Microsoft 365 Email Encryption: A Practical Guide for UK Small Businesses

You can encrypt email in Microsoft 365 straight from Outlook: write the message, choose Options, then Encrypt, and pick Encrypt or Do Not Forward. The catch is that the button only works properly when your licences and settings are in order, and that is where most small businesses get stuck. This guide covers how to send an encrypted message, what each type of encryption really does, how a customer without Microsoft opens it, why the option sometimes won’t appear, and when a UK small business should bother.

TTOY Digital

Make Your Online Presence Work Harder

TTOY Digital helps small businesses build mobile-first websites, improve local visibility on Google, and manage leads across WhatsApp and email.

Explore TTOY Digital

TL;DR

Microsoft 365 already encrypts mail between servers using TLS. Encrypting an individual message (so only the intended reader can open it) is a separate, deliberate step.
In Outlook, go to Options > Encrypt and choose Encrypt or Do Not Forward. Outside recipients can open the message with a one-time passcode or a Microsoft account.
Message encryption needs the right licence for each user. On Business Basic or Business Standard, that can mean adding an extra Azure Information Protection licence.
You don’t need to encrypt every internal email. Write a short policy so staff know when to use it, for example for sensitive personal data.
Encryption won’t save a mailbox with a weak password. Turn on two-step verification first.

Two different things people mean by “email encryption”
The options Microsoft 365 gives you
How to send an encrypted email in Outlook
How does the recipient open it?
Why can’t I encrypt an email in Outlook?
Do you need to encrypt everything? What UK rules and guidance say
What encryption doesn’t fix
Our view: keep it simple, and write it down
Getting the licensing right without overpaying
A quick checklist before you start
FAQ
Sources

Two different things people mean by “email encryption”

When someone searches for Microsoft 365 email encryption, they are usually asking one of two questions, and mixing them up causes most of the confusion.

The first is encryption in transit: protecting the connection as an email travels between mail servers. Microsoft 365 does this by default with TLS, according to Microsoft’s own documentation. You don’t have to do anything.

The second is encrypting the message itself, so that even if it lands in the wrong inbox or is intercepted, it can’t be read without proving who you are. That is what Outlook’s Encrypt button is for, and it is the part you have to switch on and use on purpose.

If you are sending a customer’s bank details, a staff contract or a medical note, the second one is what you want.

The options Microsoft 365 gives you

Microsoft’s email encryption overview lists four building blocks. Here they are in plain English:

Option	What it does	Best for
TLS	Encrypts the connection between mail servers, on by default	Everyday protection, no effort needed
Microsoft Purview Message Encryption (the successor to Office 365 Message Encryption, or OME)	Encrypts a message to anyone, inside or outside your organisation	Sending sensitive details to customers, suppliers, accountants
S/MIME	Certificate-based encryption and digital signatures	Firms that already manage certificates, or whose clients require it
IRM (Information Rights Management)	Adds usage restrictions such as blocking forwarding, printing or copying	Documents you don’t want passed around

Office 365 Message Encryption was deprecated on 1 July 2023 and automatically replaced by Purview Message Encryption. So if you read an older guide that talks about OME rules, the button you click today is the newer version of the same idea.

OME or S/MIME: which one?

For most small businesses, Purview Message Encryption is the practical choice. Microsoft says recipients need no special client software if they can open the HTML attachment in a browser. There are no certificates to install or renew.

S/MIME works differently. Both sender and recipient need certificates, and you have to manage them. The ICO points out a downside of any key-based approach: if you lose the private key, you may be unable to decrypt emails encrypted with the matching public key. That is a real admin burden for a team of five with no IT person. Choose S/MIME only if a client or regulator asks for it.

One limit worth knowing: Purview Message Encryption on its own does not apply usage restrictions. If you also want to stop someone forwarding or copying, pick Do Not Forward, which is the IRM-style option.

