How to Setup Encrypted Email in Office 365

Email encryption is an essential security feature for protecting sensitive information during email communication. Businesses rely heavily on emails to share critical details, including financial reports, client data, and confidential agreements. Without proper encryption, unauthorized users could intercept and misuse this information.

Microsoft Office 365 offers built-in tools like Microsoft Purview Message Encryption and Information Rights Management (IRM) to encrypt messages and safeguard your data. These tools are widely supported across major email clients and ensure that even if someone intercepts your email message, they won’t be able to read its content.

This guide will walk you through the step-by-step process to set up email encryption in Office 365. Whether you’re a small business owner securing client communications, a sales professional protecting proprietary leads, or an enterprise team complying with data privacy laws, this guide simplifies the entire setup.

Here’s what you’ll learn:

• How to enable encryption in Microsoft 365.
• Creating mail flow rules to encrypt email.
• Sending encrypted emails using Outlook.
• Managing encryption policies for long-term security.

Understanding Email Encryption in Office 365

Email encryption ensures that only intended recipients can view the content of an email message. For businesses, this adds an extra layer of security to email communication, helping to protect sensitive information from unauthorized access. Microsoft 365 provides multiple encryption options to secure your emails effectively.

What is Email Encryption and Why is it Needed?

Encryption converts an email message into unreadable plain text using advanced encryption algorithms. Only the recipient with the right decryption key can read the message content. Without encryption, confidential data shared via email becomes vulnerable to cyberattacks.

For example:

• A sales professional sharing pricing details.
• A marketer sending reports containing customer information.
• An enterprise team exchanging private contracts.

By using email encryption, businesses can protect sensitive information and maintain the security of sensitive information in line with compliance standards.

Encryption Options in Office 365

Microsoft Office 365 offers three key methods for encrypting emails:

1. Microsoft Purview Message Encryption (MPME):
   • Included with Microsoft 365 and Office 365 subscriptions.
   • Allows users to send encrypted emails to anyone, even external recipients using non-Microsoft services.
   • Recipients can access the encrypted mail through a secure email with a link.
2. Information Rights Management (IRM):
   • Based on Azure Rights Management (Azure RMS), IRM encrypts emails and applies access controls.
   • Prevents actions like forwarding, copying, or printing.
   • Best for businesses needing strict encryption and access controls.
3. S/MIME (Secure/Multipurpose Internet Mail Extensions):
   • A standard encryption option widely supported by email clients.
   • Uses certificates to encrypt messages end-to-end.
   • Requires both the sender and recipient to have S/MIME certificates installed.

How Office 365 Ensures Secure Email Communication

• Microsoft Purview Message Encryption and Azure RMS use industry-standard encryption algorithms.
• Admins can configure mail flow rules to automatically encrypt emails based on keywords, attachments, or recipients.
• The encryption setup is user-friendly and integrates seamlessly with Outlook and other email systems.

Prerequisites for Setting Up Email Encryption

Before you set up email encryption in Office 365, there are a few requirements to ensure a smooth setup process. These prerequisites involve verifying subscriptions, enabling specific features, and ensuring access to the right tools.

1. Required Office 365 Subscriptions

To use Microsoft Purview Message Encryption and other encryption options, you need one of the following plans:

• Microsoft 365 E3/E5 or Office 365 E3/E5.
• Microsoft 365 Business Premium.
• Information Protection and Governance add-ons, such as Azure Information Protection Plan 1 or Microsoft Purview Message Encryption.

If your organization is using Azure RMS or AD RMS, you might need to migrate to Azure for full compatibility with Office 365 message encryption.

2. Enable Azure Rights Management

Azure Rights Management (Azure RMS) powers the encryption capabilities in Office 365. You must enable it before configuring any email encryption settings. Here’s how:

1. Sign in to the Microsoft 365 admin center using an email account with admin permissions.
2. Go to Settings > Org settings > Security & privacy.
3. Select Azure Information Protection and enable it.
4. Verify activation using PowerShell: Connect-AipService  
Get-AipServiceConfiguration  
   If successful, Azure RMS is now active for your organization.

