Your office needs to send a change order from the company’s Outlook, and it shouldn’t go out as an ordinary email. This guide covers exactly that: protecting one Outlook message sent from a work account, what to check before you click anything, and where to stop.
It doesn’t cover setting up the mailbox itself (that’s in our guide on how to create a business email). If your company runs on Google instead, see how to send a secure email in Gmail.
Confirm it’s a work account before you touch a button
Encryption in Outlook depends on the kind of account you’re signed in with. Microsoft has a separate page on encrypting email with Microsoft 365 Personal or Family. If that’s the page you land on, stop. Its clicks and attachment rules aren’t the ones for a work account. Microsoft’s overview of securing email in Outlook also notes that a personal Microsoft account can’t sign messages or use IRM (Information Rights Management, which restricts what a recipient can do with a message).
Which licenses include encryption
Outlook’s Encrypt option uses Microsoft Purview Message Encryption. According to Microsoft’s message encryption FAQ, it’s included with:
- Office 365 Enterprise E3 and E5, and Microsoft 365 Enterprise E3 and E5
- Microsoft 365 Business Premium
- Office 365 A1, A3 and A5
- Office 365 Government G3 and G5
It can also be added to Exchange Plan 1, Exchange Plan 2, Office 365 F3, Microsoft 365 Business Basic, Microsoft 365 Business Standard or Office 365 Enterprise E1 with Azure Information Protection Plan 1. Each user who benefits needs a license. Those are simply the plans the FAQ names. Your admin is the one who can confirm which license, if any, your mailbox has.
Microsoft’s help page for encrypting in new Outlook is narrower: it says the option needs an Office 365 Enterprise E3 license on the email server. Because the two pages don’t agree, don’t assume your plan shows Encrypt, either way. Look for it, then ask your admin.
Azure Rights Management, the Microsoft service the encryption is built on, also has to be turned on for your company. That’s admin work. Whoever is sending the email doesn’t turn it on or change company-wide settings.
Three checks before the change order goes out
Say a made-up company at example.com is sending a change order from bids@example.com. Work through these in order. The harmless test at the end is our recommendation, not a Microsoft requirement.
Before you send
Check 1
Are you signed in with a work or school account?
If notIf it’s a personal Outlook.com account, stop. The Personal and Family steps are different and aren’t covered here.Check 2
Does Encrypt show on the message in new Outlook?
If notStop. Ask your admin whether the company has Purview Message Encryption and whether your license is on Microsoft’s list. Don’t type SECURE in the subject.Check 3
Did a harmless test, sent the same way, open on the recipient’s end?
If notDon’t send the change order. Ask your admin.
If every check passes: Send the change order with Encrypt or Do Not Forward, depending on whether the recipient needs to forward it.
Encrypting the connection isn’t protecting the message
As Microsoft’s article on how Exchange Online uses TLS explains, TLS (Transport Layer Security) encrypts the connection, not the message itself. Microsoft’s email encryption overview says the same about the session between mail servers.
That has limits. If the message is forwarded to a server that doesn’t use TLS, it isn’t necessarily still protected. With opportunistic TLS (used only when the other side supports it), mail can go out with no encryption at all if the other server doesn’t support TLS. Forcing TLS on a connection is something an admin sets up.
Protecting the message itself means Purview Message Encryption or S/MIME. Ordinary TLS alone doesn’t protect the change order.
A signature isn’t the encryption step
Purview Message Encryption and S/MIME are two different things. S/MIME (Secure/Multipurpose Internet Mail Extensions) works with certificates: the sender needs the recipient’s public key, and the recipient unlocks the message with their own certificate. Purview is the Microsoft 365 service built on Azure Rights Management. Microsoft’s encryption overview and its new Outlook help page both describe the split.
S/MIME also does two separate jobs. The overview says a digital signature confirms who sent the message, while encryption is what keeps it private. The help page lists “Encrypt this message (S/MIME)” and “Digitally sign this message (S/MIME)” as separate checkboxes.
A few practical rules:
- Don’t treat Sign, a lock icon or a sensitivity label’s name as proof the file is protected. A label doesn’t, by itself, stop what the recipient can do.
- Don’t put S/MIME and Purview on the same message, and don’t stack one encryption method on another.
- Don’t start installing certificates to get S/MIME working. That’s a conversation for your admin.
How to send a secure email in new Outlook
These steps come from Microsoft’s help page for new Outlook. They’re for new Outlook only, not every Outlook app your company has. First remove any S/MIME protection from the message, because Microsoft’s encryption overview says not to combine the two. Then:
Encrypting a message in new Outlook
- 1
Open Options
On the message you’re writing. - 2
Select Encrypt
If Encrypt isn’t there, the steps end here. Ask your admin. - 3
Choose Encrypt or Do Not Forward
The difference is explained below. - 4
Send
The harmless test first, then the change order.
Encrypt or Do Not Forward
Both options encrypt the message and make the recipient prove who they are before opening it, according to Microsoft’s page on usage rights. The difference is what the recipient can do afterward.
Encrypt
- The recipient can’t remove the encryption
- Use it when the recipient needs to forward the change order
Do Not Forward
- In Outlook, Forward, Save As and Print are unavailable
- The recipient can’t add other people to it
- Use it when forwarding, printing and copying should be blocked
Neither one stops someone taking a photo of the screen.
Apps don’t all handle these limits the same way, so Microsoft’s usage rights page recommends testing. And even when copying is blocked, nothing stops someone photographing the screen.
Attachments, PDFs and the size limit
Attachments follow their own rules, set out in Microsoft’s encryption FAQ:
- Attached Office files keep the protection only in the Office formats the FAQ lists. Word, Excel and PowerPoint 97-2003 files aren’t on that list.
- PDF protection is off until an admin turns it on. A change-order PDF isn’t protected just because you chose Encrypt.
- SharePoint and OneDrive cloud attachments aren’t supported. A link to a file there isn’t a protected attachment.
- The whole protected message, attachments included, is limited to 25 MB.
Don’t go by the attachment rules on Microsoft’s Personal and Family page. They aren’t for work accounts.
Classic Outlook, the web and Mac: ask your admin
The steps above are for new Outlook only. For the other versions, Microsoft’s pages don’t give a clear route to the Encrypt button, so check with your admin first:
- Classic Outlook. Microsoft’s help page covers classic Outlook under S/MIME rather than the Encrypt button. The FAQ confirms older Windows versions can send encrypted mail, without giving the steps.
- Outlook on the web. The help page’s web section covers S/MIME options, not the Encrypt button.
- Mac. The FAQ says Outlook for Mac can create encrypted mail. Ask your admin for the steps on your Mac rather than guessing at menu names.
- iPhone and Android. Ask your admin before sending protected mail from the phone apps.
If you’re not in new Outlook, ask your admin which app the company supports for encrypted mail.
How the recipient opens the message
Someone who uses Microsoft 365 can read it in a supported version of Outlook. Anyone outside can open it through Microsoft’s web portal with a one-time passcode, a Microsoft account, or a work or school account. They don’t need a Microsoft 365 subscription to read it or to send an encrypted reply (see the FAQ and the encryption overview). That matters when the project manager on the other end doesn’t have Microsoft 365.
Mail opened through the portal stays available as long as your organization’s account is active and the message isn’t set to expire. If your company has an expiry rule, that’s something it set up, not an Outlook default, so there’s no single expiry time to count on. And screen captures still aren’t guaranteed to be blocked.
That’s why the harmless test comes first. If it won’t open on the other end, don’t send the change order.
If Encrypt is missing, stop
A missing Encrypt option could mean the license doesn’t include it, the admin hasn’t set it up, or you’re in the wrong version of Outlook. From the sender’s seat, there’s no way to tell which. Ask your admin two questions: does the company have Purview Message Encryption, and is your license one of the plans in Microsoft’s FAQ? Don’t try to change company settings yourself.
Protecting one message is a small part of keeping business email safe. Our guide to email security best practices covers the everyday habits. If you’d like an outside administrator to look at your work mailbox alongside your admin, see our business email support for contractors.