Knowledge Base ecs.rocks

How to send an encrypted email with Outlook and Azure Information Protection

Azure Information Protection (AIP) is a cloud-based service from Microsoft that helps organizations classify, label, and protect its documents and emails.

3 min read Filed underEmailEncryptionSecurity
On this pagePrerequisites8 sections

This can be integrated with Outlook to send encrypted emails, ensuring only authorized individuals can read the contents.

Prerequisites

  1. Subscription: You need an Office 365 subscription that includes Outlook and Azure Information Protection.  Alternatively, you can procure a standalone license for the features.
  2. Azure Information Protection: You need to have Azure Information Protection set up. Check Microsoft's official documentation for more information on how to set it up.

Steps to Encrypt an Email

Encrypt an Email using Outlook

  1. Open Outlook and start composing a new email.
  2. In the Options tab, click on the Encrypt button
  3. From the dropdown list, select the level of protection you want for your email.  These are what the defaults mean:
    1. Encrypt-Only:  Encrypts the message and its contents
    2. Do Not Forward:  Encrypts the content and restricts it to be viewed only by the original recipients. Recipients cannot forward, print, or copy the content.
    3. Confidential \ All Employees: Encrypts and allows users within the same organization limited access rights 
    4. Highly Confidential \ All Employees: Encrypts and allows users within the same organization even more limited access rights
    5. Described further here: https://learn.microsoft.com/en-us/previous-versions/azure/information-protection/configure-policy-templates

Encrypt an Email using Outlook Web App

  1. Open your browser and log into Outlook Web App.
  2. Click on New to compose a new email.
  3. In the Options tab, click the lock icon 
  4. Choose the level of protection you want for your email:
    1. Encrypt-Only:  Encrypts the message and its contents
    2. Do Not Forward:  Encrypts the content and restricts it to be viewed only by the original recipients. Recipients cannot forward, print, or copy the content.
    3. Confidential \ All Employees: Encrypts and allows users within the same organization limited access rights 
    4. Highly Confidential \ All Employees: Encrypts and allows users within the same organization even more limited access rights
    5. Described further here: https://learn.microsoft.com/en-us/previous-versions/azure/information-protection/configure-policy-templates

Please note, the recipient must have permissions to decrypt and read the email. If they're using Outlook (or a compatible application), the process is seamless. If they're not, they'll get instructions on how to decrypt the email.

 

What does it look like for the recipient?

As long as their email provider supports it, encrypted emails are delivered seamlessly.  Otherwise, they will receive an email containing a link to a secure portal to view the message. The message also contains instructions for message retrieval.

 

Conclusion

Azure Information Protection and Outlook together provide a powerful tool for ensuring email privacy and security. By setting the correct permissions, you can ensure that your confidential and sensitive emails can only be read by the intended recipients.