How Do I Encrypt an Email in Outlook? Separating the Safe From the Unsafe

Encryption in Outlook is applied from the compose window: Options > Encrypt, followed by a choice between Encrypt-Only and Do Not Forward. The option appears only for accounts licensed for Microsoft Purview Message Encryption, which Microsoft's Message Encryption FAQ lists as included in Office 365 E3 and E5, Microsoft 365 E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3 and A5, and Office 365 Government G3 and G5. The same FAQ caps an encrypted message at 25 MB including attachments. Encrypt-Only leaves the recipient free to forward, copy and print the message; Do Not Forward removes all three. Neither can be applied to a message that has already left the mailbox.

The gap between those two options is where the damage happens. A sender who presses Encrypt and assumes the message is locked down has, by Microsoft's own description of the rights model, sent something the recipient is free to forward.

The account decides whether the button is there at all

Three things have to line up before Outlook will offer encryption: the licence, the client, and the organisation's rights management configuration.

On licensing, the FAQ is specific: "Each user benefiting from Microsoft Purview Message Encryption needs a license to use message encryption." Plans outside the included list — Exchange Online Plan 1 and Plan 2, Office 365 F3, Microsoft 365 Business Basic and Standard, Office 365 E1 — reach the same capability by adding Azure Information Protection Plan 1.

On clients, protected messages can be composed in Outlook for Windows, Outlook for Mac and Outlook on the web; reading adds Outlook mobile on iOS and Android. Two asymmetries matter before a team is told the feature is universal: revocation works in Outlook on the web alone, and delegated access to encrypted mail is supported everywhere except Outlook for Windows.

On configuration, an organisation still running Active Directory Rights Management on-premises cannot switch this on; Microsoft requires migration to Azure Information Protection first. Hybrid deployments must route mail through Exchange Online for encryption to apply at all. The predecessor product, Office 365 Message Encryption, was deprecated on 1 July 2023.

Encrypt-Only and Do Not Forward are two different rights models

Microsoft's usage rights documentation defines both, and the definitions do not match how the options are commonly described.

Under Encrypt-Only, recipients "have all usage rights except Save As, Export and Full Control." Microsoft spells out what that combination means in practice: "the recipients have no restrictions except that they can't remove the encryption. For example, a recipient can copy from the email, print it, and forward it." Protection travels with the message, so a forwarded copy stays encrypted and its reader must authenticate. The original recipient list is not a boundary.

Do Not Forward differs at the level of who is authorised. It is not a template. Microsoft describes it as "a set of usage rights that is dynamically applied by users to their email recipients", meaning the authorised list is built from the addresses the sender typed. Recipients cannot forward, print or copy. In the Outlook client, the Forward button disappears, Save As and Print are greyed out, and the To, Cc and Bcc fields cannot be edited.

That dynamic list is what separates it from a rights management template, whose authorised users an administrator fixes in advance. In Microsoft's illustration, a recipient covered by a Marketing template can move the email onto a USB stick where any other Marketing member reads it; under Do Not Forward, only the original addresses can open it.

| | Encrypt-Only | Do Not Forward | S/MIME | |---|---|---|---| | Recipient can forward | Yes; stays encrypted | No | Yes | | Recipient can print or copy | Yes | No | Yes | | Authorised readers | Anyone reached, after authentication | The sender's original recipients | Anyone holding the private key | | Office attachments | Inherit rights; saveable, editable, printable | Inherit Edit, Save, View, Allow Macros | Encrypted with the message | | Non-Microsoft recipient | Browser portal | Browser portal | Needs a certificate |

Applying it, version by version

In new Outlook for Windows, Microsoft's support documentation gives the path as Options > Encrypt, then a choice of Encrypt or Do Not Forward, then Send. Classic Outlook uses the same Options > Encrypt route. Outlook on the web goes through More options > Message options.

S/MIME is a separate mechanism. Turning it on for every outgoing message runs through Settings > Mail > S/MIME in new Outlook and Outlook on the web, or File > Options > Trust Center > Trust Center Settings > Email Security in classic Outlook. Microsoft's guidance names the constraint that rules it out for most external correspondence: S/MIME requires "the recipient to unlock the message with a certificate on their computer."

