Purview Message Encryption: choosing the right protection and avoiding the pitfalls
Sending a sensitive document outside the organisation by email is still an everyday task. Microsoft Purview Message Encryption protects these messages without any additional tool. But between protection options, the recipient experience and automatic rules, the choices made at deployment determine how effective it really is.
How it works and the protection options
Purview Message Encryption relies on the Azure Rights Management service. The message is encrypted and bound to usage rights: who can open it and what the recipient can do with it. The service must be activated in the tenant, which is the default in most recent tenants; check it before configuring anything else.
Encryption does not replace TLS, which protects transport between servers. It protects the content itself, including once it has reached the recipient's mailbox, and makes it possible to restrict how the message is used.
Two options are available out of the box:
- Encrypt-Only: the message is encrypted, but the recipient can forward, print or copy it. It is the simplest option for exchanging with partners without getting in their way.
- Do Not Forward: the recipient can read and reply but cannot forward, print or copy the content. Office attachments remain protected after download.
How attachments behave with Encrypt-Only depends on a tenant setting that determines whether they are downloaded decrypted. That choice has a direct impact on protection once the file has been saved; check its current value.
Custom templates or sensitivity labels with encryption let you go further: restrict access to a partner domain, set an expiry date, grant specific rights. It is often the best route when labels are already deployed.
The external recipient experience
A recipient with a Microsoft 365 account and a recent Outlook client usually opens the message seamlessly. Others, for instance on a consumer email service, receive a wrapper message inviting them to read the content on a web portal, after signing in with their account or with a one-time passcode sent by email.
That wrapper message looks a lot like what phishing campaigns imitate. Customising it with the company's branding and letting regular partners know what to expect reduces confusion. Advanced features such as multiple branding templates, expiry or revocation of sent messages fall under Advanced Message Encryption and a higher licence.
A one-time passcode is not strong authentication. It proves access to the destination mailbox, not the identity of the person. If that mailbox is compromised, so is the encrypted message. For the most sensitive exchanges, restrict access to identified accounts through a template or a label.
Applying encryption with mail flow rules
Mail flow rules can apply encryption automatically, for example:
- when the subject contains an agreed keyword such as "[confidential]";
- when a message going outside the organisation contains detected sensitive information;
- for all messages from a given department to a partner domain.
The keyword rule is the most widespread and the most fragile: it relies entirely on user discipline. A condition based on sensitive content detection, or a label applied by default, is more reliable. Conversely, a rule that removes encryption from inbound or outbound messages must be strictly justified.
Common pitfalls
- Gateways and third-party tools: a downstream security gateway or archiving tool cannot inspect encrypted content; plan how it should behave.
- External replies: depending on the recipient's client, a reply may not be encrypted; tell users.
- Shared mailboxes and delegates: check that the people who need to read encrypted replies can actually do so.
- Mobile apps and older clients: test the combinations your partners actually use.
- Super user: the feature that can decrypt any protected content should stay disabled or be limited to a controlled service account.
What an audit checks
- Activation of the Azure Rights Management service and the tenant IRM configuration.
- The attachment decryption setting for Encrypt-Only.
- Mail flow rules that apply or remove encryption, and their conditions.
- The encryption templates and labels available and how they are actually used.
- Customisation of the wrapper message.
- The state of the super user feature and its members.