irmConfiguration

Rights Management (IRM). Tenant rights-management settings for Azure RMS and message encryption. The irmConfiguration singleton lives under /exchange/v1.0/irmConfiguration in the Encryption & rights category.

Fact	Value
Path	`/exchange/v1.0/irmConfiguration`
Category	Encryption & rights
Tier	Tier 9, Hybrid and organization
Read role	`OrganizationConfig.Read.All` (Community)
Write role	`OrganizationConfig.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-IRMConfiguration, Set-IRMConfiguration

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/irmConfiguration`	GET /irmConfiguration - fetch the tenant-wide IRM / Azure RMS singleton.	`OrganizationConfig.Read`	Community
PATCH	`/exchange/v1.0/irmConfiguration`	PATCH /irmConfiguration - update the tenant-wide IRM singleton. Body keys map 1:1 to Set-IRMConfiguration parameters (e.g. azureRMSLicensingEnabled, simplifiedClientAccessEnabled). Returns 200 + the post-Set singleton.	`OrganizationConfig.ReadWrite`	Enterprise
POST	`/exchange/v1.0/irmConfiguration/refreshCertificates`	POST /irmConfiguration/refreshCertificates - trigger Set-IRMConfiguration -RefreshServerCertificates as a bound action (side-effect: tenant re-fetches RMS server certs). Returns 204.	`OrganizationConfig.ReadWrite`	Enterprise

GET /exchange/v1.0/irmConfiguration

GET /irmConfiguration - fetch the tenant-wide IRM / Azure RMS singleton.

Backing cmdlet: Get-IRMConfiguration. Role: OrganizationConfig.Read (Community).

Get the IRM (Information Rights Management) configuration

Reads the tenant’s Information Rights Management configuration, a singleton backed by Get-IRMConfiguration. Surfaces internal/external licensing state, transport decryption, journal-report decryption, simplified client access, and the Azure RMS licensing/service locations.

GET /exchange/v1.0/irmConfiguration HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#irmConfiguration",
  "Id": "ControlPoint Config",
  "Name": "ControlPoint Config",
  "Identity": "ControlPoint Config",
  "Guid": "184cd0fc-1bbd-4306-b90c-81377593564b",
  "InternalLicensingEnabled": true,
  "ExternalLicensingEnabled": true,
  "TransportDecryptionSetting": false,
  "JournalReportDecryptionEnabled": true,
  "ClientAccessServerEnabled": true,
  "SearchEnabled": true,
  "EDiscoverySuperUserEnabled": true,
  "DecryptAttachmentForEncryptOnly": false,
  "EnablePdfEncryption": false,
  "SimplifiedClientAccessEnabled": true,
  "SimplifiedClientAccessDoNotForwardDisabled": false,
  "SimplifiedClientAccessEncryptOnlyDisabled": false,
  "AzureRMSLicensingEnabled": "True",
  "RMSOnlineKeySharingLocation": null,
  "LicensingLocation": [
    "https://b4513eb0-2cbb-4215-89bf-7191e5dcb645.rms.eu.aadrm.com/_wmcs/licensing"
  ],
  "ServiceLocation": null,
  "WhenCreated": "2026-03-30T17:07:36+03:00",
  "WhenChanged": "2026-03-30T17:07:44+03:00",
  "AdminDisplayName": "",
  "AutomaticServiceUpdateEnabled": true,
  "DecryptAttachmentFromPortal": false,
  "DistinguishedName": "CN=ControlPoint Config,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "EnablePortalTrackingLogs": false,
  "ExchangeObjectId": "d93d2c61-fc07-4463-8f05-c9f09a37fbb8",
  "InternetConfidentialEnabled": false,
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "OtherWellKnownObjects": [],
  "PublishingLocation": null,
  "RMSOnlineVersion": "",
  "RejectIfRecipientHasNoRights": false,
  "ServerCertificatesVersion": 0,
  "SharedServerBoxRacIdentity": "",
  "SystemCleanupPeriod": 0,
  "WhenChangedUTC": "2026-03-30T14:07:44Z",
  "WhenCreatedUTC": "2026-03-30T14:07:36Z"
}

Notes: Tenant singleton (no key in the URL). Identity is the fixed system value “ControlPoint Config”. AzureRMSLicensingEnabled is emitted as a stringified boolean by the cmdlet.

PATCH /exchange/v1.0/irmConfiguration

PATCH /irmConfiguration - update the tenant-wide IRM singleton. Body keys map 1:1 to Set-IRMConfiguration parameters (e.g. azureRMSLicensingEnabled, simplifiedClientAccessEnabled). Returns 200 + the post-Set singleton.

Backing cmdlet: Set-IRMConfiguration. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type
`automaticServiceUpdateEnabled`	body
`azureRMSLicensingEnabled`	body
`decryptAttachmentForEncryptOnly`	body
`eDiscoverySuperUserEnabled`	body
`enablePdfEncryption`	body
`enablePortalTrackingLogs`	body
`internalLicensingEnabled`	body
`journalReportDecryptionEnabled`	body
`licensingLocation`	body
`rejectIfRecipientHasNoRights`	body
`rmsOnlineKeySharingLocation`	body
`searchEnabled`	body
`simplifiedClientAccessDoNotForwardDisabled`	body
`simplifiedClientAccessEnabled`	body
`simplifiedClientAccessEncryptOnlyDisabled`	body
`transportDecryptionSetting`	body
`dryRun`	query	bool (switch)

Update the tenant-wide IRM configuration singleton

Updates the tenant-wide Information Rights Management (Azure RMS) singleton via Set-IRMConfiguration. Body keys map 1:1 to Set-IRMConfiguration parameters; the controller returns the post-Set singleton.

PATCH /exchange/v1.0/irmConfiguration HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "azureRMSLicensingEnabled": true,
  "simplifiedClientAccessEnabled": true,
  "searchEnabled": true
}

HTTP/1.1 200 OK
Content-Type: application/json; odata.metadata=minimal

{
  "Identity": "IRMConfiguration",
  "AzureRMSLicensingEnabled": true,
  "SimplifiedClientAccessEnabled": true,
  "SearchEnabled": true,
  "InternalLicensingEnabled": true,
  "JournalReportDecryptionEnabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/irmConfiguration/refreshCertificates

POST /irmConfiguration/refreshCertificates - trigger Set-IRMConfiguration -RefreshServerCertificates as a bound action (side-effect: tenant re-fetches RMS server certs). Returns 204.

Backing cmdlet: Set-IRMConfiguration. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Refresh RMS server certificates

Bound action - POST /irmConfiguration/refreshCertificates triggers Set-IRMConfiguration -RefreshServerCertificates as a side effect. The cmdlet re-fetches the Rights Management Service certificates from Azure (useful after a tenant move, an RMS-server cert rotation, or when IRM operations start failing with stale-cert errors). No body. Idempotent - multiple invocations re-fetch each time. Returns 204.

POST /exchange/v1.0/irmConfiguration/refreshCertificates HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 204 No Content

?dryRun=true previews of any write stay on Community.