Information Rights Management is enabled in SharePoint Online

Overview

Information Rights Management (IRM) integration in SharePoint Online libraries is a legacy feature that has been replaced by Enhanced SharePoint Permissions (ESP). Any library using this legacy capability should be flagged to move to newer capabilities.

Remediation

To disable legacy IRM in SharePoint Online:

1. Identify libraries currently using IRM protection (audit existing sites)
2. Plan migration to modern sensitivity labels with encryption
3. Connect to SharePoint Online: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
4. Disable legacy IRM: Set-SPOTenant -IrmEnabled $false
5. Enable modern sensitivity labels: Set-SPOTenant -EnableAIPIntegration $true
6. Configure and publish sensitivity labels with encryption to replace IRM policies

• Enable sensitivity labels for SharePoint and OneDrive
• SharePoint IRM and sensitivity labels (migration guidance)
• Create and configure sensitivity labels with encryption

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	Data, AI
Category	SharePoint Online
Product	Purview
Feature	Information protection
Area	Data protection
Licence	RMS_S_PREMIUM, Microsoft 365 E3
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.