🔑 Key Takeaways
- Outlook has three encryption paths: Purview Message Encryption, S/MIME, and Office Message Encrypt.
- The Encrypt button only appears on Business Premium, E3, E5, or A3/A5. Basic and Standard hide it.
- S/MIME needs X.509 certs on both sides plus yearly renewal. Peer clinics keep it, patients drop it.
- External recipients open Purview mail through a portal link. Sign in with Microsoft, Google, or OTP.
- HIPAA needs a signed BAA, training, audit logs, and policies. Encryption alone is not compliance.
Outlook offers built-in encryption on most business plans, but the button only appears when the license, tenant configuration, and client version all line up. Missing one piece leaves the sender clicking on a feature that does nothing.
This guide walks through every path for how to encrypt email in Outlook, from the Encrypt button on Microsoft 365 to S/MIME certificates and Office Message Encryption rules. Where a healthcare team needs a simpler alternative, a secure email service with a BAA in the base plan often removes the recipient-side portal friction entirely.
Each method below includes the exact ribbon path, the license requirement, and the recipient experience. Skip to the section that matches your Outlook version and plan.
Outlook Supports Three Different Encryption Methods
Outlook does not have one encryption feature. It has three, and they behave differently at the recipient end.
Microsoft Purview Message Encryption is the modern default. It sits behind the Encrypt button in the ribbon on Microsoft 365 Business Premium and higher. External recipients get a portal link.
S/MIME uses X.509 certificates installed on each sender and recipient. It works entirely inside the client and produces a message that opens directly in Outlook without a portal step. Setup and certificate maintenance limit its practical reach.
Office Message Encryption is the older brand name for what is now Purview Message Encryption. Exchange Online admins can trigger it through mail flow rules based on subject keywords, recipient domain, or content sensitivity labels.
Picking the wrong path is the top cause of failed encryption rollouts. Read the recipient experience before deciding.
License Requirements Determine Which Method You Can Use
The Encrypt button in Outlook only appears on tenants with a qualifying license. Cheaper plans block the feature at the tenant level.
Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, A3, A5, and G3/G5 all include Purview Message Encryption. Business Basic and Business Standard do not. Personal and Outlook.com accounts have no access at all.
Admins verify entitlement in the Microsoft 365 admin center under Billing, then Licenses. The full breakdown lives in the Microsoft Purview Message Encryption documentation.
S/MIME has no Microsoft license gate. It works on any Outlook client, including consumer accounts, provided each user brings a valid certificate from a public or internal certificate authority.
Practices that need HIPAA-grade encryption and do not want to upgrade all seats to Business Premium often pair a lower-cost Microsoft plan with a dedicated encrypted email service.
The Encrypt Button in New Outlook and Outlook 365
The most common path is the Encrypt button on the ribbon of Outlook 365 and the New Outlook client.
Compose a new message. On the ribbon, click the Options tab. Click Encrypt. A dropdown offers Encrypt-Only, Do Not Forward, and any custom sensitivity labels the admin has published.
Pick Encrypt-Only for standard transmission protection. Pick Do Not Forward when you need to block forwarding, copying, and printing on the recipient side.
Add the recipient, subject, and message body. Attachments inherit the same protection. Click Send.
Internal recipients on the same tenant open the message directly in their Outlook client. External recipients receive a notification email with a portal link.
If the Encrypt button is grayed out, the license is missing or the client has not synced. Sign out and sign back in before opening a support ticket.
Encrypting Email in Classic Outlook 2016 and 2019
Classic Outlook 2016 and 2019 support Purview Message Encryption through the same ribbon path, with one extra permission menu.
In classic Outlook, the button lives under File, Properties, Security Settings while composing. On the ribbon, click Options, then Permission. Pick Encrypt-Only or Do Not Forward from the dropdown.
Older Outlook 2013 installs need a client update patch and Azure Rights Management activated on the tenant. Without the patch, the Permission button prompts for a rights management server that does not exist.
The rest of the workflow matches the new client. Recipient portal experience, attachment inheritance, and admin logging all behave identically across versions.
Teams on Outlook 2013 should plan a client upgrade. Microsoft ended mainstream support for Office 2013 in 2018 and extended support in 2023.
