How to Set Up and Manage Email Encryption in Office 365

Office 365 Message Encryption (OME) enables organizations to securely send sensitive information across mail servers. Powered by Azure Information Protection, OME combines email encryption with rights management capabilities.

The E3 and E5 plans of the Office 365 and Microsoft 365 suites are automatically licensed for encryption. To use it with a lower plan, you must purchase the Azure Information Protection add-on license for each user who needs encryption. OME works with Office 365 mailboxes as well as with on-premises mailboxes that use Exchange Online Protection.

Emails are encrypted using a rights management template by default. You can also create your own through the Azure portal.

How to send an encrypted message

To send an encrypted email using the Outlook client, from the message window

1. Go to the Options tab.
2. Click on Permission.
3. Choose Encrypt from the list of protection options.

In Outlook on the Web, in a new message window,

1. Click on Protect in the menu bar.
2. Click on Change permissions.
3. In the window that appears, choose Encrypt from the drop-down.

How to read and respond to encrypted messages

The image below shows an encrypted message sent to an external recipient.

When the outside user clicks on the Read the message button, they can choose to one of the following.

1. Sign in with an existing social account that uses the same email address as the message was sent to.
2. Have the service send a one-time passcode to that email address.

When any one of the steps in successful, the service will display the protected message in the web browser window connected to a page on the Office 365 Message Encryption portal. The recipient can also reply securely to the original sender using the options available.