Email encryption is no longer a niche requirement for cybersecurity experts; it has become a standard necessity for business professionals handling sensitive client data, legal documents, or internal financial reports. Microsoft Outlook offers robust encryption features, but the method for activating them varies significantly depending on whether you are using the New Outlook, the Classic desktop application, or the Web interface.

Understanding how to protect your communications ensures that only the intended recipient can read your message, preventing unauthorized access during transit. This article provides a technical yet accessible breakdown of the steps required to encrypt emails in Outlook across all platforms.

Understanding the Two Main Types of Outlook Encryption

Before diving into the steps, it is essential to distinguish between the two technologies Outlook uses to secure messages. Your account type and organizational settings will determine which one you can access.

Microsoft Purview Message Encryption

Formerly known as Office 365 Message Encryption (OME), Microsoft Purview is the modern standard. It is a cloud-based service that allows you to send encrypted messages to anyone, regardless of their email provider (Gmail, Yahoo, or Outlook.com). It does not require the sender or recipient to manage complicated security certificates. This method is included in specific Microsoft 365 subscriptions like Business Premium, E3, and E5.

S/MIME (Secure/Multipurpose Internet Mail Extensions)

S/MIME is a traditional, certificate-based encryption method. It requires both the sender and the recipient to have a digital ID (certificate) installed on their devices. It provides a higher level of authentication because it digitally signs the email, proving the sender's identity. However, because of its complexity in exchanging public keys, it is typically used in highly regulated industries or government sectors.

Essential Prerequisites for Email Encryption

Encryption buttons do not appear by default for every user. Certain conditions must be met:

  1. Subscription Requirements: For Microsoft Purview encryption, you generally need a Microsoft 365 Enterprise (E3, E5, F3) or Business Premium plan. Standard Personal or Home subscriptions often lack these advanced Information Rights Management (IRM) features.
  2. Account Configuration: If you are using a work or school account, your IT administrator must enable message encryption at the organizational level.
  3. Digital Certificates: If you intend to use S/MIME, you must obtain a certificate from a trusted Certificate Authority (CA) and import it into your computer's certificate store.

How to Encrypt a Single Message in New Outlook for Windows and Mac

The "New Outlook" experience, which mirrors the web interface, has simplified the encryption process. The steps below apply to the latest version of the Outlook desktop app.

Step 1: Start a New Draft

Open Outlook and click on the New Mail button in the top left corner. Enter the recipient’s address, a subject line, and compose your message as usual.

Step 2: Access the Encryption Menu

Navigate to the Options tab in the top ribbon menu. Look for the Encrypt button, which is usually represented by a lock icon.

Step 3: Choose the Permission Level

Click the dropdown arrow on the Encrypt button to see your options:

  • Encrypt: The message is scrambled, but the recipient has no restrictions on what they do with it after opening (e.g., they can forward it).
  • Do Not Forward: The message is encrypted, and the recipient is restricted from forwarding, printing, or copying the content. Even if they download an attached Word document, the "Do Not Forward" restriction travels with the file.

Step 4: Send the Message

Once selected, a banner will appear at the top of the draft confirming that the message is encrypted. Click Send.

Encrypting Emails in Classic Outlook Desktop

Many organizations still rely on the "Classic" Outlook (Outlook 2016, 2019, 2021, or the M365 desktop version without the "New Outlook" toggle). The interface is more traditional here.

Using Microsoft Purview (IRM) in Classic Outlook

  1. Click New Email.
  2. Go to the Options tab.
  3. Select Permission.
  4. Choose the appropriate restriction (e.g., Encrypt-Only or Do Not Forward). Note that if you do not see these options, you might need to click Connect to Rights Management Services to download the latest templates from your organization's server.

Using S/MIME in Classic Outlook

  1. Compose your email.
  2. Go to Options.
  3. Select the Permissions group or look for Message Options.
  4. If S/MIME is configured on your machine, you will see a button labeled Encrypt or Sign. Click Encrypt.
  5. If you want to ensure the encryption is applied every time, you can go to File > Options > Trust Center > Trust Center Settings > Email Security and check the box for Encrypt contents and attachments for outgoing messages.

How to Encrypt Emails in Outlook on the Web (OWA)

The Web version is often the most reliable way to send encrypted mail if your desktop app is having synchronization issues.

  1. Sign in to your Outlook account via a web browser.
  2. Click New message.
  3. In the top menu bar, click the Options tab.
  4. Click the Encrypt icon.
  5. A secondary menu or a "Change Permissions" link will appear. Select between Encrypt or Do Not Forward.
  6. If you need to remove the encryption before sending, simply click Remove encryption in the same menu.

Encrypting Emails on Outlook Mobile (iOS and Android)

The mobile app supports Microsoft Purview encryption, but the setting is tucked away in the composition menu.

  1. Open the Outlook app and tap the Compose (plus sign) button.
  2. Fill in the recipient and subject.
  3. Tap the three dots (...) or the lock icon in the corner of the compose window (the location varies slightly between iOS and Android updates).
  4. Select Direct permissions or Encrypt.
  5. Choose your desired protection level and send.

Advanced Configuration: Setting Up S/MIME

S/MIME is not a "click and go" feature. It requires a setup phase that involves managing digital keys.

Obtaining a Digital ID

You cannot create your own S/MIME certificate for public use; it must be issued by a CA. Most corporations handle this through an internal IT portal. If you are a freelancer or small business owner, you may need to purchase an S/MIME certificate from providers like DigiCert or Sectigo.

