This guide explains how to open an encrypted document protected by Microsoft's Azure Information Protection. To be more precise, this applies to documents protected with Azure Information Protection (AIP) sensitivity labels with access permissions managed by the Azure Rights Management Service (RMS). If that was Greek to you, then all you have to know is that this guide applies to you if the document you are trying to open displays a message that looks like either of these messages:
Accept the Invitation to Join their Organization
The organization that shared the protected file will need to invite you as a guest user to their Azure Active Directory (AAD). You should receive an email invite to their organization as a guest user. Click the "Get Started" button and follow the directions to join their organization. If you don't receive the invitation email, then ask for the person who shared the file with you to resend the invitation.
Download the Microsoft RMS Plug-in
For PDF's, use a supported viewer like Adobe PDF Reader or Foxit PDF. Save the file to your computer, right click on it and select the viewer from the "Open with" list (e.g. Adobe Acrobat Reader DC).
The PDF viewer may ask you to download an add-in/ plug-in. Click the "Download" button. This will take you to an online download page. Once installed, the plug-in will allow you to use your email and password (you just set up when accepting the invitation to join the organization) to authenticate and actually view the document.
Download and install the latest plug-in. For Adobe Acrobat Reader DC, download the latest one from the "Plug-in for Acrobat Reader DC Continuous" section.
Open the Document
Now that you joined the organization as a guest user and have the right software installed, close the document and try reopening it. Microsoft will prompt you to enter your email and password. Once authenticated, the document will finish opening.