Table of Contents

How to Send Securely in Outlook: A Veteran’s Guide

So, you want to send emails securely in Outlook? Excellent choice! In today’s digital landscape, safeguarding your communications isn’t just a good idea; it’s essential. The core of sending securely in Outlook revolves around encryption. You achieve this primarily through two methods: S/MIME (Secure/Multipurpose Internet Mail Extensions) and Microsoft Purview Message Encryption (formerly Azure Information Protection or AIP). Let’s break it down:

S/MIME: Think of S/MIME as your digital padlock and key. It uses public-key cryptography to encrypt and digitally sign your emails. Encryption scrambles your message so only the intended recipient with the correct key can read it. Digital signing assures the recipient that the email genuinely came from you and hasn’t been tampered with. To use S/MIME, you need to obtain a digital certificate (also known as a digital ID) from a trusted Certificate Authority (CA). Once you have the certificate, you install it in Outlook and configure your settings to use it for signing and/or encrypting emails.
Microsoft Purview Message Encryption: This is a cloud-based service that integrates seamlessly with Outlook. It allows you to send encrypted emails to anyone, regardless of whether they use Outlook or another email provider. When you use Microsoft Purview Message Encryption, recipients receive a secure link to view the email in a browser, where they can authenticate themselves and read the message. This is especially useful when sending sensitive information to recipients outside your organization. Microsoft Purview Message Encryption offers greater flexibility for senders and recipients.

Which method is right for you depends on your specific needs and technical expertise. S/MIME offers strong security but requires a bit more technical setup. Microsoft Purview Message Encryption is generally easier to use and is ideal for communicating with a wide range of recipients. Let’s dive deeper into the specifics.

Understanding S/MIME: Your Digital Lock and Key

Setting up S/MIME in Outlook

The first step is acquiring a digital certificate from a reputable Certificate Authority (CA). Numerous CAs offer these certificates, often for a fee. Once you’ve obtained your certificate:

Install the Certificate: This process varies depending on the CA and the format of your certificate. Typically, you’ll double-click the certificate file, and your operating system will guide you through the installation.
Configure Outlook: In Outlook, navigate to File > Options > Trust Center > Trust Center Settings > Email Security.
Import/Export: Here, you can import your digital certificate.
Encryption Settings: You can also configure your default settings for signing and encrypting emails. Choose your certificate for signing and encryption.
Set Default Preferences: Decide whether you want to digitally sign all outgoing messages by default or only when specifically requested. Similarly, you can choose to encrypt all messages to contacts who have provided you with their digital certificate.

Sending Encrypted Emails with S/MIME

Once S/MIME is set up, sending encrypted emails is straightforward:

Compose your email as usual.
Before sending, look for the “Sign” and “Encrypt” buttons in the message window (usually under the “Options” tab or in the ribbon).
Click the “Sign” button to digitally sign your email. This adds a digital signature to the message, verifying your identity to the recipient.
Click the “Encrypt” button to encrypt the email. This scrambles the content of the message so only the recipient with the corresponding private key can decrypt and read it.
Send your email.

Important Considerations:

To send an encrypted email using S/MIME, you need the recipient’s public key (digital certificate). If you don’t have it, you won’t be able to encrypt the message to them. Outlook usually handles this automatically if you’ve previously received a signed email from the recipient.
S/MIME relies on trust. You need to trust the Certificate Authority that issued the digital certificates being used.

Leveraging Microsoft Purview Message Encryption: Cloud-Powered Security

Activating and Configuring Microsoft Purview Message Encryption

Microsoft Purview Message Encryption is typically part of a larger Microsoft 365 subscription that includes security and compliance features. Assuming your organization has it enabled, you can use it directly from Outlook.

Ensure Activation: Your IT administrator needs to activate Microsoft Purview Message Encryption for your organization.
Sensitivity Labels: Your administrator can create sensitivity labels that automatically apply encryption based on the content of the email. For example, a label could automatically encrypt any email containing the words “Confidential” or “Private.”

Sending Encrypted Emails with Microsoft Purview Message Encryption

Compose your email in Outlook.
Apply Sensitivity Label (if applicable): If your organization uses sensitivity labels, select the appropriate label that includes encryption.
Permissions: To manually encrypt and set permissions, go to the Options tab in the message window. Then, select “Permissions.”
Choose Encryption Options: Select the desired level of encryption, such as “Encrypt-Only” or “Do Not Forward”. “Encrypt-Only” encrypts the email but allows recipients to copy and print. “Do Not Forward” restricts recipients from forwarding, printing, or copying the email content.
Send your email.

