When you need to protect the privacy of an email message, encrypt it. Encrypting an email message in Outlook means it's converted from readable plain text into scrambled cipher text. Only the recipient who has the private key that matches the public key used to encrypt the message can decipher the message for reading. Any recipient without the corresponding private key, however, sees indecipherable text.
There are two types of encryption options: S/MIME and Microsoft 365 Message Encryption (Information Rights Management).
When you have a Microsoft 365 qualifying subscription, Outlook supports Microsoft 365 Message Encryption (Information Rights Management). To use Microsoft 365 Message Encryption, you must have Microsoft 365 Message Encryption, which is included in the Office 365 Enterprise E3 license.
You can also use S/MIME encryption (Secure/Multipurpose internet Mail Extensions), a widely accepted protocol for sending digitally signed and encrypted messages. To use S/MIME encryption, you and the recipient must have a mail application, such as Outlook, that supports the S/MIME standard.
S/MIME in Exchange Online provides the following services for email messages:
-
Encryption: Protects the content of email messages.
-
Digital signatures: Verifies the identity of the sender of an email message.
To send a message with encryption, choose instructions based on the version of Outlook you're using. What version of Outlook do I have?
In new Outlook you can:
Encrypt a single message using S/MIME | Encrypt all messages using S/MIME | Encrypt a message with Microsoft 365 Message Encryption
Encrypt a single message using S/MIME in new Outlook
Before you start this procedure and encrypt emails, you must first Get a digital ID, otherwise known as a digital certificate, and add it to the keychain on your computer.
Note: New Outlook doesn't automatically import digital certificates. You must install the certificate manually or ask your administrator to configure policies to automatically install certificates.
-
In an email message, from the ribbon, select Options > More Options.
-
In Message options, you can choose the Sensitivity level as well as the read or delivery receipt and S/MIME protection options.
-
Select OK.
-
If you encrypt an outgoing message and new Outlook can’t verify that all recipients can decrypt the message, you’ll see a warning highlighting those recipients who might not be able to read the encrypted message. You can send the message anyway, remove those recipients, or retry to check again.
-
Finish composing your email and then select Send.
Need help viewing an encrypted message? See View and reply to encrypted messages in Outlook.
Encrypt all messages using S/MIME in new Outlook
-
Select Settings > Mail > S/MIME
-
Choose from: Encrypt contents and attachment for all messages I send: Automatically encrypts all outgoing messages.Add a digital signature to all messages I send : Digitally signs all outgoing messages. Automatically choose the best certificate for digital signing: Allows Outlook to select base certificate. If not checked, user will be prompted to select the right certificates.
-
Select OK.
Encrypt a message with Microsoft 365 Message Encryption in new Outlook
Note: Microsoft 365 Message Encryption (IRM) protection should not be applied to a message that is already signed or encrypted using S/MIME. To apply IRM protection, S/MIME signature and encryption must be removed from the message. The same applies for IRM-protected messages; you should not sign or encrypt them using S/MIME.
New Outlook supports Microsoft 365 Message Encryption as long as your email server has an Office 365 Enterprise E3 license. If not, you can encrypt messages using S/MIME.
-
In an email message, choose Options, and then select Encrypt.
-
Pick the encryption that has the restrictions you want to enforce, such as Encrypt-Only or Do Not Forward.
-
Finish composing your email and then choose Send.
In classic Outlook you can:
Add a certificate to encrypt with S/MIME | Configure your S/MIME certificate | Encrypt a single message using S/MIME | Encrypt all messages using S/MIME
Add a certificate to encrypt with S/MIME in classic Outlook
Before you start this procedure and encrypt emails, you must first Get a digital ID, otherwise known as a digital certificate, and add it to the keychain on your computer.
Configure your S/MIME certificate in classic Outlook
Once you have your S/MIME certificate set up on your computer, you can configure it in Outlook:
-
In Outlook, select File > Options > Trust Center > Trust Center Settings.
-
In the left pane, select Email Security.
-
Under Encrypted email, choose Settings.
-
Under Certificates and Algorithms, select Choose and then select the S/MIME certificate.
-
Select OK.
Encrypt a single message using S/MIME in classic Outlook
-
In an email message, select Options > Encrypt.
-
Choose the encryption option that has the restrictions you'd like to enforce, such as Do Not Forward.
-
Finish composing your email and then select Send.
Encrypt all outgoing messages using S/MIME in classic Outlook
When you choose to encrypt all outgoing messages by default, you can write and send messages the same as with any other messages, but all potential recipients must have your digital ID to decode or view your messages.
-
In Outlook, choose File > Options > Trust Center > Trust Center Settings.
-
On the Email Security tab, under Encrypted email, select the Encrypt contents and attachments for outgoing messages check box.
-
To change additional settings, such as choosing a specific certificate to use, select Settings.
-
Once you're done selecting your settings, select OK to save your changes.
Note: Microsoft 365 Message Encryption (IRM) protection should not be applied to a message that is already signed or encrypted using S/MIME. To apply IRM protection, S/MIME signature and encryption must be removed from the message. The same applies for IRM-protected messages; you should not sign or encrypt them using S/MIME.
See also
View and reply to encrypted messages in Outlook
Secure messages by using a digital signature
Find digital ID or digital ID services
Send a digitally signed or encrypted message for Mac
Advanced Outlook.com security for Microsoft 365 subscribers