What a Gmail recipient actually gets

Recipients on Gmail and Yahoo receive a wrapper email pointing at Microsoft's encrypted message portal, where they authenticate "using a Microsoft account, Gmail, or Yahoo credentials." The alternative is a single-use code, and Microsoft's support page sets its lifespan exactly: "Each passcode expires after 15 minutes."

How long that access lasts depends on whether anyone configured an expiry. Microsoft's FAQ says a recipient can retrieve mail "as long as the sender's organization is active and the mail isn't configured to expire", which by default means indefinitely. Advanced Message Encryption changes that through a branded template built in Exchange Online PowerShell, where the ExternalMailExpiryInDays parameter accepts "any value between 1–730 days." Expiry and revocation cover external recipients only.

The portal carries mail and nothing else: Microsoft states it "doesn't support other message types such as calendar or voice mail." Attachment preview there covers Word, Excel, PowerPoint and PDF.

The limits that change the outcome after Send

The 25 MB ceiling in Microsoft's FAQ sits below the ordinary mailbox default, which the Exchange Online limits page gives as 35 MB for sending and 36 MB for receiving, adjustable between 1 MB and 150 MB. Encrypting a message shrinks what can be sent.

Sources disagree on the number. Microsoft's FAQ says 25 MB. The Exchange Online limits table attaches that same 25 MB figure to a row labelled for the deprecated Office 365 Message Encryption. The Illinois Department of Innovation and Technology, publishing for its own tenant, tells staff that "the maximum message size you can send with Microsoft Purview Message Encryption in our environment is 35MB, and that is including attachments." Anyone planning around the limit should test their own tenant.

Attachments follow their own rules, and this is where a message ends up half-protected. Microsoft's FAQ lists eighteen extensions that inherit encryption automatically, among them docx, dotm, pptx, ppsm, xlsx, xlsb, thmx and xps, and states that the 97-2003 formats .doc, .xls and .ppt are not supported. PDF inheritance stays off until an administrator runs Set-IRMConfiguration -EnablePdfEncryption $true. SharePoint and OneDrive cloud attachments are not covered at all: "You can encrypt a mail message, but not the cloud attachments."

Phones add two constraints. The Exchange Online limits page caps messages at 33 MB on Outlook for iOS and Android. And Microsoft's FAQ records a limitation that catches people out on a first switch-on: "You can't open attachments to emails that you receive on mobile devices by using Outlook mobile." Android and iOS hand those attachments to the Office mobile app.

When the rule, not the sender, makes the call

Administrators can take the decision away from the person composing. In the Exchange admin center, under Mail flow > Rules, a rule pairs conditions with an action. The documented conditions include the sender being located inside the organisation, the recipient being a named address or an external domain, and specified words appearing in the subject or body. The action is Modify the message security > Apply Office 365 Message Encryption and rights protection, followed by a choice of RMS template.

Two boundaries apply. Inbound mail from outside cannot be encrypted on arrival; where a rule attempts it, Microsoft says "the inbound mail will be delivered without encryption." Meeting invitations sit outside the mechanism entirely, and Microsoft points administrators to sensitivity labels instead.

The argument about what "encrypted" meant

In October 2022, WithSecure published research arguing that Office 365 Message Encryption used Electronic Codebook mode, in which identical blocks of plaintext produce identical ciphertext and structure leaks through the encryption. Harry Sintonen, a security researcher at the Finnish firm WithSecure, told The Register that "attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents." NIST's position, cited in the same coverage, is that "use of ECB to encrypt confidential information constitutes a severe security vulnerability."

Microsoft paid a bug bounty and declined to patch. Its statement: "The report was not considered meeting the bar for security servicing, nor is it considered a breach. No code change was made and so no CVE was issued for this report." WithSecure advised avoiding the product for confidentiality.

