Office 365 Email Encryption

Mimecast enhances Office 365 email encryption by simplifying secure messaging, adding malware scanning and DLP controls, and enabling encrypted communication even when TLS is unavailable.

What is Office 365 email encryption?

Email encryption in Office 365 is a security feature that lets you send encrypted emails to people inside or outside your organization.

When you encrypt an email, only the people who have the encrypted email key can read it. Encrypted email is different from regular email because -

• The subject line and body of the encrypted email are encrypted so that only the intended recipient can read them, even if someone else intercepts the message in transit.
• The encrypted email doesn't include a link to download the key, so only the intended recipient can get the key and read the message.

The Importance of Office 365 Encrypted Email

The importance of encrypted email cannot be understated. In today's world, email is one of the most used communication tools. However, it is also one of the most vulnerable, as email messages are often stored on servers and can be accessed by unauthorized individuals.

Microsoft 365 email encryption helps protect your emails from being read by anyone other than the intended recipient. Encrypted emails are converted into a code that can only be deciphered by the person with the proper key. This ensures your emails remain private and confidential.

In addition, encrypted email can help to prevent fraud and identity theft. By encrypting your emails, you can help to protect yourself and your business from potential risks. 

Email Encryption Options Available in Office 365

Office 365 provides multiple email encryption options to support secure email communication across different use cases, recipient types, and compliance requirements. Each encryption option offers a different balance of usability and security, making it important to choose the approach that fits your organization’s needs.

How Office 365 Email Encryption Options Compare

The table below compares the main Office 365 email encryption options by use case, control level, and administrative complexity. It gives security and compliance teams a quicker way to evaluate which option fits their communication, governance, and operational needs.

Office 365 Message Encryption (OME)

Office 365 Message Encryption is the most commonly used encryption option for securing messages sent both inside and outside the organization. Built on Azure Rights Management, OME allows users to encrypt email without requiring recipients to have an Office 365 account.

Encrypted messages can be opened through a one-time passcode or by signing in with a Microsoft account, making it practical for external communication. Administrators can apply encryption policies automatically using mail flow rules, ensuring consistent protection without relying on manual user actions.

Information Rights Management (IRM)

Information Rights Management extends encryption by adding usage controls to encrypted messages. In addition to protecting message content, IRM can restrict actions such as forwarding, copying, printing, or replying to an email. This option is useful when sensitive information must remain controlled even after delivery. IRM works within Exchange Online and integrates with Microsoft Outlook, allowing users to apply protection templates directly when composing messages.

S/MIME Encryption

S/MIME is a certificate-based encryption option designed for environments that require strict identity verification and message-level security. It encrypts messages and digitally signs them using public and private key pairs, ensuring both confidentiality and sender authentication. While S/MIME provides strong security guarantees, it requires certificate management for every user and recipient, which can increase administrative overhead.

How to set up Office 365 email encryption

Microsoft 365 supports Message Encryption (Information Rights Management). To enable encryption, the sender must have the Microsoft 365 Message Encryption that is included in the Office 365 Enterprise E3 license.

To encrypt a single message:

1. Click File and then Properties.
2. Click Security Settings and select the Encrypt message contents and attachments check box.
3. Compose your message and hit Send.

It is possible to encrypt all outgoing messages by default, however, all potential recipients must have your digital ID to be able to decrypt and view your messages. To enable encryption by default:

1. Go to File > Options > Trust Center > Trust Center Settings.
2. On the Email Security tab, select the Encrypt contents and attachments for outgoing messages check box.

The limitations of Office 365 email encryption

Microsoft has recently added secure email encryption to its popular Office 365 productivity platform, providing users with the option to send encrypted files and messages in order to protect sensitive data. But while Office 365 email encryption is certainly a needed component of this cloud-based platform, it may not be the right fit for every user and organization.

Usability and delivery limitations

Office 365 email encryption simplifies secure messaging for senders, but decrypting those messages may be more difficult for recipients. In order to ensure that an encrypted message can be opened once received, organizations may need to pay for mandatory TLS connections for their business partners or run the risk of not being able to use Office 365 email encryption when a TLS connection is not available.

Why layered security still matters

Beyond usability, organizations relying solely on Microsoft’s native security may create a more uniform defense posture that sophisticated attackers can study and work around over time. That is one reason many organizations take a layered approach, using additional Office 365 email security controls to strengthen protection beyond native encryption alone.

See How Mimecast Strengthens Office 365 Email Encryption

Enhance Office 365 email encryption with Mimecast

Mimecast provides email encryption services that complement Office 365 email encryption, providing users with simple-to-use tools for protecting email messages and attachments. With Mimecast Secure Messaging, users can share sensitive information easily by sending protected messages directly from their regular mailbox application, without requiring senders or recipients to download software or install additional hardware.

Mimecast simplifies encryption workflows while strengthening protection around the threats Microsoft native tools may miss. For organizations that need a more layered defense, it helps improve email security around sensitive communications. Mimecast also helps reduce human risk by identifying at-risk users, delivering targeted security awareness training, and providing behavioral nudges beyond Microsoft’s native capabilities.

Mimecast augments Office 365 email encryption by enabling organizations to:

• Make encryption easier for users and administrators alike.
• Support compliance by enabling secure messages to be subjected to anti-malware, data leak prevention and compliance policies.
• Provide an encryption email service even when TLS encryption is not an option.
• Improve protection by eliminating the ability of administrators to view information within a message.
• Offer dedicated support for implementation, optimization, and ongoing management.

That value also extends beyond product features. According to Forrester’s Total Economic Impact study, organizations using Mimecast realized measurable ROI and operational gains over three years, reinforcing the business case for a layered approach alongside Microsoft 365.

How Mimecast solutions for Office 365 email encryption work

To initiate a secure message or an encrypted file transfer in Office 365, users create a new email in Outlook and select the Send Secure option on the Mimecast tab. They can also apply settings such as read receipts, message expiration dates, and restrictions on printing, replying, or forwarding.

When the user clicks Send, the email and any attachments are securely uploaded to the Mimecast cloud, where they are scanned for malware, checked against content and data leak prevention policies, and stored in a secure AES-encrypted archive. The recipient then receives a notification with instructions for retrieving the secure message and attachments through Mimecast’s Secure Messaging portal.