A client, an accountant or an insurer's questionnaire has just asked whether you send encrypted email, and the honest answer is "not sure". Email encryption means scrambling a message so that only the intended recipient can read it. The term covers three different things, though, and the person asking rarely says which. Most UK small businesses on Microsoft 365 already have one of the three switched on and a second available on the right plan. This guide explains which is which and what to say when someone asks.
Three things "encrypted email" can mean
Encrypted email usually means one of three things.
- The connection. The link between your mail server and the recipient's can be encrypted with TLS. Nobody presses a button, but Microsoft's own documentation is clear about the limit: "TLS doesn't encrypt the message, just the connection." Exchange Online uses opportunistic TLS: it encrypts the connection if the receiving server supports it and, by default, sends unencrypted if it does not.
- The message. Message level encryption, such as Microsoft Purview Message Encryption, protects the message itself. The recipient has to prove who they are before it opens, wherever it is delivered, because the protection travels with the message.
- End to end. S/MIME encrypts the message from sender to recipient using certificates. It needs a certificate for every user on both sides, Microsoft's own examples are government to government, and S/MIME encrypted mail cannot be scanned for malware or spam. Use it only where the other party requires it.
Encryption is one layer in a wider toolkit of filtering and authentication; the rest is in our guide to email security solutions, including SPF, DKIM and DMARC.
Is Microsoft 365 email encrypted by default?
The connection is. The message is not.
Between two Microsoft 365 organisations, Microsoft's documentation says the connection is always encrypted with TLS 1.2. To anyone else, Exchange Online tries TLS first and, by default, sends unencrypted if the other side cannot do TLS. Microsoft's own guidance says opportunistic TLS "is sufficient for most businesses", with forced TLS available for partners with compliance needs.
The Exchange admin centre has an "Outbound messages in Transit Security" report showing how many messages left without TLS because the recipient's domain did not support it. Ask whoever provides your Microsoft 365 support to pull it; any client on that list is a candidate for message encryption.
What Microsoft 365 already gives you, plan by plan
Microsoft's own licensing guidance settles the business email encryption question for a small firm:
- Business Premium includes it. Microsoft Purview Message Encryption is included in Business Premium, E3 and E5, with nothing extra to buy.
- Business Basic and Business Standard do not. Microsoft's add on for those plans has been retired, according to a Microsoft Q&A answer, so in practice the usual route is Business Premium.
- Licences are per sender. Each person who sends encrypted mail needs one. Recipients need nothing.
- Usually nothing to set up. The one prerequisite, the Azure Rights Management service, is activated automatically on eligible plans.
There are two options. Encrypt-Only encrypts the message and makes recipients authenticate, but they can still copy, print and forward it. Do Not Forward stops recipients forwarding, printing, copying or adding recipients. Business Premium also includes manual sensitivity labels, which can carry either option, so staff pick a label rather than remember a setting.
Your administrator can add a mail flow rule that encrypts automatically, for example every message to a named client domain. Revoking a sent message or setting an expiry is Advanced Message Encryption, an E5 or add on capability, not in Business Premium.
Sending an encrypted email from Outlook: a worked example
A 20 person accountancy practice in Dorset needs to send a client's payroll summary. In Outlook, on the web or on the desktop, the sender writes the message, chooses Encrypt, picks Encrypt-Only or Do Not Forward, attaches the spreadsheet and sends.
What the client sees depends on where they are. A client on Microsoft 365 opens it in Outlook with no extra steps. A client on Gmail signs in with their Google account. A client on any other service receives a one time passcode by email. Microsoft's documentation says all of them can reply encrypted without a subscription, and the attached Office file travels with the same protection.
Then stop relying on someone remembering the button: the practice asks its IT provider for a mail flow rule so that anything with "payroll" in the subject is encrypted automatically.
When UK GDPR and the ICO expect encryption
Does the law make you encrypt email? The ICO's encryption guidance answers directly: "No. The UK GDPR doesn't specifically require you to use encryption or encrypt all personal information you hold." Article 32 asks for measures "appropriate to the risk" and names encryption of personal data as an example. The ICO adds that you should use encryption to protect personal information in transit electronically.
For a small business that means: if you routinely email payroll, medical, financial or legal details about identifiable people, sending them unencrypted is hard to justify. The ICO says organisations with poor security "may face risks of regulatory action and reputational damage", and its published example is a misdirected, unencrypted email.
For occasional use the ICO suggests an alternative: an encrypted attachment with a long, complex password, the password given by a separate channel such as a phone call once the email has arrived, never in the same email. Either way, write the rule into your IT security policy.
The common requests, and what to answer
- An accountant or solicitor asks how you will exchange documents. Purview Message Encryption, or an encrypted attachment with the password given by phone.
- An NHS or public sector buyer asks how you will send information about identifiable people. Message encryption, and ask whether they also require a specific secure email standard.
- A cyber insurance questionnaire asks whether you encrypt email in transit. TLS, yes, by default; message encryption on Business Premium. Our cyber insurance requirements guide covers the rest of the questionnaire.
- A customer or prime contractor asks whether you hold Cyber Essentials. Cyber Essentials covers five technical controls and email encryption is not one of them, so answer separately.
- A client simply asks "is your email encrypted?" The connection is. The message can be, and here is how we would send it to you.
What encryption does not stop
A convincing phishing email arrives over TLS like any other; encryption says nothing about who sent it, so staff still need to know how to spot a phishing email. If an attacker has a user's password, they can read and send encrypted mail as that user; the defence is multi factor authentication and Conditional Access. If the recipient's mailbox is compromised, the attacker opens your encrypted message with the recipient's own credentials. Encryption is a confidentiality control, not an identity control, so it belongs inside a managed cybersecurity layer rather than replacing one.
What we do
HGC is a Microsoft Partner and Cloud Solution Provider based near Dorchester: a UK team, 24/7 monitoring, predictable monthly cost, no long contracts, and Cyber Essentials certified. As part of managed IT support we set up Purview Message Encryption, sensitivity labels and automatic encryption rules, and tell you honestly whether your plan already includes it before you buy anything.
If someone has asked you for encrypted email and you are not sure, get in touch.
Frequently asked questions
What is email encryption?
Email encryption scrambles a message so only the intended recipient can read it. It comes in three forms: encrypting the connection between mail servers (TLS), encrypting the message (Microsoft Purview Message Encryption), and end to end encryption with certificates (S/MIME).
Is Microsoft 365 email encrypted?
Partly. Exchange Online encrypts the connection to the receiving server with TLS whenever that server supports it, but Microsoft says TLS does not encrypt the message. To protect the message, Business Premium users can apply Purview Message Encryption in Outlook.
Does GDPR require email encryption?
No. The ICO says UK GDPR does not specifically require encryption, but Article 32 names it as an example of an appropriate security measure and the ICO says you should encrypt personal data in transit.
How do I send an encrypted email in Outlook?
On Microsoft 365 Business Premium, open a message in Outlook, choose Encrypt, pick Encrypt-Only or Do Not Forward, and send. Recipients on Microsoft 365 open it normally; others sign in or use a one time passcode.
