How to Encrypt Email in Outlook

Short answer

• In most work or school accounts, the quickest method is Microsoft Purview Message Encryption: start a new message, go to Options, select Encrypt, and choose Encrypt or Do Not Forward.
• S/MIME is the certificate based method. It needs a digital certificate, also called a digital ID, installed on your computer, and the recipient needs a mail program that supports the S/MIME standard.
• Do not apply both methods to the same message. Microsoft states that Purview protection should not be applied to a message already signed or encrypted with S/MIME, and S/MIME should not be applied to a Purview protected message.
• Recipients in Outlook usually open an encrypted message as normal. Recipients on another mail service usually click a link in the message and sign in or enter a one-time passcode.
• Encryption protects the message contents. It does not make a message impossible to screenshot, photograph, or retype, and it does not prove the sender address is genuine unless the message is also digitally signed.

If you need to send bank details, a contract draft, medical forms, or other sensitive information by email, ordinary email is a weak envelope. Encrypting a message in Outlook scrambles its contents so that only the intended recipient can read them. Outlook offers two main ways to do this, and picking the wrong one is the most common reason an encrypted message never gets read. This guide explains both methods, gives the steps for new Outlook, classic Outlook, Outlook on the web, and Outlook mobile, and covers what happens on the recipient side, including for people who do not use Outlook at all.

What Encrypting an Email in Outlook Actually Does

Microsoft describes encryption in plain terms. Encrypting an email message in Outlook converts it from readable plain text into scrambled cipher text. Only the recipient who has the private key that matches the public key used to encrypt the message can decipher the message for reading. Anyone without the corresponding private key sees indecipherable text.

That definition matters because it sets the boundary of what you are getting. Encryption protects the contents of the message while it travels and while it sits in the mailbox. It is not the same as password protecting an attachment, which is a separate feature of the attachment program, and it is not the same as marking a message private or confidential, which is a label rather than a lock.

It also helps to separate encryption from a digital signature. Encryption hides the contents from everyone except the intended recipient. A digital signature verifies the identity of the sender, so the recipient can check that the message really came from the person named and was not altered. S/MIME can do both, but they are separate settings. If proving who sent the message matters as much as hiding its contents, signing matters too, and this guide covers it below.

The Two Encryption Methods in Outlook

Outlook supports two encryption options, and the right choice depends on your account, your organization, and your recipient.

Microsoft Purview Message Encryption. This is Microsoft’s own message protection, built on Information Rights Management. The sender applies an option such as Encrypt or Do Not Forward, and the protection stays with the message. Recipients using supported Outlook versions can read it directly. Recipients on another mail service get instructions for opening it through a web page. You do not need to install a certificate to use it, but availability depends on your subscription and on whether your administrator has turned it on. Microsoft notes that new Outlook supports Microsoft 365 Message Encryption as long as the mail server has an Office 365 Enterprise E3 license, and that if that license is not present, S/MIME is the alternative.

S/MIME encryption. S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It is a widely accepted standard for sending digitally signed and encrypted messages, and it works with certificates rather than with a Microsoft service. To use S/MIME, you and the recipient must both have a mail program that supports the S/MIME standard. You need a digital certificate installed, and for an encrypted message to an outside recipient, the recipient’s certificate must be installed on your machine. S/MIME is common in workplaces, government offices, and regulated industries where certificates are issued and managed centrally.

Question	Microsoft Purview Message Encryption	S/MIME
What do you need first?	A qualifying Microsoft 365 account with message encryption enabled by your administrator	A digital certificate installed on your computer, and the recipient’s certificate for outside recipients
Does the recipient need Outlook?	No, but the experience is simplest in Outlook. Other recipients open the message through a web page	The recipient needs a mail program that supports S/MIME
Does it control forwarding?	Yes, the Do Not Forward option restricts forwarding and shows a banner describing the restrictions	No, S/MIME encryption on its own does not restrict forwarding
Can it also sign the message?	No, use S/MIME for digital signatures	Yes, S/MIME provides both encryption and digital signatures
Best for	Sending protected mail to mixed recipients, including Gmail and Yahoo users	Organizations that already issue certificates, or messages where a signature matters

If you just want to send one protected message from a work or school account and your recipient uses a mix of mail services, start with Purview. If your organization issues you a certificate, or a recipient or policy specifically asks for S/MIME, use S/MIME. Never stack the two on one message.

Before You Start: Check Your Account and Version

Outlook looks different depending on which version you run, and encryption options follow the version and the account type. Microsoft’s support pages organize their instructions by new Outlook, classic Outlook, and Outlook on the web, and the steps below follow that split.

