Problem activating the protection service from Azure - failing to connect to AIP Service

Marc Forget 30

Hi Support Team,

I have just registered for a 30 day trial license for MS 365 Business Premium which has the Azur Information Protection - Plan 1 (Integration with Microsoft Purview Message Encryption)

When trying to create the first transport rule, the list of RMS templates is empty.

I believe the solution could be in activating the protection service from Azure Information Protection (AIP).

https://learn.microsoft.com/en-us/azure/information-protection/activate-service#supported-activation-methods

To try to resolve this, I have run the following scriptlets based on the information I gathered on your site:

1) PS C:\Windows\system32> Get-IRMConfiguration

InternalLicensingEnabled                   : False
ExternalLicensingEnabled                   : True
AzureRMSLicensingEnabled                   : True
TransportDecryptionSetting                 : Optional
JournalReportDecryptionEnabled             : True
SimplifiedClientAccessEnabled              : False
ClientAccessServerEnabled                  : True
SearchEnabled                              : True
EDiscoverySuperUserEnabled                 : True
DecryptAttachmentFromPortal                : False
DecryptAttachmentForEncryptOnly            : False
SystemCleanupPeriod                        : 0
SimplifiedClientAccessEncryptOnlyDisabled  : False
SimplifiedClientAccessDoNotForwardDisabled : False
EnablePdfEncryption                        : False
AutomaticServiceUpdateEnabled              : True
RMSOnlineKeySharingLocation                :
RMSOnlineVersion                           :
ServiceLocation                            :
PublishingLocation                         :
LicensingLocation                          : {}
RejectIfRecipientHasNoRights               : False
EnablePortalTrackingLogs                   : False

2) PS C:\Windows\system32> (Get-Module AIPService -ListAvailable).Version

Major  Minor  Build  Revision
-----  -----  -----  --------
3      0      0      1

When I try to connect to AIP, I get the following error:

PS C:\Windows\system32> Connect-AipService
Connect-AipService : The attempt to connect to the Azure Information Protection service failed. Verify that the
credentials you are using are correct and try again. If you have continued problems, see
http://go.microsoft.com/fwlink/?LinkId=251909.
The correlation ID is 2ac96ee9-db5e-4f75-a8a0-7b06803b37d3. Please note and provide this value if asked by support for
it.
At line:1 char:1
+ Connect-AipService
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-AipService], ApplicationFailedException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServic
   eCommand

Can you please tell me how to resolve this activation issue?

Marc

Marc Forget 30 Reputation points

2024-01-21T14:58:40.51+00:00

Please note that I have manually set AzureRMSLicensingEnabled to true by invoking Set-IRMConfiguration -AzureRMSLicensingEnabled $true.
PH5 5 Reputation points

2024-01-21T17:25:34.7733333+00:00

Just saying, I have the exact same problem. You are not alone. I haven't found a way to make Connect-AIPService work either under the same situation. I've tried it under Powershell version 5.1 and 7, and neither worked. I am also sure I have the right account and password.
Matt Smith 5 Reputation points

2024-01-22T22:30:00.09+00:00

Up until a few days ago, I was able to bypass the errors by forcing version 2.0.0.3 of the AipService PowerShell module. But that seems to no longer be working now.
Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-01-23T12:55:38.8133333+00:00

@Marc Forget Just wanted to check did you follow the steps mentioned here - https://learn.microsoft.com/en-us/azure/information-protection/install-powershell

https://learn.microsoft.com/en-us/powershell/module/aipservice/enable-aipservice?view=azureipps Feel free to post back, if this doesnt help.

Marc Forget 30

Hi @Givary-MSFT , thanks for your reply, yes I have. The problem is that I cannot connect to the AIP service.

Connect-AipService : The attempt to connect to the Azure Information Protection service failed. Verify that the
credentials you are using are correct and try again. If you have continued problems, see
http://go.microsoft.com/fwlink/?LinkId=251909.
The correlation ID is c9ca4b99-4143-4208-bea9-5c0cff5c520f. Please note and provide this value if asked by support for
it.
At line:1 char:1
+ Connect-AipService
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-AipService], ApplicationFailedException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServic
   eCommand

That command was executed between 08:49:51 and 08:50:29 Eastern time.

