Email Encryption in Microsoft 365 –

Microsoft 365 encrypts email so only intended recipients can read it, inside or outside the organization. This article covers which encryption method to use, how admins enable and automate it, how users send encrypted mail, and what recipients see.

Audience: Microsoft 365 / Exchange Online admins, help desk staff, and end users.

Scope: Exchange Online mailboxes. On-premises Exchange and third-party gateways are out of scope.

Encryption options compared

For most organizations, Microsoft Purview Message Encryption is the default choice: it works with any recipient (including Gmail and Yahoo) and needs no certificates. Legacy Office 365 Message Encryption (OME) is deprecated; Purview Message Encryption is built on the Azure Rights Management service (Microsoft Learn).

TLS alone does not protect a message once it lands in a mailbox. Use one of the other methods when content is sensitive.

Licensing and prerequisites

Standard Message Encryption is included in most business and enterprise plans; expiry and revocation need E5-level licensing. Each user who sends encrypted mail must be licensed. Confirm current entitlements in the Microsoft Purview licensing guidance before rollout.

Technical prerequisites

• Azure Rights Management (Azure RMS) is activated for the tenant. It is on by default in tenants created after early 2018.
• Exchange Online is the mail host; admins hold the Exchange Administrator or Compliance Administrator role.
• Exchange Online PowerShell module (ExchangeOnlineManagement) installed for verification steps.

Admin setup: verify encryption is enabled

In most licensed tenants encryption is already on: when Azure RMS is active, Purview Message Encryption activates automatically. Run the checks below to confirm, per Set up Message Encryption.

1. Connect to Exchange Online PowerShell:

Install-Module ExchangeOnlineManagement   # first time only
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

2. Check that encryption is licensed in the tenant. AzureRMSLicensingEnabled must be True:

Get-IRMConfiguration | Format-List AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled

3. If it is False, enable it:

Set-IRMConfiguration -AzureRMSLicensingEnabled $true

4. Test end to end with any two mailboxes in the tenant. Every check should report PASS:

Test-IRMConfiguration -Sender admin@contoso.com -Recipient user@contoso.com

5. Confirm the protection templates exist (Encrypt and Do Not Forward appear by default):

Get-RMSTemplate | Format-Table Name, Type

6. Show the Encrypt button in Outlook on the web, if hidden:

Set-IRMConfiguration -SimplifiedClientAccessEnabled $true

If step 4 fails with “Failed to acquire RMS templates”, connect with the AIPService module and point Exchange at the RMS licensing URL, then retest:

Connect-AipService
$RMSConfig = Get-AipServiceConfiguration
$LicenseUri = $RMSConfig.LicensingIntranetDistributionPointUrl
Set-IRMConfiguration -LicensingLocation $LicenseUri
Set-IRMConfiguration -InternalLicensingEnabled $true

Purview Message Encryption does not work while Exchange Online is still bound to on-premises AD RMS; migrate to Azure RMS first.

Admin: auto-encrypt with mail flow rules

A mail flow (transport) rule encrypts any message that matches its conditions before it leaves Exchange Online, so users don’t have to remember. The most common rule encrypts external mail whose subject contains a keyword such as [secure]. Full reference: Define mail flow rules to encrypt email messages.

In the Exchange admin center

1. Go to admin.exchange.microsoft.com > Mail flow > Rules > Add a rule > Apply Office 365 Message Encryption and rights protection to messages.
2. Name the rule, e.g. Encrypt – [secure] keyword to external.
3. Apply this rule if: The recipient is located > Outside the organization. Add a second condition: The subject or body > subject includes any of these words > [secure], encrypt.
4. Do the following: Modify the message security > Apply Office 365 Message Encryption and rights protection > select Encrypt (or Do Not Forward).
5. Optional: add the exception The sender is > a service account or system mailbox that must not be encrypted.
6. Set mode to Enforce, save, and enable the rule. Allow up to 30 minutes for the rule to take effect.

Same rule in PowerShell

New-TransportRule -Name "Encrypt - [secure] keyword to external" `
  -SentToScope NotInOrganization `
  -SubjectContainsWords "[secure]","encrypt" `
  -ApplyRightsProtectionTemplate "Encrypt"

Other useful rule patterns

A Data Loss Prevention (DLP) policy in the Purview portal can apply the same encryption action and is the better choice when the condition is sensitive data rather than a keyword.

