Skip to content
T-Minus 365Try CloudCapsule

Set Up Office 365 Encryption

Nick Ross · Updated

Set Up Office 365 Encryption

1. Key Components

Licensing

  • Azure Information Protection Add-On
  • E3 or greater
  • EMS+E3 or greater
  • Office 365 G3 and G5
  • Microsoft E3 and E5
  • Office 365 A1, A3, and A5

Can send encrypted messages inside AND outside your organization (opens in new tab)

  • Google
  • Yahoo
  • AOL
  • Hosted Exchange

Admin Rights

  • Set up transport rules that define the conditions for encryption
  • When a user sends a message that matches a rule, encryption is applied automatically.

Viewing Encrypted Messages (opens in new tab)

  1. One-time passcode
  2. Sign in with a Microsoft/Google/Yahoo account
  3. Sign in with a work or school account associated with Office 365

Recipients can also send encrypted replies without an Office 365 Subscription

Data At Rest

  • Refers to data that isn’t actively in transit
  • In Office 365, email data at rest is encrypted using BitLocker Drive Encryption
  • BitLocker encrypts the hard drives in Office 365 datacenters to provide enhanced protection against unauthorized access

2. Activation

Admin Center

  1. After you have the proper licensing, Login to Office.com
  2. Click on the Admin Tile

Settings

Go to Settings>Services & Add-Ons

Find Azure Information Protection

Manage Settings

  1. Click Manage Microsoft Azure Information Protection Settings

Activate

  1. Click Activate

3. Set Up Transport Rules

Admin Center

  1. After you have the proper licensing, Login to Office.com
  2. Click on the Admin Tile

Go to the Exchange Admin Center

Go to Admin Centers>Exchange

Add A New Mail Flow Rule

  1. Click MailFlow>Rules
  2. Click on the + Icon
  3. Click Apply Office 365 Message Encryption

Create a New Policy to Auto-Apply Encryption

  • The fields get very granular for your if then statements
  • Apply polices based on senders, recipients, sensitive information, subject line, etc

4. Send and View Encrypted Messages Office 365

Outlook on the Web

  1. After you draft a new message in OWA you can click on the protect button at the top of the page
  2. You will then be able to select “Change Permissions”

Outlook on the Web

  1. After you draft a new message in OWA you can click on the protect button at the top of the page
  2. You will then be able to select “Change Permissions”

Go to the Exchange Admin Center

From there you can choose to encrpt the message

Viewing Messages

  1. Encrypted Messages can only be viewed in OWA, Outlook for iOS, and Outlook for Android unless you are a member of the Office Insider (opens in new tab) program
  2. The message will contain a lock icon and not have any preview funcitonality
  3. Once the message is opened, it can be read just like any other message

Create a New Policy to Auto-Apply Encryption

  • The fields get very granular for your if then statements
  • Apply polices based on senders, recipients, sensitive information, subject line, etc

4. Send and View Encrypted Messages Office 365

Outlook on the Web

  1. After you draft a new message in OWA you can click on the protect button at the top of the page
  2. You will then be able to select “Change Permissions”

Outlook on the Web

  1. After you draft a new message in OWA you can click on the protect button at the top of the page
  2. You will then be able to select “Change Permissions”

Go to the Exchange Admin Center

From there you can choose to encrpt the message

Viewing Messages

  1. Encrypted Messages can only be viewed in OWA, Outlook for iOS, and Outlook for Android unless you are a member of the Office Insider (opens in new tab) program
  2. The message will contain a lock icon and not have any preview funcitonality
  3. Once the message is opened, it can be read just like any other message

5. View Encrpted Message from outside 365

Non-365 Accont

  1. You will receive a message in your inbox like the following if you are on Google, Yahoo, etc

Select your Option

  1. Sign in to view the message
  2. Get One Time Passcode

Get One Time Code

  1. Check your email for the single-use code and copy it.
  2. Enter the code in your browser, then select Continue to read your message.
  3. Code Expires in 15 Min

Spread the word and Ask any questions below!

Facebook (opens in new tab) Twitter (opens in new tab)

Harden it once, then know it stays that way.

CloudCapsule scans 300+ Microsoft 365 security controls in about a minute, shows what to fix first, fixes findings at scale, and flags drift the day a setting changes.

Try CloudCapsule for Free

No credit card required. Results in < 2 minutes.

Learn More at CloudCapsule.io

The weekly update

One email a week with what changed in Microsoft 365, plus new guides and videos.

Unsubscribe anytime. Privacy Policy

Keep reading

How to Set Up Claude SSO with Microsoft Entra ID (10-Minute Guide)

AI

TLDR: You can set up Claude single sign-on (SSO) with Microsoft Entra ID in about 10 minutes on a paid Claude Team or Enterprise plan. The process has three parts: verify your company domain in Claude, connect Claude to Entra through Claude’s guided setup, and control access by assigning users or groups in Entra. Once […]

How to secure Claude AI for your Business

AI

An employee opens Claude on their laptop. It is free, it is fast, and within ten minutes they have pasted in a contract, a financial summary, and a list of customer records, all because they are trying to get their job done. No audit trail. No admin visibility. And depending on their account settings, that […]

How Attackers wiped 80,000 Devices in Microsoft 365

Security

On March 11th, 2026, employees at Stryker began their day to blank screens. Within three hours, roughly 80,000 devices had been wiped across the company’s 61-country footprint. Not encrypted. Not ransomed. Erased. No malware was involved. An Iran-linked hacktivist group compromised an admin account and used Microsoft’s own Intune remote wipe capability to erase the […]