Decrypting an RPMSG Message file

Question

Decrypting an RPMSG Message file

Graf, Nico 0

Hello, i have implemented the example to access an rpmsg-Message file (https://github.com/Azure-Samples/MipSDK-File-Dotnet-ServicePrincipalAuth). I have configured my MS Entra correctly, registeresd an app with application delegation access as it was described in the readme. But when i call "CreateFileHandlerAsync" i got an AccessDeniedException: The service didn't accept the auth token. Challenge:['Bearer resource="https://aadrm.com" ..... What can I do? What can be wrong configured? I have also booked an additional service (Enterprise Mobility + Security E3) to my Microsoft 365 Business Basic. Or must i have an other License? Regards Nico

Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2024-03-01T04:34:50.5266667+00:00

@Graf, Nico Thank you for reaching out to us,

Have you registered your client app in Entra ID as below ?:

https://learn.microsoft.com/en-us/information-protection/develop/setup-configure-mip#register-a-client-application-with-microsoft-entra-id

What is the scope you are using? use https://aadrm.com/.default as scope instead of https://aadrm.com
Graf, Nico 0 Reputation points

2024-03-01T21:45:24.36+00:00

Hello @Givary-MSFT ,

thank you for response.

Yes, i have registered the client app correctly. Now i have found someting. I can decrypt rpmsg-Messages with the MIP-SDK when the mail is an internal mail. When i get an external protected mail (from another office365 tenant) i can't decrypt and get the error message described in my first post. Is it generally not possible? Oulook can display this external proteced message so i think it should work somehow.

Regards

Nico
Bohdan Bondar 0 Reputation points

2026-05-29T09:04:43.56+00:00

Hi @Graf, Nico

Did you manage to decrypt protected email sent from external tenant? If yes, could you please share the solution.

Thanks.
Graf, Nico 0 Reputation points

2026-05-29T09:15:42.9533333+00:00

Hi @Bohdan Bondar , no, we have no solution found for that problem yet. Sorry.

1 answer

Your answer

Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2024-03-01T04:34:50.5266667+00:00

@Graf, Nico Thank you for reaching out to us,

Have you registered your client app in Entra ID as below ?:

https://learn.microsoft.com/en-us/information-protection/develop/setup-configure-mip#register-a-client-application-with-microsoft-entra-id

What is the scope you are using? use https://aadrm.com/.default as scope instead of https://aadrm.com
Graf, Nico 0 Reputation points

2024-03-01T21:45:24.36+00:00

Hello @Givary-MSFT ,

thank you for response.

Yes, i have registered the client app correctly. Now i have found someting. I can decrypt rpmsg-Messages with the MIP-SDK when the mail is an internal mail. When i get an external protected mail (from another office365 tenant) i can't decrypt and get the error message described in my first post. Is it generally not possible? Oulook can display this external proteced message so i think it should work somehow.

Regards

Nico
Bohdan Bondar 0 Reputation points

2026-05-29T09:04:43.56+00:00

Hi @Graf, Nico

Did you manage to decrypt protected email sent from external tenant? If yes, could you please share the solution.

Thanks.
Graf, Nico 0 Reputation points

2026-05-29T09:15:42.9533333+00:00

Hi @Bohdan Bondar , no, we have no solution found for that problem yet. Sorry.

Answer 1

hi Graf, Nico & thanks for join me here at Q&A portal,

this error usually means the token returned to the MIP SDK is not valid for Azure Rights Management. The challenge says resource="https://aadrm.com", so when the SDK asks for a token for https://aadrm.com, ur auth delegate must return a token for exactly that resource/scope, not Graph, not ARM, not api.mip.microsoft.com. Look if the app registration permissions first. For MIP SDK service principal scenarios you need the right application permissions and admin consent. Microsoft documents the required MIP SDK permissions https://learn.microsoft.com/en-us/information-protection/develop/concept-api-permissions For protection/RPMSG work, make sure the app has Azure Rights Management permissions such as Content.DelegatedReader or the relevant RMS permission, and admin consent has actually been granted.

Service principal auth does not magically mean the app can decrypt any RPMSG. The identity still must have rights to the protected message. If the message was protected for a specific user, the service principal must be acting in a supported delegated/super-user scenario, or the tenant must allow that service to access the protected content.

U can review MIP SDK setup https://learn.microsoft.com/en-us/information-protection/develop/setup-configure-mip

But review if token audience is https://aadrm.com, admin consent is granted for MIP/RMS application permissions, the service principal is actually authorized to decrypt that protected message....

EMS E3 is generally enough for Azure Information Protection/Purview Information Protection features, but licensing alone will not fix a wrong token audience or missing RMS permission.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal