Outlook can encrypt your emails so only the intended recipient can read the contents, and it does this through a couple of different built-in tools rather than one single button that works for every account. Which method you use depends on whether you have a Microsoft 365 work or school account with message encryption turned on, or a personal account where you’d need something like an S/MIME certificate instead.
This guide walks through the fastest way to encrypt a message, then covers each Outlook version separately so you can find the steps that match your setup.
Quick steps
- Open a new message in Outlook and go to the Options tab (classic Outlook) or use the Sensitivity or Encrypt control in the message ribbon (new Outlook and Outlook on the web).
- Select Encrypt, or choose a sensitivity label that applies encryption if your organization has one set up.
- Finish writing your message and send it as normal. The recipient will see a notice that the message is protected.
Before you start
A few things to check before you try to encrypt an email in Outlook:
- Account type matters. Built-in message encryption (Microsoft Purview Message Encryption, sometimes just called OME) is a Microsoft 365 feature that your IT admin has to turn on for your organization. If you’re using a personal Outlook.com or Gmail account added to Outlook, this option usually won’t be available.
- Your Microsoft 365 plan matters too. Whether encryption and sensitivity labels are available to you depends on the subscription your organization has and how the admin has configured it.
- S/MIME is a separate, older method. It relies on digital certificates rather than your Microsoft 365 subscription, and both you and the recipient need certificates set up for it to work properly.
- External recipients can still read encrypted mail. With Purview Message Encryption, people outside your organization (including Gmail or Yahoo users) can open protected messages, usually by signing in or getting a one-time passcode.
Encrypt email in classic Outlook for Windows
This is the traditional desktop Outlook app that’s been around for years, included with Microsoft 365 apps.
- Click New Email to start a message.
- Go to the Options tab on the ribbon.
- Look for an Encrypt button. If your organization has message encryption enabled, you’ll see choices such as encrypting the message or restricting it so it can’t be forwarded, printed, or copied.
- Choose the option that fits what you need, then write and send your email as usual.
If your organization uses sensitivity labels instead, you may see a Sensitivity button on the ribbon rather than a plain Encrypt button. Selecting a label that has encryption built in does the same job, protecting the message and any attachments.
Encrypt email in new Outlook for Windows
The new Outlook for Windows has a similar layout but a slightly different ribbon.
- Select New mail to open a compose window.
- Check the ribbon at the top of the message for a Sensitivity or Encrypt option.
- Pick the encryption setting or sensitivity label that applies to this message.
- Complete your email and send it.
Since new Outlook is still rolling out changes, the exact wording of these buttons can shift a bit between updates. If you don’t see either option, it’s most likely because message encryption hasn’t been enabled for your account by your admin.
Encrypt email in Outlook on the web
If you access your work or school email through a browser at outlook.com or your organization’s portal, encryption is available in a similar way.
- Select New message.
- Look for the Encrypt icon, or open the message options to find sensitivity labels if your organization uses them.
- Choose the protection level you want to apply.
- Write your message and select Send.
As with the desktop apps, this option only shows up when your Microsoft 365 tenant has message encryption or sensitivity labels configured for your account.
Encrypt email using S/MIME
S/MIME (Secure/Multipurpose Internet Mail Extensions) is a certificate-based way to encrypt and digitally sign messages, separate from Microsoft Purview Message Encryption. It’s more common in organizations that already manage their own digital certificates.
- Get a digital certificate installed for your account, usually through your IT department or a certificate authority.
- In Outlook, check your email security settings (found under account or trust center settings in classic Outlook) to confirm your certificate is set up for encrypting messages.
- When composing a message, choose the option to encrypt the message contents before sending.
- Send the message. The recipient needs your public key (often exchanged by first sending them a signed message) and their own certificate to open it properly.
S/MIME can be more fiddly to set up than Purview Message Encryption because both sides need matching certificates in place, but some organizations prefer it for compliance reasons.
If it doesn’t work
You don’t see an Encrypt or Sensitivity button at all
This almost always means message encryption hasn’t been turned on for your Microsoft 365 account, or you’re using a personal account that doesn’t support it. Ask your admin to confirm whether encryption or sensitivity labels are enabled for your mailbox.
The recipient says they can’t open the encrypted message
With Purview Message Encryption, recipients outside your organization typically need to sign in with a Microsoft account, Google account, or a one-time passcode to view the message in a browser. If they’re stuck, point them to the instructions included in the encrypted email itself, since the exact sign-in method depends on their email provider.
S/MIME encryption option is greyed out or missing
This usually means no certificate is installed, or the certificate isn’t set up correctly for encryption in Outlook’s security settings. Check with whoever manages certificates in your organization, since this isn’t something Outlook can generate on its own.
Encrypted emails aren’t working with connected apps or automated flows
If you’re using Outlook through automated connectors or workflows, be aware that encrypted messages aren’t always fully supported by every integration, so some automated processes may skip or fail on encrypted mail.
Frequently asked questions
Can I encrypt email in a personal Outlook.com account?
Built-in message encryption through Microsoft Purview is designed for Microsoft 365 work and school accounts, not personal Outlook.com accounts. If you need to encrypt email from a personal account, S/MIME with your own certificate is generally the more realistic option.
What’s the difference between the Encrypt button and S/MIME in Outlook?
The Encrypt button (Purview Message Encryption) is a cloud-based feature tied to your Microsoft 365 subscription and works even if the recipient has never used Outlook. S/MIME relies on digital certificates installed on both the sender’s and recipient’s side, and it works independently of any Microsoft 365 subscription.
Do I need special permission to encrypt an email in Outlook?
Yes, in most work or school accounts, an admin has to enable message encryption or sensitivity labels before the option appears in your Outlook ribbon. You can’t usually turn this on yourself from a personal user account.
Does encrypting a message also protect the attachments?
Yes, when you encrypt a message through Purview Message Encryption or a sensitivity label with encryption applied, the attachments are protected along with the email body.
Can someone forward my encrypted email to someone else?
It depends on the protection you chose. Some encryption options, like ones that mark a message as “Do Not Forward,” specifically block forwarding, printing, and copying, while a basic encrypt option may still allow forwarding.
Related guides
- How to Send Email Using Outlook 2019?
- How to Recall an Email in Outlook (Step-by-Step)
- Add an email account to Outlook
- How to Fix Outlook Not Working on Windows 11
Leave a Reply