Email Encryption: Lock Down Messages
Protect email messages so only intended recipients can read them. Compare Microsoft Purview Message Encryption with Advanced Message Encryption — revocation, expiration, and branding.
Why email encryption matters
Think of sending a postcard vs sending a sealed letter.
A regular email is like a postcard — anyone who handles it along the way can read it. Email encryption puts your message in a sealed, tamper-proof envelope that only the intended recipient can open.
Microsoft Purview Message Encryption works automatically — you apply a label or configure a mail flow rule, and outgoing messages are encrypted. Recipients (even outside your organisation, even without a Microsoft account) can still read them through a secure portal.
Advanced Message Encryption adds more control: revoke access to a message after sending, set expiration dates, and apply custom branding to the encrypted email portal.
Message Encryption vs Advanced Message Encryption
| Feature | Message Encryption (OME) | Advanced Message Encryption |
|---|---|---|
| Encrypt emails to anyone | Yes — internal and external recipients | Yes — same capability |
| External access | One-time passcode, Microsoft account, or social login | Same — plus custom-branded portal |
| Sensitivity labels trigger | Yes — label with 'Encrypt' or 'Do Not Forward' | Yes — same |
| Mail flow rules trigger | Yes — transport rules can apply encryption | Yes — same |
| Revoke access | No — once sent, cannot be revoked | Yes — revoke access to encrypted emails via the portal |
| Set expiration | No — message remains accessible indefinitely | Yes — set an expiry date after which recipients cannot access |
| Custom branding | One default branding template | Multiple branding templates — different portals for different audiences |
| Licensing | E3 and above | E5, E5 Compliance, or E5 Information Protection |
How to implement Message Encryption
Method 1: Sensitivity labels (recommended)
The simplest approach — configure encryption settings within a sensitivity label:
| Label Action | What Happens |
|---|---|
| Encrypt | Message and attachments are encrypted; recipients need to authenticate |
| Do Not Forward | Message is encrypted AND recipients cannot forward, print, or copy content |
| Confidential \ All Employees | Pre-configured Rights Management template — encrypt for internal recipients |
Users apply the label in Outlook, and encryption is automatic.
Method 2: Mail flow rules (Exchange transport rules)
For automatic encryption without user action:
| Rule Condition | Action |
|---|---|
| Message contains credit card numbers | Apply OME encryption |
| Sent to external domain | Apply “Do Not Forward” |
| Subject contains “CONFIDENTIAL” | Apply encryption with custom template |
| Sender is in Finance group | Apply Highly Confidential encryption |
Mail flow rules are configured in the Exchange admin center or via PowerShell.
Method 3: DLP policy actions
DLP policies can encrypt messages as an enforcement action:
| DLP Rule | Action |
|---|---|
| Message contains 5+ credit card numbers (high confidence) | Encrypt the message and notify the sender |
This combines detection (SITs) with protection (encryption) in a single policy.
Scenario: Priya implements encryption at Meridian
Meridian Financial’s requirements:
- Client communications: Emails to clients must be encrypted — clients use various email providers (Gmail, corporate Exchange, etc.)
- Trading floor: “Highly Confidential” emails must not be forwardable
- Regulatory: Certain regulatory filings must expire after 30 days
Priya’s implementation:
- Sensitivity label “Client — Encrypted” with Encrypt action — staff apply manually
- Sensitivity label “Trading — Restricted” with Do Not Forward + encryption — prevents forwarding
- Advanced Message Encryption with 30-day expiry for regulatory filings — uses E5 features
- Mail flow rule as a safety net — any email containing 5+ client account numbers is automatically encrypted even if no label is applied
Advanced Message Encryption — deep dive
Revoking access
With Advanced Message Encryption, admins can revoke access to an encrypted email after it has been sent:
| Aspect | Detail |
|---|---|
| Who can revoke | The sender or an admin with appropriate permissions |
| What happens | External recipients can no longer access the message through the OME portal |
| Internal recipients | Revocation applies to the portal view — internal M365 users who opened it in Outlook may still have a cached copy |
| When to use | Sensitive information sent to the wrong recipient, or a relationship changes after sharing |
Setting expiration
| Aspect | Detail |
|---|---|
| Configuration | Set in the Advanced Encryption template or via PowerShell |
| Behaviour | After expiry, the OME portal denies access to the message |
| Granularity | Set by date or by number of days after sending |
| Use case | Time-sensitive information — proposals, embargoed data, regulatory filings |
Custom branding
| Feature | What You Customise |
|---|---|
| Portal logo | Your organisation’s logo on the encrypted email portal |
| Portal colours | Background and accent colours matching your brand |
| Disclaimer text | Custom legal or informational text |
| Multiple templates | Different branding for different audiences (e.g., clients vs regulators) |
Exam tip: revocation scope
The exam tests whether you understand the limitations of email revocation:
- Revocation only works for emails accessed through the OME portal (external recipients)
- Internal M365 recipients who opened the message in Outlook may still have a cached copy
- Revocation is a best-effort control for external access, not a guaranteed recall
- If the question asks about ensuring an external recipient can no longer access a sensitive email, revocation is the correct answer
Encryption methods comparison
| Method | Best For | User Involvement | Coverage |
|---|---|---|---|
| Sensitivity labels | Consistent, user-driven encryption | User applies the label | Per-message or per-document |
| Mail flow rules | Automatic encryption by policy | None — transparent to users | All messages matching conditions |
| DLP policy actions | Encryption triggered by sensitive content detection | None — policy-driven | Messages with specific SIT matches |
| Advanced templates | Time-limited or revocable access | Admin configures, user may apply | External communications |
Priya at Meridian Financial sent an encrypted email containing a client portfolio to an external auditor. The audit is now complete and Priya wants to ensure the auditor can no longer access the email. Meridian has E5 licensing. What should she do?
Dr. Liam wants patient discharge summaries emailed to external doctors to automatically expire after 14 days. St. Harbour Health has E3 licensing. Can he achieve this?
🎬 Video coming soon
Next up: Purview IP Client: Classify Files at Scale — extend classification to Windows devices, file shares, and on-premises data.