Three checks save most failed attempts. First, confirm that your account is a work or school account or another account type that includes encryption, and that your administrator has not disabled it. If the Encrypt button is missing entirely, that is usually an account or admin setting, not a mistake in your steps. Second, for S/MIME, confirm that you already have a digital certificate. New Outlook does not automatically import digital certificates, so you must install the certificate manually or ask your administrator to configure policies that install it automatically. Third, confirm what your recipient can open. An S/MIME message sent to someone without S/MIME support cannot be read by that person, and new Outlook will warn you about recipients who might not be able to read an encrypted message before you send it.

Method 1: Encrypt with Microsoft Purview Message Encryption

This is the method most people want when they search for how to encrypt email in Outlook. It needs no certificate, and the steps are the same in spirit across versions even though the menus differ.

New Outlook

1. Start a new email message.
2. On the ribbon, choose Options, and then select Encrypt.
3. Pick the option that matches the restriction you want, such as Encrypt or Do Not Forward.
4. Finish writing your message and select Send.

The Encrypt option encrypts the message so that only the intended recipients can read it. The Do Not Forward option adds restrictions, so recipients cannot forward the message, and a banner at the top of the received message tells them what is restricted. Microsoft also warns against combining methods here: if the message is already signed or encrypted with S/MIME, remove that protection before applying Purview protection.

Classic Outlook

In classic Outlook for Windows, the Encrypt control also lives on the Options tab of the new message window. Start a new message, go to Options, select Encrypt, and choose Encrypt-Only or Do Not Forward. Encrypt-Only encrypts the message while still allowing the recipient to reply and forward it. Exact labels vary by Outlook version and by your administrator’s policies.

Outlook on the Web and Outlook.com

1. Start a new message in Outlook on the web.
2. Select Options in the message toolbar, or the Encrypt control if it appears directly on the toolbar.
3. Choose Encrypt or Do Not Forward.
4. Write your message and select Send.

Recipients who use Outlook will see the message open normally, with a banner describing any restrictions. Recipients on another service will see a message with a link and instructions, covered in the receiving section below.

Outlook Mobile

On Outlook for iOS and Android, Purview protected messages can be read directly in the app, and you can send protected messages where your account supports it. The control location depends on the app version, so look in the compose options and confirm the protection in the message header before sending anything sensitive. If the control is absent on mobile, send from Outlook on the web or desktop instead of assuming the message went out encrypted.

Method 2: Encrypt with S/MIME

S/MIME takes more setup, but once it is configured, encrypting a message is a one click choice. The setup has three stages: get a certificate, install it, and tell Outlook to use it.

Step 1: Get a Digital Certificate

A digital ID, also called a digital certificate, is a file verified by a third party that ties your email address to a pair of cryptographic keys. In many workplaces, the IT team issues certificates automatically. If you are setting this up yourself, obtain a certificate from a certificate provider, install it on your computer, and add it to the keychain or certificate store. Keep the password for the certificate file safe, and back the certificate up securely, because losing the private key can mean losing access to encrypted messages sent to you.

Step 2: Configure S/MIME in New Outlook

1. Select Settings, then Mail, then S/MIME.
2. Select Encrypt contents and attachment for all messages I send if you want every outgoing message encrypted automatically.
3. Select Add a digital signature to all messages I send if you want every outgoing message signed.
4. Select Automatically choose the best certificate for digital signing to let Outlook pick the certificate, or leave it unchecked to be prompted to pick one. If this option is grayed out, your administrator has disabled it.
5. Use the same S/MIME settings screen to Import or Export your digital IDs.

Note that this screen configures defaults. Selecting encryption for all messages applies to new messages, replies, and forwards, so think before turning it on globally. If you regularly email people outside your organization who do not have S/MIME, encrypting everything by default will generate warnings and unreadable messages. Most people are better off encrypting per message.

Step 3: Configure S/MIME in Classic Outlook

In classic Outlook, S/MIME settings live in the Trust Center. Go to File, then Options, then Trust Center, then Trust Center Settings, then Email Security. Under Encrypted email, choose your certificate and settings. As with new Outlook, per message encryption is usually the safer default for mixed recipients.

Step 4: Send a Single Encrypted Message with S/MIME

1. Start a new email message.
2. From the ribbon, select Options, then More Options.
3. In Message options, select Encrypt this message (S/MIME). If you also want to sign it, select Digitally sign this message (S/MIME).
4. Select OK.
5. Finish writing your message and select Send.

If new Outlook cannot verify that all recipients can decrypt the message, it shows a warning highlighting the recipients who might not be able to read it. You can send the message anyway, remove those recipients, or retry the check. Do not ignore that warning for a sensitive message. The usual fix is to exchange signed messages first, so each side holds the other’s certificate, or to switch to Purview encryption for that recipient.

To make S/MIME work with a new contact, start by exchanging digitally signed messages. When you receive a signed message from someone, Outlook can store their certificate, and that certificate is what lets you encrypt a reply to them.