End user: send an encrypted email

In every desktop and web Outlook client the path is the same: Options > Encrypt, then choose Encrypt or Do Not Forward (Microsoft Support).

Which option to pick

• Encrypt (Encrypt-Only): recipient can read, reply, forward and print. Use for most sensitive mail.
• Do Not Forward: recipient cannot forward, print, or copy. Office attachments stay protected after download.
• Sensitivity label (if your org publishes them): e.g. Confidential – External. The label applies your organization’s protection settings for you.

Tip: If your admin created a keyword rule, typing [secure] in the subject encrypts the message automatically from any client, including phones.

To remove encryption before sending, open Encrypt again and choose No permission set or remove the label.

S/MIME is a separate, certificate-based option under Options > Encrypt with S/MIME (classic) or Message options (web). Use it only if your organization has issued certificates and the recipient has one too.

Recipient experience

Microsoft 365 and Outlook.com recipients read encrypted mail like any other message; everyone else opens it in a browser portal after signing in or entering a one-time passcode (Open encrypted and protected messages).

Instructions to share with external recipients

1. Open the email and select Read the message. A browser tab opens.
2. Select Sign in with Google / Yahoo / Microsoft, or Sign in with a one-time passcode.
3. For a passcode, check the same inbox for an email from Microsoft, copy the code, paste it in the browser, and select Continue.
4. Passcodes expire after 15 minutes. If one expires, open the original email again and request a new code.
5. On a private computer, tick This is a private computer. Keep me signed in to avoid repeated passcodes.
6. Reply from the portal; the reply stays encrypted.

An attachment named message.rpmsg or message.html is part of the protected message and isn’t opened directly.

Branding, expiry and revocation

Every tenant can rebrand its single default template; extra templates, expiry and revocation need Advanced Message Encryption and work only for external recipients who read through the encrypted message portal.

Brand the default template (all licensed tenants)

Set-OMEConfiguration -Identity "OME Configuration" `
  -Image ([System.IO.File]::ReadAllBytes('C:\Temp\logo.png')) `
  -BackgroundColor "#FFFFFF" `
  -IntroductionText "has sent you a secure message." `
  -DisclaimerText "This message is confidential. If you received it in error, delete it." `
  -PrivacyStatementUrl "https://www.contoso.com/privacy"

Create an expiring template and apply it (Advanced)

1. Create a template that expires portal access after 7 days (valid range 0–730; 0 = never), per New-OMEConfiguration:

New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7

2. Apply it with a mail flow rule. A branding template on the rule forces external recipients through the portal:

New-TransportRule -Name "Encrypt external - 7 day expiry" `
  -SentToScope NotInOrganization `
  -SubjectContainsWords "[secure]" `
  -ApplyRightsProtectionTemplate "Encrypt" `
  -ApplyRightsProtectionCustomizationTemplate "Expire in 7 days"

Revoke a sent message (Advanced)

1. Find the Message ID with a message trace in the Exchange admin center, or in the Purview Encryption report.
2. Confirm it can be revoked, then revoke and verify (Microsoft Learn):

Get-OMEMessageStatus -MessageId "<messageId>" | Format-List Subject, IsRevocable
Set-OMEMessageRevocation -Revoke $true -MessageId "<messageId>"
Get-OMEMessageStatus -MessageId "<messageId>" | Format-List Subject, Revoked

Senders can also revoke portal-delivered mail to a single Gmail or Yahoo recipient from Outlook on the web. To audit portal access, run Set-IRMConfiguration -EnablePortalTrackingLogs $true, then search Encrypted message portal activities in Purview Audit.

Troubleshooting and FAQ

Most issues trace back to licensing, a disabled Encrypt button, or a passcode email caught by spam filtering.

FAQ

• Are replies encrypted? Yes. Replies from recipients to an encrypted message are encrypted too.
• Are attachments encrypted? Yes. With Encrypt-Only, recipients can download unprotected copies of most attachments; with Do Not Forward, Office files stay protected.
• Can I recall an encrypted message? Only with Advanced Message Encryption, and only when the recipient reads it through the portal.
• Is there a size limit? Encrypted messages follow normal Exchange Online limits; very large attachments can fail in the portal. Share large files via OneDrive/SharePoint links instead.
• Does encryption stop phishing or malware? No. It protects confidentiality only; Defender for Office 365 handles threats.