.png)
Two very different things called "email encryption"
When people say "encrypt our email," they usually mean one of two completely different things — and confusing them leads to either false confidence or unnecessary complexity. The distinction matters for compliance, usability, and cost.
- Transport encryption (TLS): Encrypts the connection between mail servers. The email is encrypted in transit but decrypted at each server hop. This is the default for all modern email platforms including M365 and Gmail. It protects against network interception but not against server-side access.
- End-to-end / message-level encryption: Encrypts the message content itself so only the intended recipient can read it — not even the mail servers in between. This is what compliance frameworks like HIPAA require for ePHI sent outside your organization.
Figure 1 — TLS vs. message-level encryption. TLS protects data in transit between servers but each server can read the content. Message encryption keeps the content opaque to everyone except the intended recipient.
When is encrypted email required?
| Scenario | Requirement | Solution |
|---|---|---|
| Sending ePHI outside your organization (healthcare) | HIPAA Technical Safeguard — transmission security | Microsoft Purview Message Encryption (OME) |
| Sending cardholder data via email | PCI DSS Requirement 4.2.1 — strong cryptography | OME or S/MIME; better to avoid email for PAN entirely |
| Attorney-client privileged communications | Professional obligation; not a regulatory mandate | OME or S/MIME depending on recipient capability |
| Financial data, SSNs, tax documents | State privacy laws (CCPA, SHIELD Act, etc.) | OME with DLP auto-encryption policy |
| Internal email between M365 users | Generally not required — TLS + M365 server-side encryption covers this | No additional action needed |
Microsoft Purview Message Encryption (OME)
OME is Microsoft's built-in message encryption solution for M365. It replaced the older Azure Rights Management-based OME and is included with M365 Business Premium, E3, and E5. It requires no software installation on the recipient's end — recipients receive a link to a secure portal where they authenticate and read the message.
How OME works
- Sender applies an encryption label (manually or via DLP policy trigger).
- M365 encrypts the message and sends the recipient a notification with a secure link.
- Recipient authenticates via Microsoft account, Google account, or one-time passcode.
- Recipient reads and replies in the encrypted portal — replies are also encrypted.
Automatic encryption with DLP policies
The most effective deployment is automatic — users should not have to remember to encrypt. A DLP policy can detect sensitive content patterns and apply encryption automatically:
- Emails containing Social Security Numbers → encrypt automatically
- Emails containing ePHI keywords → encrypt and apply HIPAA label
- Emails containing credit card numbers → encrypt or block
S/MIME — the alternative for high-security environments
S/MIME (Secure/Multipurpose Internet Mail Extensions) provides true end-to-end encryption using digital certificates. Unlike OME, S/MIME encrypts the message at the client level — Microsoft's servers never see the plaintext. It is preferred in legal, government, and high-security financial environments.
The tradeoff: S/MIME requires both sender and recipient to have certificates installed and exchanged in advance. It is not practical for ad-hoc external communication. For most SMBs, OME provides the right balance of security and usability.
What encrypted email does not protect against
Encryption protects data in transit and at rest. It does not protect against:
- A recipient who forwards the decrypted message to an unauthorized party.
- A compromised recipient mailbox — if the attacker has the recipient's credentials, they can read encrypted messages too.
- Screenshots or physical observation of the screen.
For the highest-sensitivity communications, combine encryption with Rights Management restrictions (prevent forwarding, set expiry) using OME Advanced Message Encryption, included with M365 E3/E5 and Business Premium.
See our HIPAA Technical Safeguards checklist for the full compliance context, and our Spam Filter vs. Email Security Gateway article for the broader email security stack.
Contact our engineers to configure Microsoft Purview Message Encryption and DLP auto-encryption policies for your organization.