A three-person dermatology practice on Microsoft 365 Business Standard tries to click Encrypt on a referral message and finds the button missing from the Options ribbon. The office manager verifies licenses in the admin center, upgrades one seat to Business Premium for the referral coordinator, waits 24 hours for the license to propagate, then signs out and back in. The Encrypt button appears. The coordinator picks Do Not Forward and sends the message. The specialist receives a portal link and reads it in the browser.
S/MIME Setup for Certificate-Based Encryption
S/MIME uses public-key cryptography. Each sender and recipient holds a certificate. The sender encrypts with the recipient public key. The recipient decrypts with their private key.
Obtain an X.509 certificate from a trusted CA or internal PKI. Import the certificate to the Windows certificate store under Personal. Match the certificate email address to the Outlook account email.
In Outlook, open File, Options, Trust Center, then Trust Center Settings, then Email Security. Click Settings under Encrypted email. Point Outlook to the installed certificate.
Before sending an encrypted message, exchange signed messages with each intended recipient. Each signed message carries the sender public key, which Outlook stores in the contact record for future encryption.
S/MIME certificates expire annually. Track expiration dates in a shared calendar. An expired certificate blocks all new encrypted sends until renewal.
Automatic Encryption Rules in Exchange Online
Manual clicking works for individual senders. Organizations that must encrypt every message matching a policy need mail flow rules.
An admin opens the Exchange Online admin center. Under Mail flow, then Rules, they create a new rule. Conditions can include subject contains PHI, recipient domain matches an external partner, or content contains a sensitive information type like Social Security number.
Action: Apply Office 365 Message Encryption and rights protection. Select Encrypt-Only or Do Not Forward. The rule fires server-side on every matching message without any sender action.
Rules cover the compliance gap when workforce members forget to click Encrypt. They also apply to messages sent from mobile clients that lack the ribbon.
Test the rule against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users to send from personal accounts.
Recipient Experience Determines Adoption
Encryption succeeds only when the recipient opens the message. Portal friction kills adoption.
Purview Message Encryption sends the external recipient a notification email. The email carries a link to the message portal. The recipient clicks, chooses a sign-in method, and reads the message.
Sign-in options include Microsoft account, Google account, or one-time passcode delivered to the same inbox. The passcode option adds thirty seconds and one extra click.
Elderly patients, referring physicians on legacy email systems, and vendor billing staff sometimes stall at the portal step. They call the practice for help. That call is the hidden cost of portal-based encryption.
Services like Mailhippo deliver encrypted email that opens like a normal message on the recipient side, which removes the support call entirely. Practices weighing tradeoffs should test both flows with a real referral partner.
The Encrypt button in Outlook satisfies the HIPAA transmission safeguard, but the practice is not compliant without a signed Business Associate Agreement with Microsoft on file. Sign the BAA through the Microsoft 365 admin center at no extra cost on eligible plans, then configure audit logging and document workforce training before staff start sending PHI. OCR audits routinely find the gap between working encryption and a missing BAA during breach investigations.
HIPAA Compliance Requires More Than Encryption
Purview Message Encryption satisfies the Security Rule transmission security safeguard. It does not make a practice HIPAA compliant on its own.
The covered entity must sign a business associate agreement with Microsoft. The BAA is available at no extra cost through the Service Trust Portal. Practices without a signed BAA on file are not compliant even when the encryption works correctly.
Additional requirements include audit logging on message access, workforce training records, sanction policies, and documented procedures for PHI email. The HHS Security Rule guidance covers each safeguard in detail.
Practices that build websites handling patient data face parallel obligations. A HIPAA-compliant intake form pairs with encrypted email. See healthcare website security features for the site-side controls.
Compliance is a program, not a checkbox. Encryption is one piece.
Common Errors and How to Fix Them
Three errors account for most encryption support tickets. Each has a specific fix.
- Encrypt button missing after license upgrade. Sign out of Outlook, close the app, wait up to 24 hours for tenant propagation, sign back in.
- Recipient cannot open the portal. Confirm the notification email did not land in spam. Ask the recipient to request a one-time passcode instead of Microsoft or Google sign-in.
- Attachments download without protection. Convert Word and Excel files to PDF before attaching, or apply Do Not Forward instead of Encrypt-Only.
- S/MIME send fails with a no valid certificate error. Verify the recipient sent a signed message first so their public key is in the address book.
