This stopped working for our tenant about two weeks ago. I have gone into PowerShell and checked the IRMConfiguration settings and DecryptAttachmentFromPortal and DecryptAttachmentForEncryptOnly are both set to True, but now all our Office document attachments are retaining the protection when downloaded using the Outlook desktop application. I’ve gone to our O365 provider for help but so far they haven’t been able to help us.