diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90a298403..fa707c999 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - Added additional permissions for Graph application permission validate sets. [#3835](https://github.com/pnp/powershell/issues/3835)
 - Added the ability to upload entire local folders with files and optionally subfolders to SharePoint Online into 'Copy-PnPFolder' [#3850](https://github.com/pnp/powershell/pull/3850)
 - Added `LoopDefaultSharingLinkRole`, `DefaultShareLinkScope`, `DefaultShareLinkRole`, `LoopDefaultSharingLinkScope` and `DefaultLinkToExistingAccessReset` parameters to `Set-PnPTenant` cmdlet. [#3874](https://github.com/pnp/powershell/pull/3874)
+- Added `Unlock-PnPSensitivityLabelEncryptedFile` which allows the encryption to be removed from a file [#3864](https://github.com/pnp/powershell/pull/3864)
 - Added `Get-PnPLibraryFileVersionBatchDeleteJobStatus` and `Get-PnPSiteFileVersionBatchDeleteJobStatus` to check on the status of applying file based version expiration based on age on a library and site level [#3828](https://github.com/pnp/powershell/pull/3828)
 
 ### Fixed
diff --git a/documentation/Unlock-PnPSensitivityLabelEncryptedFile.md b/documentation/Unlock-PnPSensitivityLabelEncryptedFile.md
new file mode 100644
index 000000000..ea07dd71e
--- /dev/null
+++ b/documentation/Unlock-PnPSensitivityLabelEncryptedFile.md
@@ -0,0 +1,84 @@
+---
+Module Name: PnP.PowerShell
+title: Unlock-PnPSensitivityLabelEncryptedFile
+schema: 2.0.0
+applicable: SharePoint Online
+external help file: PnP.PowerShell.dll-Help.xml
+online version: https://pnp.github.io/powershell/cmdlets/Unlock-PnPSensitivityLabelEncryptedFile.html
+---
+ 
+# Unlock-PnPSensitivityLabelEncryptedFile
+
+## SYNOPSIS
+
+**Required Permissions**
+
+* SharePoint: Access to the SharePoint Tenant Administration site
+
+## SYNTAX
+
+```powershell
+Unlock-PnPSensitivityLabelEncryptedFile -Url <String> -JustificationText <string> [-Connection <PnPConnection>] 
+```
+
+## DESCRIPTION
+
+It removes encryption on a Sensitivity label encrypted file in SharePoint Online.
+
+## EXAMPLES
+
+### EXAMPLE 1
+```powershell
+Unlock-PnPSensitivityLabelEncryptedFile -Url "https://contoso.com/sites/Marketing/Shared Documents/Doc1.docx" -JustificationText "Need to access file"
+```
+
+This example will remove a regular label with admin defined encryption from the file Doc1.docx and also make an entry in audit logs.
+
+## PARAMETERS
+
+### -Connection
+Optional connection to be used by the cmdlet. Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
+
+```yaml
+Type: PnPConnection
+Parameter Sets: (All)
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Url
+Full URL for the file
+
+```yaml
+Type: string.
+Parameter Sets: (All)
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -JustificationText
+Text that explains the reason to run this cmdlet on the given file.
+
+```yaml
+Type: string.
+Parameter Sets: (All)
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+## RELATED LINKS
+
+[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)
+
diff --git a/src/Commands/Admin/UnlockSensitivityLabelEncryptedFile.cs b/src/Commands/Admin/UnlockSensitivityLabelEncryptedFile.cs
new file mode 100644
index 000000000..3f8f55df2
--- /dev/null
+++ b/src/Commands/Admin/UnlockSensitivityLabelEncryptedFile.cs
@@ -0,0 +1,22 @@
+using PnP.PowerShell.Commands.Base;
+using System.Management.Automation;
+
+namespace PnP.PowerShell.Commands.Files
+{
+        [Cmdlet(VerbsCommon.Unlock, "PnPSensitivityLabelEncryptedFile")]
+        public class UnlockSensitivityLabelEncryptedFile : PnPAdminCmdlet
+        {
+            [Parameter(Mandatory = true, Position = 0, ValueFromPipeline = true)]
+            public string Url = string.Empty;
+            [Parameter(Mandatory = true)]
+            public string JustificationText = string.Empty;
+            protected override void ExecuteCmdlet()
+            {
+                // Remove URL decoding from the Url as that will not work. We will encode the + character specifically, because if that is part of the filename, it needs to stay and not be decoded.
+                Url = Utilities.UrlUtilities.UrlDecode(Url.Replace("+", "%2B"));
+
+                Tenant.UnlockSensitivityLabelEncryptedFile(Url, JustificationText);
+                AdminContext.ExecuteQuery();
+            }
+    }
+}