Importing the Certificate

Once you have the .pfx or .p12 file:

  1. In Windows, open the Certificate Manager (type certmgr.msc in the Start menu).
  2. Import the file into the Personal store.
  3. In Outlook Classic, go to File > Options > Trust Center > Trust Center Settings > Email Security.
  4. Under Digital IDs (Certificates), click Import/Export to link your certificate to your Outlook profile.

The Public Key Exchange

To send an encrypted S/MIME email, you must first have the recipient's Public Key. The easiest way to get this is to have them send you a digitally signed (but not necessarily encrypted) email first. Once you receive their signed email, right-click their name in the "From" field, select Add to Outlook Contacts, and the certificate will be saved to their contact card.

What is the Recipient’s Experience?

A common concern is whether the recipient can actually read the encrypted file. The experience differs based on their email client.

Recipient uses Outlook/Microsoft 365

If the recipient is also on a modern version of Outlook or Microsoft 365, the experience is seamless. The message decrypts automatically in their inbox. They will see a small lock icon indicating the message is protected.

Recipient uses Gmail, Yahoo, or Other Services

Users on other platforms will receive a notification email stating, "You've received a protected message."

  1. They must click a link to Read the message.
  2. They will be redirected to a secure Microsoft Purview portal.
  3. They can choose to Sign in with a Google/Yahoo account or request a One-time passcode.
  4. If they choose the passcode, it is sent to their email. They enter the 8-digit code into the portal to view the message and its attachments.

Managing Encrypted Attachments

When you encrypt an email using Microsoft Purview, the protection usually extends to the attachments.

  • Office Files (.docx, .xlsx, .pptx): These files inherit the "Do Not Forward" or "Encrypt" permissions. If a recipient downloads a "Do Not Forward" Word document and tries to email it to someone else, the second person will be unable to open it because the file checks for user authentication with Microsoft’s servers every time it is opened.
  • PDFs and Images: Modern Purview encryption supports PDF protection, but older versions or specific configurations might not. If you are sending a highly sensitive PDF, it is best to use the Do Not Forward setting and verify if the recipient can view it within the secure portal rather than downloading it.
  • Size Limits: Encrypted emails have slightly lower size limits due to the metadata overhead required for the encryption headers. It is generally recommended to keep encrypted attachments under 25MB.

Troubleshooting: Why Is the Encrypt Button Missing?

If you have followed the steps above and cannot find the options, consider these common fixes:

  • Check Your License: Log into your Microsoft 365 account online, go to "View Account," and check "Subscriptions." Ensure you have a version that includes "Azure Information Protection" or "Microsoft Purview."
  • Update Outlook: If you are using an old desktop build (like Outlook 2013), Purview encryption may not be supported. Update to the latest version of Microsoft 365.
  • Primary Account Conflict: If you have multiple accounts in Outlook (e.g., one Personal Gmail and one Work M365), ensure the "From" field is set to your Work account. The encryption options only appear when the sending account supports them.
  • IT Policy: Your organization might have disabled manual encryption in favor of "Sensitivity Labels." Look for a Sensitivity button in the ribbon instead of "Encrypt." Labels like "Confidential" or "Highly Confidential" often trigger encryption automatically.

How to Set Up an Encrypted Email Receipt

For high-stakes communication, knowing a message was received and opened is vital. In Classic Outlook, you can combine encryption with a digital signature to request an S/MIME receipt.

  1. Open a new message and go to Options.
  2. Click the small arrow in the More Options group.
  3. Select Security Settings.
  4. Check Add digital signature to this message AND Request S/MIME receipt for this message.
  5. When the recipient opens the mail, you will receive a verified notification in your inbox.

FAQ: Common Questions About Outlook Encryption

What is the difference between "Encrypt" and "Do Not Forward"?

"Encrypt" simply ensures the data is unreadable during transit. Once it arrives, the recipient can do anything with it. "Do Not Forward" is more restrictive; it prevents the recipient from adding new people to the "To" line, printing the email, or copying text from the body.

Does the one-time passcode expire?

Yes. For security reasons, the one-time passcode sent to Gmail or Yahoo users typically expires after 15 minutes. If the recipient doesn't enter it in time, they must request a new one from the secure portal.

Can I encrypt an email after it has been sent?

No. Encryption must be applied at the time of composition. If you accidentally sent sensitive information without encryption, you should attempt to use the "Recall Message" feature (though this only works within the same organization and is not 100% reliable) and then send a new, encrypted version.

Does Outlook encrypt my emails by default?

No, Outlook does not encrypt every email by default because it requires extra processing and can occasionally cause issues with certain automated mail filters. You must manually select the encryption option or have your IT admin set up "Transport Rules" that automatically encrypt emails containing specific keywords like "Social Security Number" or "Confidential."

Summary of Outlook Encryption Methods

Securing your digital communication is a multi-layered process. For the vast majority of users, the Microsoft Purview (Encrypt button) in the Options tab provides the perfect balance of security and ease of use, especially when communicating with people outside your organization. If you are in a high-security environment, S/MIME offers an extra layer of identity verification through digital signatures, though it requires more technical overhead.

By following the steps for your specific version of Outlook—whether New, Classic, or Web—you can ensure that your sensitive data remains confidential and reaches only the eyes it was intended for. Always verify your subscription level if the buttons are missing, and remember that "Do Not Forward" is your strongest ally when you need to maintain control over your documents even after they leave your outbox.