3. Administrative Permissions

To configure encryption rules and policies, you need global admin or Exchange admin permissions. Only admins with appropriate rights can access the Exchange admin center or run PowerShell scripts to manage encryption.

4. Outlook and Email Client Compatibility

Ensure that your users are using supported email clients for sending and receiving encrypted emails:

• Outlook for Microsoft 365 (Windows/Mac).
• Outlook on the Web.
• Mobile apps for Outlook (iOS and Android).
• Other major email providers with encryption software support.

Step-by-Step Guide to Configuring Email Encryption

Follow this step-by-step process to set up email encryption in Microsoft 365 and Office 365. This guide covers enabling encryption, creating rules, and sending encrypted emails.

1. Enable Microsoft Purview Message Encryption

To use Microsoft Purview Message Encryption, you need to activate it in the Microsoft 365 admin center.

1. Sign in to the Microsoft 365 Admin Center
   • Use your email account with admin permissions.
2. Activate Azure Rights Management (Azure RMS):
   • Go to Settings > Org Settings > Security & Privacy.
   • Select Azure Rights Management and enable it.
3. Verify Activation Using PowerShell
   Run the following PowerShell commands: Connect-ExchangeOnline  
Get-IRMConfiguration    If Azure RMS is active, the status will confirm its availability for email encryption.

2. Configure Mail Flow Rules to Encrypt Email

Mail flow rules allow you to automatically encrypt outgoing emails based on specific conditions, such as keywords or recipients.

1. Access the Exchange Admin Center:
   • Go to Microsoft 365 Admin Center > Exchange.
2. Create a New Mail Flow Rule:
   • Navigate to Mail Flow > Rules.
   • Click + (New) and select Create a New Rule.
3. Define Conditions and Actions:
   • Condition: Set criteria like “emails containing sensitive keywords” or “specific attachments for outgoing messages.”
   • Action: Select Apply Office Message Encryption.
   • Example Rule: Encrypt emails containing the word “confidential” in the subject or body.
4. Save and Test the Rule:
   • Test the rule by sending an email that meets the conditions.
   • Verify that the email is encrypted before sending.

3. Send Encrypted Emails Using Outlook

Once encryption is enabled, users can send encrypted emails through Outlook or Outlook on the Web.

1. Using Outlook for Microsoft 365:
   • Create a new email message.
   • Go to Options > Encrypt and choose Encrypt Only or Do Not Forward.
   • Add the recipient’s email address and click Send.
2. Using Outlook on the Web:
   • Start a new message.
   • Select the Encrypt option from the toolbar.
   • Send the email as usual.
3. How It Works for Recipients:
   • If the recipient uses Microsoft 365, they can open the encrypted email directly.
   • Non-Microsoft recipients will receive an email with a link to view the message securely.

4. Verify Your Email Encryption Setup

After completing the setup, confirm that your emails are encrypted correctly:

• Check for the Encrypt label in sent emails.
• Ensure recipients receive encrypted content as intended.
• Monitor any encryption errors or decryption issues.

Managing Encryption Policies and Best Practices

Once you’ve configured email encryption in Office 365, it’s essential to manage your policies effectively to ensure the ongoing security of your emails. Here’s how you can fine-tune encryption settings and follow best practices for secure email communication.

1. Managing Encryption Policies

Microsoft Purview Message Encryption and Information Rights Management (IRM) allow admins to create and enforce encryption policies. Here’s how to manage these:

1. Access the Exchange Admin Center (EAC):
   • Go to Microsoft 365 Admin Center > Exchange.
2. Edit Existing Mail Flow Rules:
   • Under Mail Flow > Rules, select an existing rule.
   • Update conditions, actions, or exceptions to meet changing business needs.
   • Example: Add more keywords to trigger message encryption automatically.
3. Create Templates for Consistency:
   • Use predefined template options in Azure RMS or IRM to standardize encryption settings.
   • Example: Apply a Do Not Forward template for sensitive email messages.
4. Monitor Policy Effectiveness:
   • Use the Microsoft 365 compliance center to review reports on encrypted emails.
   • Check for any issues, such as failed encryption or unreadable content.

