Rights for Mail Recipients on Attachments in Encrypted Emails

By default, when a user sends an email and attachments using Encrypt-only, the Office attachments are also protected with Encrypt-Only permissions and that encryption persists throughout lifecycle of the content. To provide more flexible controls for recipients, organizations can control if recipients have unrestricted permissions on the attachment or not for Encrypt-Only emails. To send attachments as un-encrypted, admins can use below mentioned command after connecting with Exchange Online via PowerShell.

Set-IRMConfiguration - DecryptAttachmentForEncryptOnly $true

-DecryptAttachmentForEncryptOnly

This parameter is available only in the cloud-based service.

The DecryptAttachmentForEncryptOnly parameter specifies whether mail recipients have unrestricted rights on the attachment or not for Encrypt-only mails sent using new Office 365 Message Encryption capabilities. Valid values are:

• $true: The recipients will have unrestricted rights on attachments sent using Encrypt-Only policy.
• $false: The recipients will not have unrestricted rights on attachments sent using Encrypt-Only policy.

Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/set-irmconfiguration?view=exchange-ps