Extra infor:

PS C:\Windows\system32> (Get-Module AIPService -ListAvailable).Version
Major  Minor  Build  Revision
-----  -----  -----  --------
3      0      0      1

PS C:\Windows\system32> $PSVersionTable.PSVersion
Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      19041  3930

Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-01-23T14:14:04.07+00:00

@Marc Forget Would suggest to run this cmdlet first Enable-Aipservice https://learn.microsoft.com/en-us/powershell/module/aipservice/enable-aipservice?view=azureipps and let me know if this helps to use/activate AIP service.

PH5 5

I tried that, and it said the Enable-AIPService has to be run after Connect-AIPService.

Enable-AipService : No connection to the Azure Information Protection service is present. Please run the
Connect-AipService cmdlet first to establish a connection to the the Azure Information Protection service.
At line:1 char:1
+ Enable-AipService
+ ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Enable-AipService], AdminClientException
    + FullyQualifiedErrorId : Microsoft.RightsManagementServices.Online.Admin.PowerShell.AdminClientException,Microsof
   t.RightsManagementServices.Online.Admin.PowerShell.EnableAipServiceCommand

Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-01-23T15:28:46.8566667+00:00

@Marc Forget Try to execute this command Connect-AipService -Verbose and share the output. Also, make sure the account you are trying to connect make sure it is a Global admin account, keep me posted the output.

Marc Forget 30

@Givary-MSFT , With an account set up with the global admin role, the execution of the suggested command returns:

PS C:\Windows\system32> Connect-AipService -Verbose
Connect-AipService : The attempt to connect to the Azure Information Protection service failed. Verify that the
credentials you are using are correct and try again. If you have continued problems, see
http://go.microsoft.com/fwlink/?LinkId=251909.
The correlation ID is 637dff53-e6e0-460b-899d-29de0b310669. Please note and provide this value if asked by support for
it.
At line:1 char:1
+ Connect-AipService -Verbose
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-AipService], ApplicationFailedException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServic
   eCommand

VERBOSE: Microsoft.RightsManagementServices.Online.Admin.PowerShell.AdminClientException: The attempt to discover the
location of the administration service and organization failed. You can retry this action. If you have continued
problems, see http://go.microsoft.com/fwlink/?LinkId=251909.
   at Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServiceCommand.ProcessRecordInternal()
   at Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServiceCommand.ProcessRecord()

PH5 5 Reputation points

2024-01-23T19:17:19.93+00:00

I have found a little more information for you. I tried the Connect-AipService on the same PC, but with a different Admin account on a completely different Tenant, and it connects immediately. So, the problem, at least for me, is there is something wrong with the Tenant. Mine was recently defederated, and I think that is the problem somehow. Was yours as well Marc?
Marc Forget 30 Reputation points

2024-01-23T20:31:41.78+00:00

@PH5 , I have just created my tenant last Saturday when I registered for a trial license of Microsoft 365 Business Premium. I would not know how to determine if it is defederated, I noticed in Entra Admin that Access management for Azure resources is not enabled (see picture below), should it be, would that be the root cause?
PH5 5 Reputation points

2024-01-23T20:48:29.9066667+00:00

No, if yours was just created, it isn't defederated then. Shoot. I was hoping that was the common trait. I don't know anything about the Access management setting.
Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-01-24T06:31:11+00:00

@Marc Forget Came across couple of cases internally, where connecting to AIP Service via PowerShell ISE wont work, can you try connect to AIP Service via PowerShell only not via ISE. Let me know if this helps or not.
Marc Forget 30 Reputation points

2024-01-24T12:14:50.29+00:00

@Givary-MSFT , all my commands were executed from PowerShell only as Admin.
Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-01-24T12:17:09.5533333+00:00

@Marc Forget Please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary" along with your Azure subscription id and we will help you one time support option for this issue.
Marc Forget 30 Reputation points

2024-01-24T14:06:30.7566667+00:00

Thanks Givary, I just sent the email as requested.