How to send an encrypted email in Outlook

Microsoft’s guidance for personal and family subscriptions is to compose a message, select Options > Encrypt, then choose Encrypt or Do Not Forward. The business version follows the same path.

Start a new message in Outlook (Windows, Mac or Outlook on the web).
Write your message and add attachments as normal.
Open the Options tab and select Encrypt.
Choose Encrypt if you want the message protected but still shareable by the recipient, or Do Not Forward if you want to stop it being forwarded.
Send.

The menu may show extra choices if your organisation has added its own labels or templates. If you are not sure which to choose, Encrypt is the simplest for a customer who just needs to read and reply.

A practical habit: put nothing sensitive in the subject line. Message encryption protects the body and attachments, and the subject is not the place for a National Insurance number.

How does the recipient open it?

This is the question that worries owners most, because nobody wants to send a customer something they can’t open. Microsoft says recipients can open encrypted email using a one-time passcode, a Microsoft account, or a work or school account, and they don’t need a Microsoft 365 subscription.

In practice, a customer on Gmail receives a message telling them there is a protected email. They click through, ask for a one-time code, receive it at their own address, type it in and read the message in a browser. It takes a minute. We tell clients to warn important recipients first, because an unexpected “protected message” email can look like phishing.

Microsoft’s message encryption FAQ adds that people inside Microsoft 365 can read and reply from Outlook for Windows, Mac, the web and mobile, and that the encrypted message portal needs no separate download.

Why can’t I encrypt an email in Outlook?

This is the most common frustration, and the cause is usually one of these.

Five causes of a missing Outlook Encrypt option

The licence doesn’t include it. Microsoft states that each user benefiting from Purview Message Encryption needs a licence for it. It also says you can add Azure Information Protection Plan 1 to plans including Exchange Plan 1, Microsoft 365 Business Basic and Microsoft 365 Business Standard to get message encryption. If you are on one of those and the Encrypt option is missing or fails, check the licence first. Our guide on which Microsoft 365 plan UK small businesses need helps you see where encryption sits in each tier before you pay for the wrong one.

Only some users are licensed. Because the licence is per person, one member of staff can see the option while a colleague can’t. Compare the two accounts in the admin centre.

The setting hasn’t been turned on for the organisation. An administrator may need to confirm the service is active. If you aren’t the admin, ask whoever set up your tenant.

You are using the wrong Outlook. Look for Options > Encrypt in the new and classic desktop apps and in Outlook on the web. If one app hides it, try another to narrow the problem down.

You are using a personal subscription for business. The steps in Microsoft’s personal and family guidance apply to qualifying personal subscriptions. A business tenant works to its own licence rules.

If none of this fixes it, an admin can check the licence assignment and tenant settings in minutes. Guessing at it for an afternoon is the manual bottleneck nobody needs.

Do you need to encrypt everything? What UK rules and guidance say

Short answer: no. Not every email needs wrapping in extra protection, and doing it everywhere makes life harder for staff and customers.

The UK Information Commissioner’s Office says that when deciding whether to adopt encrypted email, you should weigh the risks and investment, compatibility with other security measures, and alternatives for encrypted transit. Its wider guidance recommends a policy with guidelines so staff understand when to use encryption, such as for emails containing sensitive personal data.

The NCSC adds the legal angle for small firms: email accounts are a common target for attackers, and business emails count as data you must protect as part of your GDPR obligations.

In practice, here is a sensible rule for a small firm:

Always encrypt: payroll and HR details, ID documents, health information, bank details, legal papers.
Usually fine without: routine quotes, meeting times, general enquiries, internal chat about the week’s jobs.
Use a dedicated system if your sector has one. The ICO notes that some sectors, such as health with NHSmail, have dedicated secure systems that should be preferred over generic manual setups.

Internal emails sent within your own Microsoft 365 tenant are protected in transit by default, so most firms don’t need to label them all. Reserve message encryption for content that would hurt if it reached the wrong person.