2. Best Practices for Email Encryption in Office 365

Follow these tips to make the most of Office 365 email encryption:

1. Automatically Encrypt Sensitive Content:
   • Configure mail flow rules to automatically encrypt emails containing specific terms like “confidential” or “sensitive information.”
   • Use attachments for outgoing messages as a condition to enforce encryption.
2. Educate Users on When to Encrypt Emails:
   • Train your team to manually choose encryption options when sharing private data using Outlook.
   • Encourage using encrypt emails in Outlook for extra protection.
3. Test Encryption Policies Regularly:
   • Send test emails to internal and external recipients to confirm encryption works as intended.
   • Verify the recipient’s ability to open and read the encrypted content.
4. Enable Multi-Factor Authentication (MFA):
   • Combine email encryption with MFA to ensure only authorized users access the encrypted content.
5. Regularly Update Security Features:
   • Stay updated with the latest encryption capabilities offered in Microsoft 365.
   • Check for improvements to Azure RMS and Microsoft Purview Message Encryption.

Troubleshooting Common Issues

Even after setting up email encryption in Office 365, users may encounter some challenges. Here are common problems and their solutions to ensure smooth and secure email communication.

1. Azure Rights Management Not Enabled

If Azure Rights Management (Azure RMS) isn’t active, email encryption won’t work.

Solution:

• Verify Azure RMS activation using PowerShell: Connect-ExchangeOnline  
Get-IRMConfiguration  
• If inactive, enable it through the Microsoft 365 Admin Center.

2. Encrypted Emails Not Accessible by External Recipients

Sometimes, recipients outside your organization cannot access encrypted emails.

Solution:

• Ensure you are using Microsoft Purview Message Encryption, which allows external recipients to receive an email with a link to decrypt and read the message.
• Instruct external users to open the link and verify their email address to access the content.

3. Mail Flow Rules Not Triggering Encryption

If your configured mail flow rules fail to encrypt emails, the rule conditions might not match.

Solution:

• Check your mail flow rules in the Exchange Admin Center:
  • Ensure the rule conditions (keywords, recipients, or attachments) are correctly set.
  • Test the rule by sending an email with known sensitive keywords.

4. Encrypted Attachments Appearing as Plain Text

Attachments in outgoing encrypted emails might appear as plain text if settings are not configured properly.

Solution:

• Verify that encryption rules apply to both the message content and any attachments.
• Update your rules in the Exchange Admin Center to include “attachments for outgoing messages.”

5. PowerShell Configuration Errors

Errors may occur when using PowerShell to verify or manage encryption settings.

Solution:

• Ensure you have the latest Exchange Online PowerShell module installed.
• Run PowerShell as an administrator and reconnect to Exchange Online. Install-Module -Name ExchangeOnlineManagement  
Connect-ExchangeOnline    

6. Delays in Sending Encrypted Emails

Sending encrypted emails may take longer than expected, especially for large attachments.

Solution:

• Optimize the email content and avoid oversized attachments.
• Use file-sharing options like OneDrive for Business to share large files securely.

FAQs

Conclusion

Implementing email encryption in Office 365 is essential for securing sensitive information and maintaining trust in your email communication. By using tools like Microsoft Purview Message Encryption and Azure Rights Management, businesses can easily encrypt messages and ensure that only intended recipients can access the content.

This guide provided a step-by-step process to:

• Enable encryption with Azure RMS.
• Create mail flow rules to automatically encrypt emails.
• Use Outlook to send encrypted messages securely.
• Troubleshoot common issues to maintain a smooth encryption setup.

Whether you’re a small business owner safeguarding client data or an enterprise team ensuring compliance, Office 365 email encryption offers the tools you need to protect sensitive information and improve the security of your emails. Regular monitoring and updates will help you maximize these encryption capabilities.