & secrets → Client secrets → New client secret.

2. Description: metadefender-core; expiry: 24 months (the maximum).

3. Click Add, then immediately copy the Value column (not the Secret ID).

Step 2 — Grant API permissions

In the app registration → API permissions → Add a permission.

2a. Azure Rights Management Services

1. Open the APIs my organization uses tab and search for Azure Rights Management Services.

2. Choose Application permissions.

3. Add Content.SuperUser and Content.Writer.

If Azure Rights Management Services does not appear in the search, the RMS service principal has not been provisioned in your tenant. Run the following in Windows PowerShell, wait 5–10 minutes, and retry:

Install-Module -Name AIPService -Force Connect-AipService Enable-AipService

2b. Microsoft Information Protection Sync Service

This API is hidden from the default picker. Use one of these methods.

Method A — search by application ID. In APIs my organization uses, paste this GUID into the search box:

Select the Microsoft Information Protection Sync Service tile → Application permissions → add UnifiedPolicy.Tenant.Read.All.

Method B — edit the manifest (more reliable). App registration → Manifest → add this object to the requiredResourceAccess array, then save:

2c. Grant admin consent

On the API permissions page click Grant admin consent for [tenant]. All three permissions must show Granted:

Step 3 — Create the super-user group

1. Entra admin center → Identity → Groups → All groups → New group.

2. Fill in:

   • Group type: Microsoft 365

   • Group name: mpip-superusers

   • Group email address: mpip-superusers (the tenant domain is appended automatically)

   • Owner: your admin account

   • Members: leave empty for now

3. Click Create and wait about a minute for provisioning. Note the group's full email address from its Overview page.

Step 4 — Enable the RMS super-user feature

In Windows PowerShell 5.1 or Azure Cloud Shell (PowerShell):

Replace yourtenant.onmicrosoft.com with your tenant's primary domain.

Step 5 — Add the service principal to the super-user group

1. Entra admin center → Identity → Groups → open mpip-superusers.

2. Members → Add members.

3. Search for MetaDefender-MPIP-Decryptor. The service principal shows a gear icon rather than a person icon. Select it → Select → Add.

If the service principal does not appear, force its creation and retry:

Step 6 — Verify the tenant configuration

If either result is Disabled or empty, re-run the corresponding cmdlet from Step 4.

Step 7 — Hand off credentials

The person configuring MetaDefender Core needs:

Part 2 — Configure MetaDefender Core

Enable MPIP decryption in the Archive Extraction module

1. In the MetaDefender Core Management Console go to Inventory → Modules → Utilities → Archive Extraction and open its settings.

2. Enable Decrypt MSIP-protected documents. The option is disabled by default.

3. Enter the values from Step 7:

   • Tenant ID

   • Client ID

   • Client Secret

4. Save. The Archive Extraction engine restarts and launches its MIP processing service. The service authenticates to the tenant and downloads the label policy at startup, so the first scan after enabling the feature takes a few seconds longer.

Workflow configuration

MPIP-protected files are handled as an archive-like container: the decrypted document becomes the single extracted child of the original file and flows through every engine enabled in the workflow.

Files whose decryption fails (wrong tenant, service principal not authorized, network error) are reported the same way as failed Office or PDF password decryption: the file remains detected as MSO-ENCRYPTED-MSIP / PDF-ENCRYPTED-MSIP with an extraction failure, and the workflow's existing handling for encrypted archives applies.

Verify

1. Using Microsoft Word signed in to the configured tenant, create a document and apply a sensitivity label whose settings include Encrypt files. Save it.

2. Submit the file to MetaDefender Core (Management Console → Process, or the REST API).

3. In the scan result:

   • The top-level file is detected as MSO-ENCRYPTED-MSIP.

   • Extracted files shows one child — the decrypted document, detected as the ordinary Office type (for example Microsoft Word Document).

Troubleshooting

Limitations

• Same-tenant only. Files protected by other tenants cannot be decrypted.

• Decryption only. MetaDefender Core does not re-apply the label or encryption to the sanitized or extracted output.

• Office and PDF payloads. Supported inputs are the MSO-ENCRYPTED-MSIP file types.