What encryption doesn’t fix

Encryption is one lock on one door. Three things it won’t do.

It won’t protect a hijacked mailbox

If an attacker logs in as you, they read what you read. The NCSC recommends enabling passkeys where supported, or using a strong, unique password with 2-step verification if your email service doesn’t support them. Sort that out before anything else. Our guide to Microsoft Defender for Business setup covers the next layer.

It can make scanning harder

The ICO notes that encryption such as S/MIME or PGP can complicate server-side malware scanning, because security software may not be able to inspect encrypted content. It is a good reason not to encrypt everything by default.

It won’t stop spoofing

Encryption protects what you send. It doesn’t prove that an email claiming to be from you really is. That is a job for SPF, DKIM and DMARC, and we walk through it in our Office 365 DMARC guide. The NCSC also recommends MTA-STS to prevent downgrade attacks, where attackers push mail servers into insecure, clear-text connections.

It isn’t a backup

An encrypted message that gets deleted is still gone. Think about backup and retention separately.

Our view: keep it simple, and write it down

We set up Microsoft 365 for small businesses across Derbyshire, South Yorkshire and Nottinghamshire, and the same pattern repeats. Someone reads that email should be encrypted, switches on every option they can find, and a month later the accountant can’t open a message and the owner is pulling their hair out.

Our advice is plainer than that:

Lock down the sign-in first. Two-step verification on every account. This stops more real-world problems than any message setting.
Pick one method, normally Purview Message Encryption. It works for customers on any email provider without certificates.
Write a half-page policy. List the five or six kinds of information that must be encrypted. Pin it somewhere staff will see it.
Tell the recipient first. A quick call or text to say “a protected email is coming” saves a lot of phone calls.
Test it with a friendly outside address before you rely on it with a client.

We would rather you encrypt the twenty emails a month that matter than hide the other two thousand behind a passcode.

— Chris

Getting the licensing right without overpaying

The licensing is where small firms tend to lose money, either by buying a bigger plan than they need or by buying one that doesn’t include what they thought. Our Microsoft 365 packages start from £16 per month per user, and our Microsoft 365 page explains the Standard and Secure plans. If you are still on another mail provider, the email migration guide shows how a move works. And if you would like someone local to check your tenant, work out why Encrypt isn’t appearing, and set up a simple policy, get in touch through our services page. We can sit down with you in person if you are in our area.

A quick checklist before you start

Confirm which licence each user has, and whether message encryption is included or added.
Turn on 2-step verification for every mailbox.
Test the Encrypt option from each Outlook version your team uses.
Send a test message to a Gmail or other outside address and open it with a one-time passcode.
Write the short policy on what must be encrypted.
Check whether your sector has its own secure system you should be using instead.

Work through that list and you will have a setup that is secure enough for a small business and simple enough that people actually use it.

FAQ

How do I set up Outlook to send encrypted emails?

Open a new message, go to Options, select Encrypt and choose Encrypt or Do Not Forward before sending. The option is only usable when your account has a licence that includes message encryption. If the button is missing, ask your administrator to check the licence assigned to your account.

Do internal emails need to be encrypted?

Not as a rule. Mail inside Microsoft 365 is protected in transit by default, and the ICO suggests a policy that tells staff when to use encryption, such as for sensitive personal data. Encrypt internal messages that contain that kind of data, and leave routine ones alone.

Can a customer without Microsoft 365 read an encrypted email?

Yes. Recipients can use a one-time passcode, a Microsoft account or a work or school account, and they don’t need a Microsoft 365 subscription. They read the message in a browser through a secure portal.

What is the difference between OME and S/MIME?

OME, now Purview Message Encryption, needs no certificates and works with almost any recipient. S/MIME uses certificates held by both sides and adds digital signatures, so it takes more management. Most small businesses are better served by Purview Message Encryption unless a client specifically asks for S/MIME.