Quick Purview File Decryption in a Pinch

Matthew Silcox

05 Aug 2025 — 2 min read

*you having an existential breakdown because of purview encryption*

It's 7:59 AM, you're not even one cup of coffee deep, and the HR Director is pounding down your door because they're locked out of a critical personnel file...which was encrypted by a terminated employee account you deleted yesterday.

Let me show you how to regain access fast without waiting on slower Purview workflows.

When someone applies a sensitivity label that includes encryption, they become what we call the Rights Management owner. Unless they explicitly remove or modify the file permissions, no one else (no, not even a Compliance Admin) can decrypt it.

Enter...the AIP Super User

AIP Super User mode is essentially "break glass" mode for emergency Purview encryption removal. First, what does it look like when I try to access the encrypted file via my Compliance Admin account?:

Now, let's resolve this by adding ourselves as an AIP Super User:

In PowerShell, install and import the AIPService module via Install-Module AIPService and Import-Module AIPService
Run Connect-AIPService and authenticate with a Compliance Admin account.
Run Enable-AIPServiceSuperUserFeature.
Add an admin account by running Add-AIPServiceSuperUser -EmailAddress admin@yourorg.com.
To verify these steps worked, run Get-AIPServiceSuperUser.

Now, you should be able to open the file with the Microsoft Information Protection client:

*right-click the file to get the labeling client option*

*we now have the full functionality of the labeling client*

Happy Director, happy Compliance Admin.

⚠️

REMEMBER: this is a break-glass account. Treat it as such by disabling the feature after use.

Using Microsoft’s Data Security Stack to Prevent the Next Breach

AI is transforming industries worldwide, but it’s simultaneously creating one of the largest data risks we've ever seen. According to the Varonis 2025 State of Data Security Report, 95% of healthcare organizations have exposed sensitive cloud data, and 64% have employees using unverified AI tools. The same

Email SIT Finder Update: All Credentials Bundled Entity

Found this nugget buried in the Purview Blueprints Github repo. Figured I'd take a crack at integrating credential SITs into my EXO SIT Finder. The "All Credentials" Bundled SIT is multitudinous and complex, as you can see in the linked Learn Doc below. Current SITs being

Architectural Case Study | Extending Microsoft Purview with Fortra (Digital Guardian) DLP via the MIP SDK

This post is a continuation of a series. See part 1, here. Most enterprises already live in dual worlds. On one side, Microsoft Purview governs information inside Microsoft 365. But on the other, dedicated DLP platforms like Digital Guardian DLP control endpoints, networks, and file movement. So what's

Uniting Purview and Third-Party Data Security Products

As a consultant in the Microsoft Security & Compliance space, you learn that some projects are more like therapy sessions. Half the organization wants to migrate to Microsoft, and the other half, clutching their Varonis or Symantec licenses, waits in the shadows for their "I told you so"

Enter...the AIP Super User

Read more

Using Microsoft’s Data Security Stack to Prevent the Next Breach

Email SIT Finder Update: All Credentials Bundled Entity

Architectural Case Study | Extending Microsoft Purview with Fortra (Digital Guardian) DLP via the MIP SDK

Uniting Purview and Third-Party Data Security Products