Unable to save Sensitivity Labels (Rights Management not active for Tenant)

Question

Unable to save Sensitivity Labels (Rights Management not active for Tenant)

Suneet Luthra 20

This is the message that we are getting. Need help resolving this. Checked the docs but unable to install AIPService. error

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-24T04:38:17.91+00:00

Suneet Luthra

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer accepted by question author

Chandra Boorla 15,480 Microsoft External Staff Moderator

Hi Suneet Luthra

Thank you for sharing the details.

The error message you're encountering - Microsoft.Exchange.Management.UnifiedPolicy.RmsInactiveForTenantException | Rights Management is not active for the tenant - indicates that Azure Rights Management (RMS) is not enabled for your Microsoft 365 tenant.

This service is required to apply encryption - based sensitivity label features, such as restricting access or usage rights on documents and emails.

To resolve this - You will need to activate the Rights Management service for your tenant. Here are two ways to do it:

Using PowerShell

Open PowerShell as Administrator.
Run the following commands:

Install-Module -Name AIPService -Force
Connect-AipService
Enable-AipService
Get-AipService  # to confirm it's enabled

You will need to be a Global Administrator or Compliance Administrator to perform this.

For more details, please refer: Activating the protection service from Azure Information Protection

Using Microsoft Purview Portal

Go to the Microsoft Purview Compliance Portal: https://compliance.microsoft.com
Navigate to: Information protection > Labels
If prompted, follow the on-screen steps to activate protection.

Once activated, you should be able to save and apply sensitivity labels with encryption settings.

Please refer similar thread on Microsoft Q&A platform for useful insights: Cant Enable Access Control for Sensitivity Labels in Microsoft Purview

I hope this information helps. Please do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Thank you.

Suneet Luthra 20 Reputation points

2025-07-24T05:52:49.7033333+00:00
We ran some diagnostics on Purview and here are the results.

Validate mail encryption evaluation details.

Diagnostic status

Failure

No IRM configuration results obtained. Run Test-IRMConfiguration to verify specific errors encountered.

No IRM configuration results obtained. Run Test-IRMConfiguration to verify specific errors encountered.

Documentation Links:

Learn More about Test-IRMConfiguration

This assessment checks the email encryption configurations.

Diagnostic status

Failure

IRM Configuration: 'InternalLicensingEnabled' empty or incorrect. Recommended value should be 'True'. Actual value: 'False'.

IRM Configuration: 'AzureRMSLicensingEnabled' empty or incorrect. Recommended value should be 'True'. Actual value: 'False'.

IRM Configuration: 'LicensingLocation' empty or incorrect. This field should have exactly one value in the format 'https://{GUID}.rms.{REGION}.{CLOUD}/_wmcs/licensing'.

No RMS templates available.. RMS templates can be updated using Set-RMSTemplate cmdlet.

Organization licenses configuration does not contain one or more capabilities from 'BPOS_S_Enterprise' which are required for minimum access to OME features.

Your Organization settings don't have proper licenses for encryption. Organization licenses configuration does not contain one or more capabilities from 'BPOS_S_Enterprise' which are required for minimum access to OME features.

Documentation Links:

Learn more about License requirements

Check if MIP Label feature is enabled

Diagnostic status

Success

Licenses required for MIP Labels is available for your tenant.Validate mail encryption evaluation details.

Diagnostic status

Failure

No IRM configuration results obtained. Run Test-IRMConfiguration to verify specific errors encountered.

No IRM configuration results obtained. Run Test-IRMConfiguration to verify specific errors encountered.

Documentation Links:

Learn More about Test-IRMConfiguration

This assessment checks the email encryption configurations.

Diagnostic status

Failure

IRM Configuration: 'InternalLicensingEnabled' empty or incorrect. Recommended value should be 'True'. Actual value: 'False'.

IRM Configuration: 'AzureRMSLicensingEnabled' empty or incorrect. Recommended value should be 'True'. Actual value: 'False'.

IRM Configuration: 'LicensingLocation' empty or incorrect. This field should have exactly one value in the format 'https://{GUID}.rms.{REGION}.{CLOUD}/_wmcs/licensing'.

No RMS templates available.. RMS templates can be updated using Set-RMSTemplate cmdlet.

Organization licenses configuration does not contain one or more capabilities from 'BPOS_S_Enterprise' which are required for minimum access to OME features.

Your Organization settings don't have proper licenses for encryption. Organization licenses configuration does not contain one or more capabilities from 'BPOS_S_Enterprise' which are required for minimum access to OME features.

Documentation Links:

Learn more about License requirements

Check if MIP Label feature is enabled

Diagnostic status

Success

Licenses required for MIP Labels is available for your tenant.

Please let us know how we can proceed.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-25T03:13:27.7033333+00:00
Suneet Luthra

Thank you for sharing the detailed diagnostic results - they are very helpful.

Based on the findings, here are some findings and suggestions:

Key issues identified:

Azure Rights Management (RMS) is not active or properly configured.

IRM configuration settings such as InternalLicensingEnabled, AzureRMSLicensingEnabled, and LicensingLocation are incorrect.

No RMS templates available - required for encryption-based sensitivity labels.

Licensing gap - your tenant is missing the required BPOS_S_Enterprise SKU, which is needed for Office Message Encryption (OME) and RMS.

