Email Encryption in Microsoft 365: A Practical Guide

Prerequisites

The email encryption features of Microsoft 365 are grouped under the “Microsoft Purview Message Encryption”. It combines email encryption and rights management capabilities.

The Microsoft Purview Message Encryption is offered as part of Office 365 Enterprise E3 and E5, Microsoft 365 Enterprise E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3, and A5, and Office 365 Government G3 and G5. You don’t need additional licenses to receive the new protection capabilities powered by Azure Information Protection.

You can also add Azure Information Protection Plan 1 to the following plans to receive Microsoft Purview Message Encryption: Exchange Online Plan 1, Exchange Online Plan 2, Office 365 F3, Microsoft 365 Business Basic, Microsoft 365 Business Standard, or Office 365 Enterprise E1.

Also, you should note that Microsoft has rebranded email encryption recently, which may lead to confusion regarding its terminology, deployment, and use.

Activating Microsoft Purview Message Encryption

Microsoft Purview Message Encryption leverages the protection features in Azure Rights Management Services (Azure RMS), the technology used by Azure Information Protection to protect emails and documents through encryption and access controls.

The only prerequisite for using Microsoft Purview Message Encryption is that Azure Rights Management must be activated in your organization’s tenant.

Normally, Azure Rights Management is active by default, but depending on the timeline, it might not be. If it is not active, you may need to contact your system administrator. It is a non-trivial task that should be entrusted to only a seasoned system administrator.

Setting things up might be a bit difficult, but using it is the easy part!

But Aren’t All Emails Encrypted by Default?

Yes and no. Most email communications happen using STARTTLS. It prevents any third-party from snooping into the communication, but it does not prevnt mail servers themesleves from reading the contents of the email.

The STARTTLS provides transport layer security. As you can see in the diagram below, it encrypts email messages as they travel across the Internet between various servers and clients.

STARTTLS protects the communication from eavesdroppers, but it does not prevent mail servers from reading the contents of the email.

What Happens When You Encrypt Email in Office 365

When you encrypt an email with Microsoft Purview Message Encryption, you are effectively doing end-to-end encryption. It means that the data is encrypted and decrypted only at the end points.

As you can see in the diagram, the Office Message Encryption service will encrypt the email at the time of sending, and it will decrypt the email at the receiver’s end.

In simple words:

1. Email is encrypted at source. 
2. Email will remain unreadable to mail servers during its transit.
3. Email will be decrypted at the recipient’s endpoint.

Sending Encrypted Email from Outlook

If everything is set up properly, you can easily send encrypted email to anyone:

1. Compose a new email as usual.
2. Draft the message.
3. From “Options”, select “Encrypt Only” from the list of available templates (see the screenshot for reference if required).
4. Send.

What Happens at the Receiver’s End

For Microsoft 365 Users

If your recipient is also a Microsoft 365 user, the entire process works seamlessly.

As you can see in the screenshot, there is nothing to do. The receiver will be able to open and read your message as long as he/she is signed into the Microsoft 365 service.

For Users of Other Services (Non-Microsoft 365)

Recipients of encrypted messages who receive encrypted or rights-protected mail sent to their Gmail, Yahoo, or other accounts receive a wrapper mail that directs them to the Office Message Encryption (OME) Portal.

In the following example, we have sent an encrypted email to a Gmail user.

As you can see, the message has been received as an attachment in a wrapper email. When you click on the “Read the message” button, it will take you to the Office Message Encryption Portal, as you can see in the screenshot:

The users of Gmail and Yahoo can sign in with their accounts to view the message. Alternatively, they can sign in with a one-time passcode. Also, this one-time passcode method is universally available to users of other email services as well.

In this instance, we are using a one-time passcode method:

Once you enter the OTP, you can see the encrypted message:

To summarize, if the user is not using Microsoft 365:

• If he uses Gmail (personal or business) or Yahoo, he can read the email by signing into the Office Message Encryption Portal with his Google or Yahoo account.
• Any recipient, including Gmail and Yahoo users, can also read the encrypted message by signing into the Office Message Encryption Portal with a one-time passcode.

Encrypted Email with Attachments

The Microsoft Purview Message Encryption automatically extends to the email attachments. However, it will encrypt only supported file formats. All unsupported file formats will remain unencrypted.

All modern Microsoft Office document formats such as DOCX, XLSX, PPTX, etc. are supported. Adobe PDF format is also supported.

Other attachment types including the older versions of MS Office files such as DOC and XLS are unsupported. These attachments will not be encrypted. Please refer to the official documentation for a comprehensive list of supported formats.

Once an email attachment is encrypted, only the intended recipient can open it. He can do so either by signing into the Microsoft 365 services or by signing into the Message Encryption portal.

Let us consider this scenario:

1. Alex (alex@example.com) sends an encrypted email to Charlie (charlie@contoso.com) with a Word file attached to it.
2. If Charlie is a Microsoft 365 user, he can seamlessly open the email, and he will also be able to open the Word file in a browser, or a desktop application.
   • If Charlie uses any non-Microsoft email service, he can still view the email and the document using the OME portal.
3. If Charlie forwards the attachment to Quinn via email or shares the attachment with Quinn using any other means (e.g., using a pen drive), Quinn still won’t be able to open it.

Additional Encryption Templates

Microsoft Purview Message Encryption comes with a few built-in templates that we can use out-of-box.

Do Not Forward: It prevents the recipients from forwarding or printing the email. It does so by disabling the “Forward” option in the mail client.

Confidential and Highly Confidential: These templates add further restrictions such as preventing external users from being able to view the contents of the email.

Automatic Message Encryption via Mail Flow Rules

You can configure Microsoft Exchange Mail Flow Rules in the EAC (Exchange Admin Console) to automatically encrypt emails based on the words in the subject, recipient address, sender address, and other sensitivity labels.

For example, we can set up a rule such that if someone mentions “Confidential” in the subject of the email, Microsoft Exchange will automatically encrypt it.

S/MIME vs. Microsoft Purview Message Encryption

S/MIME (Secure/Multipurpose Internet Mail Extensions) is an alternative method for email encryption. It is based on Public Key Infrastructure, i.e., it uses digital certificates to sign and encrypt emails.

Microsoft Purview Message Encryption is easy to set up. It works transparently across domains. But it only protects a limited number of attachment formats. If you want an email encryption system that protects all types of attachments, you must use S/MIME.

S/MIME requires more work to set up and use, but it can encrypt all types of attachments. However, it is more suitable for a small number of organizations that work closely with each other, e.g., government departments.

Useful Links

• Microsoft Purview Message Encryption FAQ
• Setting Up Message Encryption Capabilities
• Wikipedia: Email Encryption

Related

• Password Protection in Microsoft Office 365
• Promo: Get a Free Network Firewall