The dispute has since been overtaken by a product change. Microsoft's technical reference on encryption records that Purview Information Protection began using AES256-CBC in late August 2023, and that the mode became the default for Microsoft 365 Apps documents and emails by October 2023. Office 2013 through 2021 need the "Encryption mode for Information Rights Management (IRM)" policy set to Cipher Block Chaining; Microsoft 365 Apps from version 16.0.16327 use it by default. Messages sent before the transition stayed in the old mode, and nothing in Microsoft's documentation describes them being re-encrypted.

The message has already gone

Recall is narrower than most senders expect. Microsoft's documentation limits it to cases where "both you and the recipient have a Microsoft 365 work or school email account in the same organization, and the recipient hasn't opened the message yet." Gmail, Hotmail and Outlook.com addresses are out of reach, and where recall does apply the service retries for up to 24 hours before reporting failure.

Revocation runs on the opposite logic, which surprises people. It works only where the recipient got the link-based portal experience, meaning Gmail, Yahoo and other non-Microsoft addresses, and never where they got the inline experience that Microsoft 365 and Microsoft account recipients receive. A colleague's copy cannot be pulled back; a Gmail recipient's copy can. The sender acts from the Sent folder in Outlook on the web via Remove external access; an administrator checks eligibility with Get-OMEMessageStatus and revokes with Set-OMEMessageRevocation.

If personal data went to the wrong person, the technical options run out and the regulatory clock starts. The Information Commissioner's Office requires a notifiable breach to be reported without undue delay and no later than 72 hours after the organisation becomes aware of it, under Article 33 of the UK GDPR. The ICO treats 72 hours as a backstop rather than a grace period, and expects breaches to be documented even where no report is filed.

Keeping it consistent across a team

Ad hoc encryption leaves the decision to individual senders under time pressure, which is a poor control. Sensitivity labels move it into policy, and they are the only route to encrypted meeting invitations.

Microsoft's guidance is against elaborate schemes. A tenant can hold well over a thousand labels, dropping to a maximum of 500 where a label applies encryption specifying users and permissions, but the documented advice points the other way: "Real-world deployments show that effectiveness is noticeably reduced when users have more than five main labels or more than five sublabels per main label." Label order sets priority, most restrictive at the bottom, and published changes take up to 24 hours to reach everyone.

One correction belongs in any team briefing. Outlook's old Normal, Personal, Private and Confidential markings are not protection. Microsoft's documentation says they indicate the sender's intention and "can't provide data security."

Frequently asked questions

How do I enable email encryption in Outlook?

For Microsoft Purview Message Encryption, the sender enables nothing. The Encrypt option appears in the compose window once the account holds a qualifying licence such as Microsoft 365 Business Premium or Office 365 E3. S/MIME is enabled separately, through Settings > Mail > S/MIME, and requires a certificate on both sides.

Does Outlook have built-in encryption?

Yes, in two forms. Microsoft Purview Message Encryption is built into Exchange Online and reaches any recipient, including Gmail and Yahoo, through a browser portal. S/MIME is built into the Outlook clients but needs certificates at both ends. Neither replaces TLS, which protects mail only while it moves between servers.

How do I send an email as confidential in Outlook?

Outlook's Normal, Personal, Private and Confidential settings mark intent and enforce nothing; Microsoft's documentation says they cannot provide data security. To restrict what a recipient can do, use Options > Encrypt and choose Do Not Forward, or apply a sensitivity label configured with encryption.

Can I encrypt an email already sent?

No. Encryption is applied when the message is sent and cannot be added afterwards. If the message was already encrypted and the recipient received the link-based portal version, the sender can revoke it from the Sent folder in Outlook on the web using Remove external access. Recall works only inside the same organisation.

How do I encrypt an attachment in Outlook?

Attach the file to an encrypted message and supported formats inherit the protection. Microsoft's FAQ lists docx, xlsx, pptx and related Office extensions, and excludes the 97-2003 formats .doc, .xls and .ppt. PDF inheritance requires an administrator to run Set-IRMConfiguration -EnablePdfEncryption $true.

What will a Gmail recipient see?

A wrapper email containing a link to Microsoft's encrypted message portal. The recipient signs in with Google, Yahoo or Microsoft credentials, or requests a one-time passcode that Microsoft says expires after 15 minutes. The portal carries mail only and previews Word, Excel, PowerPoint and PDF attachments.