How the Recipient Opens an Encrypted Message

Knowing how the other side reads your message prevents the most common support request after sending encrypted mail: a recipient who thinks the message is broken.

Recipients Using Outlook

If the recipient opens the message in most versions of Outlook, including Outlook mobile and Outlook on the web, they may not need to do anything different. A Purview protected message opens like a normal message, with a banner describing any restrictions. An S/MIME encrypted message shows a lock icon, and Outlook decrypts it when opened if the matching certificate is available. If the certificate is stored on a smart card, the recipient will be prompted to insert it, and the smart card may also require a PIN. One exception is conversation view: Microsoft notes that conversation view does not support viewing encrypted messages on desktop, web, or mobile, so the recipient may need to open the message in a new window.

Recipients Using Gmail, Yahoo, or Another Mail Service

A recipient on another mail service receives a message with a link rather than the readable contents. The steps are:

1. Select Read the message in the email they received.
2. Choose how to sign in. If their provider is Google, Yahoo, or Microsoft, they can select Sign in with Google, Sign in with Yahoo, or Sign in with Microsoft. Otherwise, they select sign in with a one-time passcode.
3. If they chose a passcode, they receive the passcode in a separate email, enter it on the web page, and select Continue to read the message.

Each one-time passcode expires after 15 minutes. If it expires, the recipient should start over by opening the original message again and requesting a fresh passcode. This is worth telling your recipient in advance, because an expired passcode looks like a failed message when it is only a timed out code.

Replying to an Encrypted Message

Replying works from the same protected view. The recipient chooses Reply or Reply All, types a reply, and sends it. An encrypted copy of the reply is sent back. One limit to note: if the sender applied a Do Not Reply policy, the recipient will not be able to reply at all.

Encrypting All Messages by Default

Both methods offer an always on option, and both deserve a pause before you enable them. In new Outlook, the S/MIME settings page lets you encrypt contents and attachments for all messages you send and add a digital signature to all messages you send.

Always on encryption suits roles where every message is sensitive and every regular recipient is set up for it, such as a legal or clinical team working inside one organization. It is a poor fit for a general mailbox that emails customers, suppliers, and personal contacts on mixed services, because every outside recipient without the right setup becomes a failed delivery or an unreadable message.

Digital Signatures: Proving Who Sent the Message

Encryption and signing solve different problems, and confusing them causes real mistakes. A signed but unencrypted message is readable by anyone who intercepts it, but the recipient can verify that it came from the claimed sender and was not altered. An encrypted but unsigned message is hidden from everyone except the recipient, but the recipient has less assurance about who sent it.

To send a signed message with S/MIME, you need your own digital certificate installed, and the recipient needs a mail program that supports the same standard. A ribbon icon in the message list or reading pane indicates a digitally signed message, and information about the signature appears at the top of the message. If you receive a signed message and want to verify it, open it in a new window rather than conversation view and follow the signature information shown at the top.

Signing every message is a reasonable habit inside an organization, because it builds a certificate history that makes later encryption easier. It is less useful for casual outside mail, because recipients who do not use S/MIME may see signature attachments they do not understand.

Troubleshooting Common Problems

There is no Encrypt button. This almost always points to account or admin settings rather than to your technique. Microsoft notes that Purview encryption requires a qualifying license and administrator setup, and that new Outlook supports it as long as the mail server has an Office 365 Enterprise E3 license. If you use a personal account, check whether your plan includes message encryption, and if you use a work account, ask your administrator whether Purview Message Encryption is enabled for you.

Outlook warns that a recipient might not be able to read the message. For S/MIME, this means Outlook cannot verify the recipient’s certificate. Exchange signed messages first, check that the recipient’s certificate is installed on your machine, or switch that message to Purview encryption. For Purview, check that you have not accidentally applied both S/MIME and Purview protection to the same message, and remove one of them.

The recipient sees indecipherable text or an attachment they cannot open. For S/MIME, the recipient probably lacks the matching private key or a mail program that supports S/MIME. Resend with Purview encryption or send the content through another approved channel. For Purview, the recipient may have opened only the wrapper message; ask them to click Read the message and follow the sign in or passcode steps instead.

The one-time passcode does not work. Passcodes expire after 15 minutes, so request a fresh one from the original message. Also check that the recipient is entering the code from the most recent passcode email, not an older one, and that they are pasting it without extra spaces.

A certificate error appears when opening an S/MIME message. The recipient may need to grant Outlook access to the keystore, insert a smart card, or enter a smart card PIN. If the certificate has expired or been revoked, the message may remain unreadable, and the sender should resend it through another protected method rather than resending it unencrypted.

