How to Encrypt Emails and Prevent Message Forwarding in Microsoft Outlook

Transmitting confidential business proposals, legal contracts, proprietary code snippets, or sensitive personal documents via conventional unencrypted email exposes your communications to intermediary packet sniffing, inadvertent recipient forwarding, and compliance penalties under data privacy regulations such as GDPR and HIPAA. To protect sensitive communications, Microsoft Outlook provides robust, enterprise-grade email encryption and Information Rights Management (IRM) capabilities built directly into the compose window.

Through Microsoft 365 Message Encryption (OME) and certificate-based S/MIME, Outlook enables users to encrypt the body and attachments of outgoing messages with end-to-end cryptographic protection, restrict recipients from forwarding or printing messages, and prevent screenshots or unauthorized clipboard copying. In this guide, you will learn how to encrypt individual emails in Outlook, apply “Do Not Forward” policy restrictions, and understand how recipients decrypt your messages.

Understanding Microsoft Outlook Encryption Technologies

Outlook provides two primary encryption models depending on your account configuration:

• Microsoft 365 Message Encryption (OME / IRM): Cloud-based encryption included with Microsoft 365 Business, Enterprise, and Family subscriptions. Requires no certificate exchange; recipients authenticate seamlessly using their Microsoft Account, Google Account, or a single-use passcode.
• S/MIME (Secure/Multipurpose Internet Mail Extensions): Traditional public-key cryptography requiring both sender and recipient to possess digital ID certificates installed on their devices. Common in government and strict corporate intranet environments.
• Policy Rights (Do Not Forward): Restricts the recipient’s email client, disabling Forward, Print, and Copy buttons while encrypting transmission.

Step 1: Encrypting a Single Email in Microsoft Outlook (Desktop App)

If you use the classic or new Outlook desktop client on Windows, applying encryption is simple:

1. Open Outlook and click New Email to launch the compose window.
2. Add your recipient, subject line, and message body. Attach any confidential documents.
3. Click the Options tab on the top ribbon.
4. Look for the Encrypt button (padlock icon). Click the dropdown arrow below it to view available security policies:
   • Encrypt: Encrypts the email and attachments in transit and at rest. Recipients can read, reply, and forward the message normally.
   • Do Not Forward: Encrypts the message and strictly revokes forwarding privileges. Only the designated recipients can read the email; they cannot forward, copy text, or print attachments.
   • Confidential / Highly Confidential: Enterprise-managed sensitivity labels that apply watermarks and automated retention policies.
5. Select your preferred policy (e.g. Do Not Forward). A security banner appears above the message header confirming: “Do Not Forward — Recipients can read this message, but cannot forward, print, or copy content.”
6. Click Send.

Step 2: Encrypting Emails in Outlook on the Web (OWA)

If you access Outlook through a web browser:

1. Sign into your inbox at outlook.office.com or outlook.live.com.
2. Click New mail.
3. In the compose toolbar at the top of the message pane, click the Encrypt button (or click Options > Encrypt).
4. Click Change permissions if you want to switch between basic Encrypt and Do Not Forward.
5. Draft your message and click Send.

Step 3: How External Recipients Decrypt and Read Your Message

One of the greatest advantages of modern Microsoft 365 encryption is that recipients do not need to use Outlook to read your encrypted email:

• Recipients Using Outlook: If the recipient uses Outlook on Windows, Mac, iOS, or Android, the email decrypts seamlessly and displays directly in their reading pane just like a standard message.
• Recipients Using Gmail, Yahoo, or Apple Mail: External users receive an email containing a secure link: “Read the message”. Clicking the link opens a secure Microsoft web portal where they can authenticate using their Google Account or request a temporary One-Time Passcode (OTP) sent to their inbox.

Step 4: Setting Up Automatic Encryption for Specific Keywords

System administrators managing Microsoft 365 Exchange Online can configure automated transport rules that scan outbound messages for keywords (such as [Confidential] or national insurance numbers) and enforce encryption automatically:

1. Sign into the Exchange Admin Center (admin.exchange.microsoft.com).
2. Navigate to Mail flow > Rules.
3. Create a new rule: Apply Microsoft 365 Message Encryption to outgoing messages with specific words in the subject line.
4. Specify the trigger keyword (e.g. SECURE:) and set the action to Modify the message security > Apply Office 365 Message Encryption.