Back to script library
Entra / Microsoft 365 · SharePoint & OneDrive

Decrypt protected SharePoint documents

Uses Unlock-SPOSensitivityLabelEncryptedFile to decrypt sensitivity-label-protected SharePoint Online documents.

Connect & set up

Run these once per session. All scopes are read-only unless the script makes changes.

Connect-PnPOnline -Url $SiteURL -Credentials $O365Cred

Run it

The main script. Copy it, or download the .ps1 and run it from your console.

$SPOCheck = Get-Module "Microsoft.Online.SharePoint.PowerShell"
If (!$SPOCheck) {
Write-Host "Your PowerShell session is not connected to SharePoint Online."; break}
$SPOCheck = Get-Module "SharePointPnPPowerShellOnline"
If (!$SPOCheck) {
Write-Host "Your PowerShell session is not connected to SharePoint Onnline PnP."; break}
$SiteURL = "https://redmondassociates.sharepoint.com/sites/rabilling"
$FolderURL= "/Shared Documents/2020"
# Connect to SharePoint PnP with cached credentials
Connect-PnPOnline -Url $SiteURL -Credentials $O365Cred
$FolderItems = Get-PnPFolderItem -FolderSiteRelativeUrl $FolderURL -ItemType File
ForEach ($Item in $FolderItems) {
$ItemPath = $SiteUrl+$FolderUrl+"/"+$Item.Name
Write-Host "Unlocking" $Item.Name
Unlock-SPOSensitivityLabelEncryptedFile -FileUrl $ItemPath -JustificationText "Administrator removed label"
}
# $ItemPath Looks like this: https://redmondassociates.sharepoint.com/sites/rabilling/Shared%20Documents/2020/Document.docx
Attribution