ServerBoy 0

I have just setup a 365 Dev tenant and also experiencing this problem. For some odd reason the credential box does not appear when I run the command

Connect-AipService

I get the following errors similar to what you have.

Connect-AipService : The attempt to connect to the Azure Information Protection service failed. Verify that the
credentials you are using are correct and try again. If you have continued problems, see
http://go.microsoft.com/fwlink/?LinkId=251909.
The correlation ID is 246cabd1-126b-4640-9dd1-ed8835fe4782. Please note and provide this value if asked by support for
it.
At line:1 char:1
+ Connect-AipService
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-AipService], ApplicationFailedException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServic
   eCommand

If I run this command from my PC which is running windows 10 I get the credential box. I then attempt to login with my global administrator account and it fails with the following error.

Connect-AipService : The attempt to connect to the Azure Information Protection service failed. Verify that the
credentials you are using are correct and try again. If you have continued problems, see
http://go.microsoft.com/fwlink/?LinkId=251909.
The correlation ID is 246cabd1-126b-4640-9dd1-ed8835fe4782. Please note and provide this value if asked by support for
it.
At line:1 char:1
+ Connect-AipService
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-AipService], ApplicationFailedException
    + FullyQualifiedErrorId : NotSpecified,Microsoft.RightsManagementServices.Online.Admin.PowerShell.ConnectAipServic
   eCommand

The 365 Dev Tenant includes P2 features and E5 licenses so this should work. Anyone got any ideas what is going on. I need to enable this to get the Edge syncing working for a test lab.

Ryan Matthes 0 Reputation points

2024-01-31T20:43:12.1866667+00:00

I have the same problem as @ServerBoy. Downgrading my AIPService module to 1.0.0.6 made the sign in box appear again, but I still can't connect. A Microsoft Support tech said it's my network firewall, but that doesn't feel right (never a problem before). Frustratingly, all I'm trying to do is enable the damn AIP service. It should have been auto-enabled, but it wasn't, and all I want to do is tick the box but now I can't tick it in the portal, I have to use PowerShell, and not 7 but 5, and not the latest version of the module but an outdated version, and now I can't even connect....
ServerBoy 0 Reputation points

2024-01-31T21:07:03.86+00:00

Hi Ryan They said the same thing to me. Its all nonsense. I showed them my firewall policies. This is clearly some backend issue. Could be down to the name change of AIP. Probably haven't updated the backend correctly. They have escalated my ticket now after taking some logs via fiddler on my machine to capture the decrypted https traffic. It can't be a firewall blocking traffic if we are all experiencing the same thing. I tethered my mobile to my laptop and attempted to connect but still got the exact same error. This only affecting new tenants.
JasonS 0 Reputation points

2024-02-01T03:49:10.9133333+00:00

After several days of trying and multiple MS support techs helping to get the Connect-AipService command to work I was finally able to get it to work. The key for me was to disable MFA on the account being used via PS, even though it was disabled in EntraID portal. first connect to msolservice, then disable MFA connect-msolservice Set-MsolUser -UserPrincipalName user@domain.com -StrongAuthenticationRequirements @() then follow the normal commands to enable-AipService
ServerBoy 0 Reputation points

2024-02-01T08:35:09.57+00:00

That has actually worked.
PH5 5 Reputation points

2024-02-01T15:45:59.5+00:00

Yep, working for me too. I was able to Enable the service and the Exchange RMS Templates I was missing are now present.
Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-02-01T15:53:27.98+00:00

@PH5 Thanks for the update.

Accepted answer

Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-02-01T12:49:04.3466667+00:00

@Marc Forget Apologies for the long delay to fix this issue.

Offline update: As per the last communication which I received from my team, RMS team found the cause and deployed the fix for this issue (connect-aipservice failing due to rms), as soon I received the update and communicated over the email to test the connection.

As per the last communication which I got from you, you were able to connect to AIP Service and able to receive the encrypted emails to my id as well.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Problem activating the protection service from Azure - failing to connect to AIP Service

0 additional answers