How do you encrypt email in Microsoft 365 with Purview Message Encryption?

Microsoft 365 can encrypt an individual email so only the people you sent it to can read it, even if they use Gmail or Yahoo. The feature is called Microsoft Purview Message Encryption, and most Business Premium and Enterprise tenants already have it switched on without realizing. This guide covers how users send encrypted mail, how admins encrypt it automatically, and what recipients see, at the time of writing (November 2026).

If you're still deciding what kind of encryption you need, start with our overview of email encryption types for business.

What is Microsoft Purview Message Encryption?

Microsoft Purview Message Encryption is a Microsoft 365 service that encrypts individual email messages and their attachments for recipients inside or outside your organization. It's built on the Azure Rights Management service, and Microsoft says it "works with Outlook.com, Yahoo!, Gmail, and other email services" (Microsoft Learn).

You may see older names. Office 365 Message Encryption (OME) was deprecated on July 1, 2023 and is being replaced automatically with Purview Message Encryption (Microsoft Learn). The Exchange admin center still labels the rule action "Apply Office 365 Message Encryption and rights protection."

It's different from the two other kinds of encryption your mail already gets:

TLS alone leaves the message readable on each server it passes through. Message encryption keeps it encrypted in the recipient's mailbox too. For the transport side, see STARTTLS email encryption in transit.

Which Microsoft 365 plans include message encryption?

According to Microsoft's FAQ, Purview Message Encryption is included in:

• Office 365 Enterprise E3 and E5, and Microsoft 365 Enterprise E3 and E5
• Microsoft 365 Business Premium
• Office 365 A1, A3 and A5
• Office 365 Government G3 and G5

Exchange Online Plan 1 and Plan 2, Office 365 F3, Microsoft 365 Business Basic, Microsoft 365 Business Standard and Office 365 Enterprise E1 can get it by adding Azure Information Protection Plan 1. Microsoft adds that "each user benefiting from Microsoft Purview Message Encryption needs a license."

Advanced Message Encryption, which adds message expiry, revocation and multiple branding templates, is a separate tier. The Microsoft Purview service description lists it in Microsoft 365 E5, A5 and G5, Office 365 E5, A5 and G5, the Microsoft Purview Suite plans, and the Microsoft 365 E5/A5/F5/G5 Information Protection and Governance add-ons. Business Premium and E3 don't include it on their own. Check the service description for your exact plan before you promise it to anyone.

Is message encryption already turned on?

Probably. Microsoft says the only prerequisite is that the Azure Rights Management service is active, and "if it is, Microsoft 365 activates message encryption automatically and you don't need to do anything." Rights Management is "activated automatically for most eligible plans" (Microsoft Learn).

To confirm it in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-IRMConfiguration | Format-List AzureRMSLicensingEnabled
Test-IRMConfiguration -Sender admin@contoso.com -Recipient admin@contoso.com

AzureRMSLicensingEnabled should be True, and Test-IRMConfiguration should end with OVERALL RESULT: PASS. If the first value is False, Microsoft says to set it with Set-IRMConfiguration -AzureRMSLicensingEnabled $true. Tenants still using on-premises Active Directory Rights Management Services (AD RMS) must migrate to Azure Rights Management first, because Purview Message Encryption isn't compatible with AD RMS.

How do users send an encrypted email in Outlook?

In both new Outlook for Windows and classic Outlook, Microsoft's steps are the same (Microsoft Support):

1. Start a new message.
2. Select Options > Encrypt.
3. Choose Encrypt or Do Not Forward.
4. Write the message and select Send.

Outlook on the web also offers the Encrypt option when you compose a message (Microsoft Learn). For new Outlook, Microsoft's support page says Purview Message Encryption works "as long as your email server has an Office 365 Enterprise E3 license," and points other users to S/MIME. If the button is missing, check the user's license first.

Encrypt vs Do Not Forward: what's the difference?

Both options encrypt the message and make recipients authenticate. The difference is what recipients can do afterwards. This table summarizes Microsoft's usage rights documentation:

Use Encrypt for most confidential mail to customers, such as statements or contracts, where the recipient may need to forward it to their accountant or lawyer. Use Do Not Forward when only the people you chose should ever see it. Restrictions only work in clients that honor them: a determined recipient can still photograph the screen.

How do you encrypt email automatically with a mail flow rule?

Admins can make encryption automatic, so users don't have to remember. Microsoft's example is a rule that encrypts "all messages that contain specified keywords and are addressed to external recipients" (Microsoft Learn). The steps are in Define mail flow rules to encrypt email messages. A common pattern is to encrypt any external message whose subject contains a tag such as [secure]. To find sensitive content such as card numbers without relying on keywords, a Purview DLP policy can apply encryption or block the message instead.