Suggestions:

Activate Azure RMS - You’ll need to enable Azure RMS for your tenant. Please run the following PowerShell commands:

Install-Module AIPService -Force Connect-AipService Enable-AipService

If you’ve already done this, please run:

Get-AipService

To confirm the Status is Enabled.

Fix IRM Configuration - Connect to Exchange Online and apply the correct configuration:

Connect-ExchangeOnline Set-IRMConfiguration -InternalLicensingEnabled $true Set-IRMConfiguration -AzureRMSLicensingEnabled $true Set-IRMConfiguration -LicensingLocation "https://<YourTenantGUID>.rms.<region>.aadrm.com/_wmcs/licensing"

Replace the LicensingLocation with the correct URL for your tenant. It’s typically auto-configured after RMS is enabled.

Validate configuration - Once you’ve made these changes, please run:

Test-IRMConfiguration

This should return Success for all IRM diagnostics.

Verify licensing - Ensure your organization has at least one of the following:

Microsoft 365 E3 / E5

AIP Premium P1/P2

EMS E3 / E5

The diagnostic result shows that the BPOS_S_Enterprise license (part of E3/E5) is missing. Without this, encryption features like email protection and content marking won’t work.

We recommend verifying license assignments in Microsoft 365 Admin Center or with your Microsoft licensing partner.

Once all steps are completed - You should be able to successfully save and use sensitivity labels with encryption in Microsoft Purview.

I hope this information helps.
Suneet Luthra 20 Reputation points

2025-07-25T05:32:43.89+00:00

will look into the BPOS_S_Enterprise license (I believe it is part of Exchange Online Plan 2). However when I input the commands in the Power Shell, it didn't work. Please see the failure notices below from the PowerShell screen..

PS /home/suneet> Install-Module AIPService -Force

PS /home/suneet> Connect-AipService

Connect-AipService: The 'Connect-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

PS /home/suneet> Enable-AipService

Enable-AipService: The 'Enable-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

I think the import module is not loading. I'm a Global Administrator. so the role should allow me to do that.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-25T07:00:38.74+00:00
Suneet Luthra

Thanks for sharing the error details.

The issue you're encountering is due to the AIPService PowerShell module not being supported on non-Windows environments (like Linux, macOS, or PowerShell Core). The module requires Windows PowerShell 5.1 and the full .NET Framework, which are only available on Windows machines.

How to proceed - Please follow these steps on a Windows machine:

Open Windows PowerShell (not PowerShell 7 or PowerShell Core):

Press Win + R, type powershell, and press Enter.
Run the following commands one by one:

Install-Module AIPService -Force Import-Module AIPService [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Connect-AipService Enable-AipService

After enabling, you can confirm the status using:

Get-AipService

You should see: Status : Enabled

Once Azure Rights Management is enabled successfully, we can proceed with configuring IRM and validating the sensitivity label setup again. I hope this information helps.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-28T14:27:10.13+00:00

Suneet Luthra

Following up to see if the above suggestion was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

1 additional answer

Your answer

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-24T04:38:17.91+00:00

Suneet Luthra

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.
Suneet Luthra 20 Reputation points

2025-07-25T05:32:43.89+00:00

will look into the BPOS_S_Enterprise license (I believe it is part of Exchange Online Plan 2). However when I input the commands in the Power Shell, it didn't work. Please see the failure notices below from the PowerShell screen..

PS /home/suneet> Install-Module AIPService -Force

PS /home/suneet> Connect-AipService

Connect-AipService: The 'Connect-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

PS /home/suneet> Enable-AipService

Enable-AipService: The 'Enable-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

I think the import module is not loading. I'm a Global Administrator. so the role should allow me to do that.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-25T07:00:38.74+00:00

Suneet Luthra

Thanks for sharing the error details.

The issue you're encountering is due to the AIPService PowerShell module not being supported on non-Windows environments (like Linux, macOS, or PowerShell Core). The module requires Windows PowerShell 5.1 and the full .NET Framework, which are only available on Windows machines.

How to proceed - Please follow these steps on a Windows machine:

Open Windows PowerShell (not PowerShell 7 or PowerShell Core):

Press Win + R, type powershell, and press Enter.
Run the following commands one by one:

Install-Module AIPService -Force Import-Module AIPService [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Connect-AipService Enable-AipService

After enabling, you can confirm the status using:

Get-AipService

You should see: Status : Enabled

Once Azure Rights Management is enabled successfully, we can proceed with configuring IRM and validating the sensitivity label setup again. I hope this information helps.
Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-07-28T14:27:10.13+00:00

Suneet Luthra

Following up to see if the above suggestion was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer 1

I will look into the BPOS_S_Enterprise license (I believe it is part of Exchange Online Plan 2). However when I input the commands in the Power Shell, it didn't work. Please see the failure notices below from the PowerShell screen..

PS /home/suneet> Install-Module AIPService -Force

PS /home/suneet> Connect-AipService

Connect-AipService: The 'Connect-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

PS /home/suneet> Enable-AipService

Enable-AipService: The 'Enable-AipService' command was found in the module 'AIPService', but the module could not be loaded due to the following error: [Could not load file or assembly 'System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.

]

For more information, run 'Import-Module AIPService'.

I think the import module is not loading. I'm a Global Administrator. so the role should allow me to do that.