Fix Word IRM Decryption Error When Opening Protected Email Attachments

You open a protected email attachment in Word and see an IRM decryption error instead of the document content. This error occurs when Word cannot decrypt the file because your Information Rights Management license is missing, expired, or incorrectly configured. This article explains the root cause of the IRM decryption failure and provides four proven methods to resolve it. You will learn how to reacquire licenses, repair Office, clear cached credentials, and adjust Group Policy settings.

Why Word Displays an IRM Decryption Error on Protected Attachments

Information Rights Management (IRM) in Microsoft 365 uses Azure Rights Management (Azure RMS) to encrypt documents and control permissions. When you open a protected email attachment, Word contacts the Azure RMS service to download a use license. If the license cannot be obtained, Word shows an IRM decryption error.

Several conditions cause this failure:

Expired or Missing Use License

Each protected document requires a unique use license that is valid for a limited time. If the license has expired or was never downloaded, decryption fails.

Network or Proxy Blocking RMS Connectivity

Word must connect to https://api.aadrm.com and related endpoints. A corporate firewall, VPN, or proxy that blocks these URLs prevents license acquisition.

Corrupted IRM Credential Cache

Windows stores IRM authentication tokens in a local cache. If these tokens become corrupted or stale, Word cannot decrypt the file even with a valid network connection.

Outdated Office Version

Older builds of Office 2016 or 2019 may lack the necessary updates for Azure RMS. Microsoft 365 Apps subscribers are less affected because updates are applied monthly.

Steps to Resolve the IRM Decryption Error in Word

Follow these methods in order. Test after each method by reopening the protected attachment.

Method 1: Reacquire the IRM License by Signing Out and Back In

1. Close the protected document and all Word windows
   Make sure no Word process is running in the background. Check Task Manager if needed.
2. Open Word and go to File > Account
   Under User Information, you will see your Microsoft 365 sign-in name.
3. Click Sign Out
   Confirm any prompts. Word will disconnect from your account.
4. Restart Word
   Close and reopen Word completely.
5. Go to File > Account and click Sign In
   Enter your work or school credentials. This forces Word to download a fresh IRM use license from Azure RMS.
6. Open the protected attachment again
   The decryption should succeed if the issue was a stale or missing license.

Method 2: Run the Microsoft Support and Recovery Assistant (SaRA)

1. Download SaRA from the Microsoft 365 admin center
   Go to https://aka.ms/SaRA and install the tool.
2. Launch SaRA and select Office > I signed in but can’t use Office
   This scenario covers IRM and licensing issues.
3. Follow the on-screen prompts
   SaRA will check your account status, Office activation, and IRM license validity.
4. Apply any suggested fixes
   SaRA may automatically renew your license or repair the Office installation.
5. Restart Word and open the protected attachment
   Verify that the decryption error is gone.

Method 3: Clear the IRM Credential Cache Manually

1. Close all Office applications
   Ensure Word, Outlook, and Excel are not running.
2. Open Credential Manager
   Press Windows key + R, type control keymgr.dll, and press Enter.
3. Locate IRM-related credentials
   Look for entries containing “MicrosoftOffice15” or “MicrosoftOffice16” under Windows Credentials.
4. Remove each IRM credential
   Click the credential and select Remove. Confirm the deletion.
5. Restart Word and open the protected attachment
   Word will request a new use license from Azure RMS.

Method 4: Repair Office Installation

1. Open Control Panel > Programs and Features
   Find Microsoft 365 or Office in the list.
2. Right-click the Office entry and select Change
   Choose Quick Repair first. This takes a few minutes and does not require a product key.
3. If the error persists, run Online Repair
   Online Repair re-downloads all Office components and reinstalls them. You need a stable internet connection.
4. Restart your computer
   After the repair completes, reboot Windows.
5. Open the protected attachment in Word
   The decryption error should be resolved.

If Word Still Shows the IRM Decryption Error

“Word cannot open this document because the IRM license is not available”

This message appears when the sender applied IRM protection but the recipient is not part of the same Microsoft 365 tenant. The sender must add your email address to the document permissions list. Ask the sender to open the document in Word, go to File > Info > Protect Document > Restrict Access, and add your email address with View or Edit permissions.

“Your IRM license has expired. Please contact your IT administrator.”

The use license for this document has a time limit. You can request a new license by signing out and back in (Method 1). If the problem continues, the document may have an explicit expiration date set by the sender. Contact the sender to extend the expiration or resend the file.

“IRM is not enabled on this computer.”

Word cannot find the IRM client component. This is rare on Microsoft 365 Apps installations but can happen on older Office versions. Run the Office repair (Method 4) or install the Rights Management Services (RMS) client from the Microsoft Download Center. After installation, restart Word.

“Your organization’s IRM policy prevents you from opening this document.”

Your IT administrator has configured a conditional access policy that blocks decryption on unmanaged devices. You must open the document on a domain-joined computer or use the Microsoft 365 web app. Contact your help desk to request an exception.

IRM Decryption Error: Common Troubleshooting Methods Compared

Method	Fixes Stale License	Fixes Corrupted Cache	Requires Admin Rights
Sign out and back in	Yes	No	No
Run SaRA tool	Yes	Yes	No
Clear IRM credential cache	No	Yes	No
Quick Repair Office	No	Yes	Yes
Online Repair Office	No	Yes	Yes

Now you can resolve the IRM decryption error by reacquiring the license, clearing cached credentials, or repairing Office. Start with the simplest method: sign out and back into your Microsoft 365 account. If the error persists, run the SaRA tool to automatically diagnose IRM connectivity. For advanced control, clear the credential cache in Credential Manager or perform an Online Repair of Office.