How to Send an Encrypted Email in Outlook: New Outlook Steps and Admin Checks

The short version: In the new Outlook, open a message, select Options > Encrypt, then choose Encrypt or Do Not Forward before you send. Both choices use Microsoft Purview Message Encryption. Encrypt protects the content but still lets recipients forward, copy and print. Do Not Forward also blocks those actions. An admin can confirm the feature is switched on with one Exchange Online PowerShell check.

This guide is for staff who need to send a confidential email from Outlook, and for the IT admin who has to make sure it works. After reading it you can send an encrypted message, check that your tenant is ready, and tell an external recipient exactly how to open it. Microsoft documents click-by-click steps only for the new Outlook, so that is where the steps are exact; for other Outlook clients we state only what Microsoft documents. Facts in this guide were checked against Microsoft Learn and Microsoft Support on 28 October 2026.

Pick the right kind of encryption first

Outlook offers two different mechanisms, and they should not be mixed on one message.

• Microsoft Purview Message Encryption: works with recipients inside and outside your organisation, including Gmail, Yahoo and Outlook.com. No certificate exchange is needed. This is what this guide covers.
• S/MIME: needs a certificate on both sides. Microsoft states that Purview Message Encryption should not be applied to a message that is already signed or encrypted with S/MIME.

For most small and mid-sized organisations, Purview Message Encryption is the practical choice.

Encrypt vs Do Not Forward

Microsoft Learn describes the two options this way:

• Encrypt (also called encrypt-only): the message is encrypted and recipients must authenticate. They keep every usage right except Save As/Export and Full Control. In practice they can copy from the email, print it and forward it. They cannot remove the encryption.
• Do Not Forward: the message is encrypted and recipients must authenticate. They cannot forward it, print it or copy from it. The Forward button is not available and the To, Cc and Bcc lines cannot be changed. Office documents attached to it inherit the same limits.

Use Encrypt when you only need the content protected in transit and at rest. Use Do Not Forward when only the people you addressed should ever see it.

Steps for users

New Outlook for Windows

1. Start a new message and write it as normal.
2. Select Options > Encrypt.
3. Choose Encrypt or Do Not Forward.
4. Select Send.

Other Outlook clients

Microsoft's support page gives exact steps only for the new Outlook. Microsoft Learn confirms that the Encrypt option exists in classic Outlook for Windows and Mac and in Outlook on the web, and that creating encrypt-only mail needs Outlook for PC 2019 or the Microsoft 365 apps. Microsoft does not publish a button path for these clients on the pages we checked, so open the message's options and follow the on-screen labels Encrypt and Do Not Forward. If many of your users are on classic Outlook, test on one machine first and write your own one-page instruction.

If you do not see Encrypt, the user may not have a licence that includes it, or Azure Rights Management may not be active in the tenant. See the admin section below.

Two limits to remember

• The maximum message size with attachments is 25 MB. Cloud attachments from SharePoint or OneDrive are not protected.
• PDF attachments are only encrypted if an admin turns that on (see the admin section).

Steps for admins: confirm the feature is on

Purview Message Encryption needs the Azure Rights Management service to be active in your tenant. Microsoft activates it automatically for most eligible plans.

Licences that include it (per the Microsoft Purview Message Encryption FAQ): Office 365 E3 and E5, Microsoft 365 E3 and E5, Microsoft 365 Business Premium, and the A1, A3 and A5 education plans. Exchange Plan 1, Exchange Plan 2, Office 365 F3, Microsoft 365 Business Basic, Business Standard and Office 365 E1 can receive it by adding Azure Information Protection Plan 1. Every user who benefits needs a licence.

Connect to Exchange Online PowerShell with an account such as Compliance Administrator and run:

Connect-ExchangeOnline
Get-IRMConfiguration | Format-List AzureRMSLicensingEnabled
Test-IRMConfiguration -Sender user@yourdomain.com -Recipient user@yourdomain.com

AzureRMSLicensingEnabled should be True. If it is False, set it with Set-IRMConfiguration -AzureRMSLicensingEnabled $true. Test-IRMConfiguration should end with OVERALL RESULT: PASS. Use real mailbox addresses from your tenant.