Recipients will receive a link to a secure portal where they can authenticate and read the message. This works regardless of their email provider.

Key Advantages:

Ease of Use: Microsoft Purview Message Encryption is generally easier to use than S/MIME, especially for recipients who are not familiar with digital certificates.
External Recipients: It works seamlessly with recipients outside your organization, even if they don’t use Outlook.
Centralized Control: Your IT administrator has centralized control over encryption policies and can track who is accessing encrypted emails.

Choosing the Right Method

The best method depends on your specific needs.

S/MIME: Ideal for secure communication with individuals or organizations that also use S/MIME and require strong authentication and non-repudiation. Good for internal teams needing high security.
Microsoft Purview Message Encryption: Ideal for sending sensitive information to a wide range of recipients, including those outside your organization. Better for general business needs and compliance.

Frequently Asked Questions (FAQs)

Here are answers to common questions about sending securely in Outlook:

What is a digital certificate, and where do I get one? A digital certificate is an electronic “ID card” that verifies your identity. You obtain one from a Certificate Authority (CA). Popular CAs include DigiCert, Sectigo, and GlobalSign. Some email providers or organizations may provide free or discounted certificates.
Do both the sender and recipient need a digital certificate for S/MIME? Yes, for fully encrypted communication using S/MIME, both the sender and recipient must have a digital certificate. However, you can still send a digitally signed email to someone without a certificate; they just won’t be able to send you an encrypted reply.
What happens if I send an encrypted email to someone who can’t decrypt it? With S/MIME, if the recipient doesn’t have the necessary key, they’ll see a garbled message and won’t be able to read the email. With Microsoft Purview Message Encryption, they’ll receive a link to a secure portal to authenticate and read the email.
Is Microsoft Purview Message Encryption the same as Azure Information Protection (AIP)? Yes, Microsoft Purview Message Encryption is the new name for the encryption capabilities that were previously part of Azure Information Protection (AIP). Microsoft often rebrands services to better reflect their functionality.
Can I use both S/MIME and Microsoft Purview Message Encryption at the same time? Yes, you can use both methods depending on the recipient and the sensitivity of the information you are sending. S/MIME for recipients within your organization needing extra security, Microsoft Purview for outside recipients for ease of use and accessibility.
How do I revoke a digital certificate if it’s been compromised? You need to contact the Certificate Authority that issued the certificate and request revocation. The CA will then add the certificate to a Certificate Revocation List (CRL), which will prevent it from being used.
What is Transport Layer Security (TLS), and how does it relate to secure email? TLS is a protocol that encrypts the communication channel between your email client (like Outlook) and the email server. It protects your email while it’s in transit. Most modern email providers use TLS by default. TLS helps safeguard against eavesdropping but doesn’t encrypt the content of the email itself like S/MIME or Microsoft Purview Message Encryption.
Are there any limitations to using email encryption? Yes, some limitations exist. Encryption can make it difficult for archiving and compliance solutions to scan email content. Also, search capabilities within encrypted emails may be limited.
How do I know if an email I received is encrypted? In Outlook, encrypted emails often display an icon (like a padlock) in the message list or header. If you’re using S/MIME, Outlook will automatically decrypt the message if you have the corresponding private key. If you’re using Microsoft Purview Message Encryption, you’ll see instructions on how to access the message via the secure portal.
Does encryption protect against phishing attacks? While encryption protects the confidentiality of your messages, it doesn’t directly protect against phishing attacks. Phishing attacks often rely on social engineering and deceptive tactics to trick you into revealing sensitive information. Always be cautious of suspicious emails, even if they are encrypted.
How can I ensure my emails are compliant with data privacy regulations like GDPR or HIPAA? Using email encryption is an important step in complying with data privacy regulations. However, you should also implement other security measures, such as data loss prevention (DLP) policies and access controls. Consult with legal counsel to ensure full compliance.
Is there a cost associated with using Microsoft Purview Message Encryption? Microsoft Purview Message Encryption is typically included in certain Microsoft 365 subscription plans. Check your organization’s licensing agreement to determine if you have access to this feature. If not, you might need to purchase a specific subscription or add-on.

By understanding these methods and FAQs, you’re well on your way to sending secure emails in Outlook. Remember, security is a continuous process. Stay informed, stay vigilant, and keep those digital communications safe and sound!