Get All AIP encrypted files - SharePoint Online

One of the recent project merger and acquisition. 

Technology - M365 tenant to Tenant migration

Areas of consolidation
1. Mailboxes 
2. SharePoint online data
3. OneDrive for Business data
4. Teams data migration
5. Security and Compliance Migration 

Area of concern from security and compliance side was the encrypted files within EXO, SPO, Teams, ODB.

Issue with encrypted data migration - end users will not be able to access the documents once the Source tenant is decommissioned.  

Solution available - 
Ask end users to unencrypt the data before migration 

Alternet Solution -

1. Decrypt the files, mails using eDiscovery - This will give us output in PST format will is available for offline access, but the data in source will still be encrypted. 

Decryption in eDiscovery - Microsoft Purview (compliance) | Microsoft Docs 

2. Use Get-AIPfileLabel and Get-AIPFileLabel but in order to use this you must be aware of all the files paths. 

Challenges - 

1. We do not want end user intervention to remove encryptions

2. We are not aware where all these files and emails are and who own it.

3. eDiscovery will not solve the purpose for data migration 

What we did 

1. Created a PowerShell Script to identify the list of encrypted document on SharePoint online (tenant wide)

How to use the script 

1. Enter all the SharePoint Sites URL for scanning in the excel sheet. 

Edit the Script - change the following values 

$username = ""

$password = ""

$TenantAdminURL 

$FileURL

This script will automatically generate the output file in the output folder and generate logs too under logs folder. 

Note - Script and input file must be in the same location. 

You can use the same script to get details from one Drive folder too.

Currently there is no option other than below one's to get the details on encrypted email, however this is a manual task.

• Content Explorer List Viewer
• Content Explorer Content Viewer

Script can be found Encrypted Documents