In the Exchange admin center:

1. Go to Mail flow > Rules and select New > Create a new rule.
2. Name it, for example Encrypt external mail tagged [secure].
3. Under Apply this rule if, add The sender is located > Inside the organization.
4. Add a second condition: The recipient is external/internal > Outside the organization.
5. Add a third condition that the subject includes the word [secure].
6. Under Do the following, select Modify the message security > Apply Office 365 Message Encryption and rights protection, then choose Encrypt or Do Not Forward.
7. Save the rule, then test it with a message to a personal Gmail address.

The equivalent in Exchange Online PowerShell:

New-TransportRule -Name "Encrypt external mail tagged [secure]" -FromScope InOrganization -SentToScope NotInOrganization -SubjectContainsWords "[secure]" -ApplyRightsProtectionTemplate "Encrypt"

Three rule details catch people out. You can't encrypt inbound mail from outside senders: Microsoft says such a rule delivers the mail "without encryption." Meeting invites can't be encrypted with mail flow rules; Microsoft says to use sensitivity labels instead. And if you have older rules that use "Apply the previous version of OME," update them, or recipients keep getting the old HTML attachment format. For general rule design, see Microsoft 365 mail flow rules for security.

What does the recipient see?

It depends on who they are:

• Microsoft 365 users in any organization using Outlook for Windows, Mac, web, iOS or Android read the message normally. Microsoft calls this a "native, first-class reading experience."
• Gmail, Yahoo and other recipients get a wrapper email with a Read the message link. They sign in with Google, Yahoo or a Microsoft account, or choose Sign in with a one-time passcode. Microsoft says "each passcode expires after 15 minutes" (Microsoft Support).

Replies from the portal are encrypted as well. If recipients say the passcode never arrives, Microsoft suggests they check their junk folder and their organization's quarantine, because the first passcode emails an organization receives often end up there. A correct SPF, DKIM and DMARC setup on your domain helps.

Tell external contacts to expect these wrapper emails. Phishing often copies "you have a secure message" notifications, so a customer who has never seen yours may delete the real thing, or click a fake one. Our guide to file-sharing notification phishing covers the look-alikes.

How do you revoke or expire an encrypted email?

Revocation and expiry need Advanced Message Encryption, and they only work for external recipients who read the message in the portal. Microsoft says: "You can only revoke and set an expiration date for emails sent to external recipients." To make sure recipients use the portal, apply a custom branding template in the mail flow rule.

To expire messages, create a branding template with an expiry, then use it in a rule:

New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7
New-TransportRule -Name "Encrypt and expire external" -FromScope InOrganization -SentToScope NotInOrganization -ApplyRightsProtectionTemplate "Encrypt" -ApplyRightsProtectionCustomizationTemplate "Expire in 7 days"

ExternalMailExpiryInDays accepts "any value between 1–730 days" (Microsoft Learn). Recipients see the expiry date in the wrapper email.

To revoke a message, the sender opens it in the Sent folder in Outlook on the web and selects Remove external access; this works for a message sent to a single recipient who got the link-based portal experience. Admins find the Message ID in message trace, then run:

Get-OMEMessageStatus -MessageId "<message id>" | Format-Table -AutoSize Subject,IsRevocable
Set-OMEMessageRevocation -Revoke $true -MessageId "<message id>"

The recipient then sees "The message has been revoked by the sender" in the portal (Microsoft Learn). Messages read inline by Microsoft 365 or Outlook.com recipients can't be revoked.

What are the limits of Purview Message Encryption?

From Microsoft's Message Encryption FAQ:

Does message encryption stop phishing or spoofing?

No. Encryption protects mail you send. It doesn't check mail you receive, and it doesn't stop someone sending fake mail in your name. For that you need inbound filtering and an enforced DMARC policy; our guide to stopping email spoofing of your domain covers the second part, and the free DMARC Checker shows where your domain stands.

Next steps

• Run Get-IRMConfiguration and Test-IRMConfiguration to confirm encryption works in your tenant.
• Decide your default: Encrypt for most confidential mail, Do Not Forward for the few cases that need it.
• Add one mail flow rule for tagged external mail, and test it with a Gmail address.
• Warn customers and suppliers what your encrypted message notifications look like.
• Encryption handles outgoing mail; for the phishing coming in, see how iBlockSpam filters inbound mail for Microsoft 365.

Browse our other email setup guides.