Why ordinary email is not enough for sensitive data
Exchange Online usually sends email to other mail servers over an encrypted connection (TLS). That protects the message in transit, but not afterwards. At the recipient’s end, it sits in the mailbox as an ordinary readable message. Anyone who gains access to that mailbox can read it, and the recipient can forward it without a second thought. If a message goes to the wrong address, for instance because of autocomplete in Outlook, its contents are immediately with the wrong person.
For personal data, the GDPR requires appropriate security. For data such as a citizen service number (BSN), a copy of an ID document, salary details or medical information, sending it encrypted is a sensible and demonstrable measure. A password-protected zip file, with the password in the same or the next email, does not offer that protection.
What Message Encryption does
Microsoft Purview Message Encryption encrypts the message itself and its Office attachments, and attaches rights to it. Only the recipients you addressed can open it. In Outlook, staff choose between two standard options:
- Encrypt. The message stays encrypted and only the addressees can read it. Suitable for most sensitive messages.
- Do Not Forward. The message is encrypted and the recipient also cannot forward, print or copy it. Useful for a payslip or confidential advice, for example.
Staff find these options in Outlook when composing a message, under Options or via the Encrypt button. If you use sensitivity labels, you can also link encryption to a label, so staff only need to pick ‘Confidential’.
What the recipient sees
A recipient who uses Outlook with Microsoft 365 opens the message like any other. A recipient with a different email address, such as Gmail or their own domain at another provider, receives a message with a button to read it. That opens a secure Microsoft web page, where the recipient signs in with a Google or Microsoft account, or receives a one-time passcode by email. They can also reply securely from there.
Explain this in advance to clients receiving it for the first time. An unexpected email saying ‘click here to read your message’ looks like phishing. A short sentence in the covering text or on your website stops the recipient from ignoring the message or calling you to check.
Encrypting automatically with rules
Staff sometimes forget the button. A mail flow rule in the Exchange admin center therefore encrypts messages automatically. Common rules for SMEs:
- A set word in the subject. If the subject contains, for example, [encrypt], the message is encrypted. Easy to explain and to remember.
- Specific senders or departments. All external email from payroll or HR goes out encrypted.
- Sensitive content. With data loss prevention, Microsoft 365 can recognise things like citizen service numbers or IBANs and encrypt or block such messages.
Licences and limits
Message Encryption is included as standard in Microsoft 365 Business Premium and in the E3 and E5 plans. With Business Basic or Business Standard you need an additional licence; that is one of the points to weigh when choosing a plan. Extra features, such as an expiry date on encrypted messages or revoking a sent message, fall under Advanced Message Encryption and require an E5 licence or an add-on.
Encryption is not always the best fit. For large files or a file you work on together, a sharing link for specific people only is often more practical; see also our guide to external sharing in SharePoint and OneDrive. If you work in Dutch healthcare, additional arrangements often apply, such as the NTA 7516 standard for secure email containing medical data. And encryption says nothing about whether the sender is genuine; for that you need SPF, DKIM and DMARC.
How Floor ICT handles this
Floor ICT first checks whether your licences include Message Encryption and whether it is active in your tenant. Together with you, we decide which data must always be encrypted, build the mail flow rules and, where you want it, the link with sensitivity labels. We test with a recipient outside Microsoft 365, so you know what your client will see, and give staff a short guide: when to encrypt, when to use Do Not Forward and when to use a sharing link. As part of our managed service, we adjust the rules whenever the way you work changes.