- Mail flow rule fires on internal messages. Add a sender is outside the organization is false exception or scope by recipient domain.
Run each fix in order. If the error persists, capture the message header and open a Microsoft support case. Include the tenant ID, the affected user UPN, and the exact error text.
Related guides in this series cover how to encrypt email across providers, how to encrypt an email in Outlook 365, and how to encrypt email in new Outlook.
When a Dedicated Encrypted Email Service Fits Better
Outlook encryption works well for organizations already standardized on Business Premium or higher with dedicated IT staff. It creates friction elsewhere.
Small practices on Business Basic or Business Standard face a cost jump per seat to unlock Purview. Multi-provider teams running Google Workspace and Microsoft 365 side by side hit sign-in friction on the recipient portal.
Mailhippo is a HIPAA-compliant email service that works with existing Gmail and Outlook accounts, includes a business associate agreement in the base plan, and delivers messages to recipients without a separate portal login. Client-side encryption plus TLS covers the transmission security safeguard without requiring per-recipient S/MIME certificates.
Practices running healthcare marketing sites often pair encrypted email with a compliant patient-facing web presence. See healthcare marketing services for the site-side counterpart.
Pick the tool that matches the workflow. Outlook Purview for standardized enterprise tenants. S/MIME for internal certificate-managed teams. A dedicated encrypted service for practices that want one-click send and one-click open across every recipient.
Frequently Asked Questions
Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, Apps for Enterprise with add-on, A3, A5, and Government G3 and G5 all include Microsoft Purview Message Encryption. Business Basic, Business Standard, and Apps for Business do not include it and cannot use the Encrypt button without an add-on license. Personal plans and Outlook.com free accounts do not include Purview at all. The Encrypt button will appear grayed out or missing in the ribbon on plans that lack the entitlement.
Yes. When you click Encrypt in Outlook and send to a Gmail address, the recipient gets a notification email with a link to a Microsoft-hosted portal. They open the portal, sign in with their Google account or request a one-time passcode, and read the message. Replies from the portal return encrypted. The recipient never needs an Outlook or Microsoft 365 account. The experience adds one click compared to a normal email but keeps the content protected end to end.
Encrypt applies default protection, which prevents forwarding by unauthorized users and enforces sign-in for external recipients. Encrypt-Only allows the message to be forwarded by the recipient but keeps the content encrypted in transit and at rest inside the recipient mailbox. Do Not Forward is a stricter option that blocks forward, copy, and print. Practices sending PHI typically pick Do Not Forward for records requests and Encrypt-Only for routine coordination.
Attachments inherit the same encryption applied to the message when Purview Message Encryption is active. Word, Excel, PowerPoint, and PDF files stay protected inside the recipient portal and cannot be downloaded outside it when Do Not Forward is selected. Other file types download with the protection removed, so senders should convert sensitive spreadsheets or notes to PDF before attaching. Attachment size still follows the standard 25 MB Exchange Online limit unless SharePoint delivery is triggered.
The admin obtains X.509 certificates from a trusted certificate authority or an internal PKI and deploys them to each user Windows certificate store. Each user opens File, Options, Trust Center, Trust Center Settings, then Email Security, and points Outlook to their certificate. Before the first encrypted send, users exchange signed messages so public keys populate the address book. From that point, the Sign and Encrypt buttons in the message ribbon apply S/MIME per message.
The encryption meets the HIPAA Security Rule technical safeguard for transmission security, but compliance requires more. The practice signs a business associate agreement with Microsoft, configures audit logging, trains workforce members on PHI handling, and documents policies. Administrative safeguards like access controls and workforce sanctions still belong to the practice. A practice that clicks Encrypt but skips the BAA or leaves auditing off is not compliant. A signed BAA is available through the Microsoft 365 admin center at no extra cost on eligible plans.
Sign out of Outlook completely, close the application, and reopen it. If the button still does not appear, wait up to 24 hours for the license to propagate across the tenant. Confirm the license assignment under Users, Active Users in the admin center. Verify Azure Rights Management is activated under Settings, Org settings, Microsoft Azure Information Protection. On the desktop client, run Get-IRMConfiguration in Exchange Online PowerShell to confirm InternalLicensingEnabled is true.
