How To Encrypt Outlook Message | Encrypt Button + S/MIME

Encrypting an Outlook message takes one click on the Options ribbon, though the steps depend on your Outlook version and plan.

A sensitive email leaves your inbox and lands in someone else’s server in plain text unless you lock it first. You can learn how to encrypt Outlook message in about ten seconds — two clicks on the Options ribbon does it for anyone with a Microsoft 365 Personal or Family subscription. For classic Outlook desktop users without that ribbon option, a certificate-based S/MIME path handles the same job.

The Two-Click Encrypt Method

Anyone with a Microsoft 365 subscription or Outlook.com account can encrypt a message in two clicks from the Options ribbon, with no advanced setup required. This is the built-in Microsoft 365 Message Encryption flow, and it works in new Outlook, Outlook for Mac, Outlook.com, and the Outlook mobile app.

1. Compose a new message.
2. Select Options on the ribbon.
3. Select Encrypt.
4. Choose Encrypt or Do Not Forward.
5. Send the message normally.

Encrypt locks the content so only the intended recipient can read it — Microsoft says the message “doesn’t leave Microsoft 365” in readable form. Do Not Forward adds forwarding, copying, and printing restrictions on top of encryption. Office attachments like Word, Excel, and PowerPoint remain encrypted even after download under both options.

Encrypt vs Do Not Forward: Side-By-Side

The two options share the same encryption core but differ in what the recipient can do with the message after opening it. The table below shows the specific limits of each.

Outlook Message Encryption With S/MIME Certificates

For enterprise accounts or older Outlook desktop versions that don’t display the Encrypt button on the ribbon, S/MIME certificate-based encryption is the alternative route. This method requires a digital certificate on your device and additional configuration steps.

1. Go to File > Options > Trust Center > Trust Center Settings > Email Security.
2. Under Encrypted Email, select Settings.
3. Create a new security setting or select an existing one.
4. Choose a signing certificate and an encryption certificate.
5. Set the Encryption Algorithm to AES 256-bit.
6. Enable Send these certificates with signed messages.
7. When composing a message, go to Options > More Options > Security Settings and check Encrypt message contents and attachments.

This setup is common in government, healthcare, and enterprise environments where IT manages the certificates. Outlook can decrypt S/MIME messages only when the matching certificate and private key are available — if stored on a smart card, the recipient must insert it and enter a PIN.

What Happens When Your Recipient Opens An Encrypted Message?

How the recipient sees your encrypted message depends entirely on their email provider and client. Recipients using Outlook.com, Microsoft 365, new Outlook, Outlook for Mac, or the Outlook mobile app can read and reply like normal mail — the encryption is invisible to them. No extra steps.

Recipients on Gmail, Yahoo, or other providers see a link that opens the message in a secure Microsoft portal. They may need to sign in with a Microsoft, Google, or Yahoo account, or use a one-time temporary passcode sent to their inbox. The message body never appears as readable text during transit. Microsoft’s support documentation covers the full encrypted message sending and receiving flow for both senders and recipients.

For S/MIME encrypted messages, Outlook decrypts automatically only when the matching certificate and private key are present on the device. If the certificate lives on a smart card, the recipient inserts the card and enters a PIN.

Which Outlook Versions Support Each Encryption Method?

Your account type and Outlook client determine which encryption option is available. The table below maps the most common combinations.

Common Mistakes That Block Encrypted Messages

A few setup missteps cause most of the “can’t read it” complaints. Here are the ones that trip people up most often.

• Confusing Encrypt and Do Not Forward. Both encrypt the content, but Do Not Forward also blocks copying, forwarding, and printing. Pick the one that matches your needs.
• Assuming every Outlook version works the same way. The two-click Encrypt button lives in Microsoft 365, new Outlook, Outlook for Mac, and the mobile app. Classic desktop Outlook without a Microsoft 365 subscription needs the S/MIME certificate path instead.
• Expecting all recipients to open it without verification. Non-Microsoft recipients must sign in or use a temporary passcode. That is normal, not a sign something broke.
• Using conversation view. Microsoft Support says conversation view does not support viewing encrypted messages in Outlook. Switch to single-message view to read them.

Quick Reference: Pick Your Encryption Route

Your Outlook version and account type determine which encryption method is available. Use these criteria to pick the right path.

• Microsoft 365 Personal or Family subscriber? Use the two-click Encrypt button method — no setup needed.
• Outlook.com user? Same two-click method works for any message.
• Enterprise or classic Outlook desktop without the Encrypt button? Set up S/MIME certificates through the Trust Center settings.
• Using Outlook without a Microsoft 365 plan? Encrypted messages arrive with a link and sign-in or passcode instructions.