What Encryption Does Not Protect

Encryption is strong protection for message contents, but it has limits that matter for sensitive mail. First, protection follows the message, not the screen. A recipient who can read a message can still photograph the screen, copy text by hand, or describe the contents to someone else, unless the applied policy also blocks copying and the recipient’s client enforces it. Do Not Forward restricts forwarding inside supported clients, but it cannot control what a determined recipient does outside the mail program.

Second, encryption does not hide metadata. The sender, recipient, subject line, and timing of a message are generally visible to mail systems even when the body is encrypted, so avoid putting sensitive details in the subject line. Third, encryption does not make attachments safe on their own. An attachment downloaded from a protected message may lose its protection once saved outside the mail program, so treat downloaded files as sensitive.

Fourth, encryption is only as safe as the endpoint. If the sender’s or recipient’s computer is compromised, or if a certificate private key is exposed, encrypted messages can be read by whoever controls that device or key. Keep devices updated and revoke or replace a certificate promptly if you believe it has been compromised. Finally, encryption does not guarantee delivery or reading. A message can be encrypted correctly and still bounce, land in spam, or sit unread, so for time sensitive matters, confirm receipt through another channel.

Frequently Asked Questions

Can I encrypt email in Outlook for free?

It depends on your account. Work or school accounts include it when the administrator has enabled message encryption and the plan qualifies. If your account shows no Encrypt button, encryption is not included in your current plan or setup. Check your plan or ask your administrator before assuming a message was encrypted.

How do I encrypt a single email in Outlook without encrypting everything?

Use per message encryption. Start a new message, go to Options, select Encrypt, and choose Encrypt or Do Not Forward for Purview, or choose Encrypt this message (S/MIME) under More Options for S/MIME. Leave the global settings for encrypting all messages turned off, so only the messages you choose are protected.

What is the difference between Encrypt and Do Not Forward in Outlook?

Both options encrypt the message. Encrypt protects the contents while still allowing the recipient to reply and forward it. Do Not Forward adds restrictions that prevent forwarding and display a banner describing the restrictions on the received message. Choose Do Not Forward when controlling onward sharing matters, and choose Encrypt when you only need to protect the contents.

Can I encrypt email to someone who uses Gmail?

Yes, with Microsoft Purview Message Encryption. The Gmail recipient receives a message with a link, clicks Read the message, and signs in with Google or enters a one-time passcode to read it in a browser window. S/MIME is not a good choice for a Gmail recipient unless that recipient has an S/MIME capable mail program and you hold their certificate.

Do I need a certificate to encrypt email in Outlook?

Only for S/MIME. Microsoft Purview Message Encryption does not require you to install a certificate. S/MIME does require a digital certificate on your computer, and for outside recipients, their certificate must also be available to you. If you do not have a certificate and do not want to obtain one, Purview is the simpler route where it is available.

Why does Outlook say a recipient cannot read my encrypted message?

For S/MIME, Outlook is warning that it cannot verify the recipient can decrypt the message, usually because their certificate is missing. Exchange signed messages first so Outlook can store their certificate, or switch to Purview encryption for that recipient. Sending anyway risks delivering an unreadable message.

Can the recipient forward an encrypted email?

It depends on the option you chose. With Purview Encrypt, the recipient can forward the message. With Purview Do Not Forward, forwarding is restricted in supported clients and the restriction is shown in a banner. With S/MIME encryption alone, forwarding is not restricted by the encryption itself, so a recipient who can decrypt the message can forward the readable contents.

Is an encrypted Outlook email completely secure?

No email method is completely secure, and encryption should not be described that way. Encryption strongly protects message contents from anyone without the right key or access, but it does not hide the subject line or sender details from mail systems, it does not stop a recipient from photographing or retyping content, and it depends on the security of the sender and recipient devices and certificates.

Sources & references

• Microsoft Support, "Send S/MIME or Microsoft Purview encrypted emails in Outlook" (support.microsoft.com). Used for the definition of encryption, the choice between S/MIME and Purview, new Outlook steps for single message S/MIME, all message S/MIME, and Purview encryption, the warning about recipients who cannot decrypt, the rule against combining S/MIME and Purview on one message, and the Enterprise E3 license note.
• Microsoft Support, "Set up Outlook to use S/MIME encryption" (support.microsoft.com). Used for the two encryption types, the requirement that both sides support S/MIME, the certificate and keychain setup, the note that new Outlook does not automatically import certificates, the S/MIME settings path, and the LDAP certificate lookup note summarized in the setup guidance.
• Microsoft Support, "Open encrypted and protected messages" (support.microsoft.com). Used for how recipients open protected mail in Outlook, Gmail, Yahoo, and other services, the one-time passcode steps and 15 minute expiry, the lock icon and smart card behavior for S/MIME, the conversation view limit, and replying to encrypted messages.