To encrypt PDF attachments automatically, a user holding the Information Rights Management role can run:

Set-IRMConfiguration -EnablePdfEncryption $true

Optional: encrypt automatically with a mail flow rule

Do not rely on people remembering. Test a rule on one recipient before you turn it on for everyone. In the Exchange admin center go to Mail flow > Rules > New > Create a new rule. Add a condition (for example, the recipient is outside the organisation, or the subject contains a keyword). Under Do the following, choose Modify the message security > Apply Office 365 Message Encryption and rights protection, pick an RMS template, then Save. Mail flow rules cannot encrypt inbound mail that arrives from outside your Exchange Online organisation.

How recipients open the message

• Recipients on Microsoft 365 using Outlook (Windows, Mac, web, iOS, Android): the message opens normally. A banner shows any restrictions such as Do Not Forward.
• Gmail: select Read your message, then Sign in with Google, then Allow. The message opens in a new browser tab.
• Yahoo and other providers: select Read the message, request a one-time passcode, enter the code from the email you receive, then select Continue. The passcode expires after 15 minutes. If it expires, open the original message again.

Send these three lines to external recipients before the first encrypted message, so nobody mistakes the notice for phishing.

Common mistakes

1. Choosing Encrypt and expecting forwarding to stop. Encrypt allows forward, copy and print. Use Do Not Forward.
2. Layering Purview encryption on an S/MIME message. Pick one mechanism per message.
3. Leaving it to individual users. Add a mail flow rule for the cases that must always be encrypted, such as messages to specific partners or with specific keywords.
4. Forgetting the one-time passcode email lands in junk or quarantine. Microsoft's FAQ says to check the junk folder first, then quarantine in the Microsoft Purview portal. Messages with passcodes, especially the first ones, often end up quarantined.
5. Putting recipients on Bcc in hybrid setups. Microsoft notes Bcc recipients can be removed before encryption when connectors are configured. Use To or Cc.
6. Trying to encrypt a calendar invite with a mail flow rule. Meeting invites need sensitivity labels instead.

How to check it worked

1. Send a test message with Do Not Forward from your own mailbox to a second mailbox at another provider, such as a Gmail address you control.
2. Confirm the recipient sees a prompt to read the message securely rather than the plain content.
3. In a Microsoft 365 mailbox, confirm the message shows a restriction banner and that Forward is unavailable.
4. As admin, confirm Test-IRMConfiguration returns OVERALL RESULT: PASS.

FAQ

Can I send an encrypted email in Outlook?

Yes. With a licence that includes Microsoft Purview Message Encryption, select Options > Encrypt in the new Outlook and choose Encrypt or Do Not Forward before sending.

How do I unencrypt an Outlook email?

Recipients cannot remove the encryption on a message they received. An admin can create a mail flow rule that removes encryption applied by your organisation from outgoing messages or from replies to them. In the Exchange admin center, choose Modify the message security > Remove Office 365 Message Encryption and rights protection applied by the organization.

Can I encrypt an email already sent in Outlook?

We did not find a documented way in Microsoft Learn to add encryption to a message after it has been sent. Send a new message with encryption turned on. Revocation is a separate and limited feature tied to Advanced Message Encryption. A sender can revoke only a message sent to a single recipient who uses a social account such as gmail.com or yahoo.com, from the Sent folder in Outlook on the web using Remove external access. Microsoft says you cannot revoke mail sent to Microsoft 365 work or school accounts or to outlook.com accounts, and that a custom branding template is needed to guarantee tracking and revoking.

How do I open an encrypted Outlook email?

In Outlook with a Microsoft 365 account it opens normally. For Gmail, choose Read your message and sign in with Google. For other providers, choose Read the message and use the one-time passcode, which expires after 15 minutes.

Does the Outlook app on a phone open encrypted email?

Outlook for iOS and Outlook for Android are listed by Microsoft among the clients that read encrypted and rights-protected mail natively.

Related reading: the Microsoft 365 security checklist, data encryption at rest and in transit and how to enable MFA in Microsoft 365.

If you want someone to review how your Microsoft 365 email protection is actually set up, talk to our managed IT security services team.