In short: Email encryption protects the content of messages so only the intended recipient can read them. Options range from TLS, which encrypts the connection between mail servers, to secure web portals, encrypted PDFs, and S/MIME or PGP certificates. Microsoft 365 includes Microsoft Purview Message Encryption; dedicated services such as Echoworx add more delivery methods and branding.
Why encrypt email
Ordinary email is not designed to be private. Messages can cross several servers, can be sent in clear text if a receiving server does not support encryption, and are easy to forward or send to the wrong person. For organisations handling personal data, that creates real risk.
UK GDPR requires appropriate technical and organisational measures to protect personal data, and Article 32 names encryption as an example. The ICO's guidance treats encryption as a standard safeguard, and its personal data breach guidance gives sending personal data to an incorrect recipient as an example of a breach. Regulated sectors, including legal, financial services, healthcare and the public sector, often have contractual or professional requirements on top.
Encryption works best when it does not depend on staff remembering. Policy-based encryption, triggered automatically by recipient, content or a data loss prevention rule, is more reliable than asking people to tick a box.
The encryption methods compared
| Method | What is protected | Recipient experience | Best for |
|---|---|---|---|
| TLS (opportunistic) | The connection between mail servers, if both support it | Nothing to do; mail arrives normally | Baseline for all mail |
| Enforced TLS | The connection, with delivery refused or rerouted if TLS is unavailable | Nothing to do | Regular partners whose servers you know support TLS |
| Secure web portal | The message and attachments, held in a portal | Follow a link, sign in or use a one-time code, read and reply securely | Clients, patients and the public, on any email service |
| Encrypted PDF or attachment | The documents, protected by a password | Open the file with a password in any PDF or Office app | Statements, payslips and contracts sent in bulk |
| S/MIME | The message itself, end to end, using certificates | Seamless once both sides have certificates | Organisations exchanging mail with partners who already use S/MIME |
| PGP | The message itself, end to end, using key pairs | Needs PGP software or a service that manages keys | Technical and security teams, some regulated exchanges |
TLS is necessary but not sufficient on its own: it protects mail in transit between servers but not once it is stored, and opportunistic TLS falls back to clear text if the other side does not support it. Better services use TLS where it is available and fall back automatically to a portal or encrypted PDF where it is not, so a sensitive message is never sent in the clear.
Microsoft Purview Message Encryption
Microsoft 365 includes Microsoft Purview Message Encryption, built on the Azure Rights Management service within Microsoft Purview Information Protection. It replaced the older Office 365 Message Encryption, which Microsoft deprecated on 1 July 2023.
- Users can encrypt from Outlook with options such as Encrypt-Only and Do Not Forward, or with sensitivity labels
- Administrators can create Exchange mail flow rules that encrypt automatically, for example for messages to certain recipients or containing certain keywords
- Microsoft 365 recipients read encrypted mail natively in Outlook; recipients on Gmail, Yahoo and other services get a message that links to an encrypted message portal, where they sign in with a Microsoft, Google or Yahoo account or a one-time passcode
- Microsoft Purview Advanced Message Encryption adds multiple branding templates, automatic policies based on sensitive information types, expiry dates and the ability to revoke access to mail sent outside the organisation, plus portal access logs
Message Encryption is included in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, and Office 365 E3 and E5. Business Basic, Business Standard and Office 365 E1 can get it by adding Azure Information Protection Plan 1. Advanced Message Encryption comes with higher-tier licences such as Microsoft 365 E5, Office 365 E5 and the Microsoft Purview Suite. Check your licences with Forever Group's Microsoft licensing team, and see our Microsoft Purview guide for labelling and DLP.
Echoworx Email Encryption
Echoworx is a dedicated, cloud-hosted encryption service that sits alongside Microsoft 365 or Google Workspace. In Microsoft 365, outbound mail that needs encrypting is routed to Echoworx by an Exchange mail flow rule, with no MX change; Google Workspace and common secure email gateways are supported too. Senders can also encrypt on demand with a web-based Outlook add-in or a Gmail add-on. We supply it in two editions:
| Capability | Echoworx Email Encryption Standard | Echoworx Email Encryption Advanced |
|---|---|---|
| Rule-based encryption policies | Yes | Yes |
| TLS delivery with secure fallback | Yes | Yes |
| Secure web portal with secure reply | Yes | Yes |
| Inbound secure messages through the portal | Yes | Yes |
| Multi-language, multi-brand message templates | Yes | Yes |
| Encrypted PDF (body and attachments in one PDF) | - | Yes |
| Encrypted attachments (body readable, documents protected) | - | Yes |
| S/MIME and PGP certificate encryption | - | Yes |
| Portal branding (name, logo, company web address) | Separate one-off item | Separate one-off item |
Recipients can sign in to the portal with an existing Microsoft 365 or Google account, a passkey, or self-registered credentials with a text message or authenticator app code as a second step. Licensing detail is on Echoworx Email Encryption licensing.
Purview or a dedicated service: how to choose
Start with what you already own. If you have Business Premium or E3, Microsoft Purview Message Encryption costs nothing extra and is a sensible first step, especially if most recipients use Outlook or Microsoft 365.
A dedicated service is worth considering when:
- Many recipients are members of the public or small firms who struggle with Microsoft's portal
- You need encrypted PDF or attachment delivery for statements or payslips sent in volume
- Partners require S/MIME or PGP
- You want a branded portal for several brands or business units
- You use Google Workspace, or a mixture of mail platforms
Encryption is also built into several email security products we cover, including the higher packages of Proofpoint Essentials, IRONSCALES encryption and DLP modules, Hornetsecurity Email Encryption and Cisco Secure Email. If you already run one of these, compare its encryption with Purview before adding another tool.
How we help
We map what you send, who to and under which rules, then recommend Purview, a dedicated service or the encryption in your existing email security product. We build policies that encrypt automatically, set up branding and recipient sign-in, pilot with a small group and brief staff on when encryption applies. Pricing depends on the product, edition and user count: ask us for a quote.
Contact us to discuss email encryption.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft 365 email encrypted?
Microsoft 365 uses TLS to encrypt mail in transit where the receiving server supports it, and stores data encrypted at rest. That does not stop a message being read if it is sent to the wrong person or a server without TLS. For sensitive content, use Microsoft Purview Message Encryption or a dedicated encryption service.
What is the difference between TLS and email encryption?
TLS encrypts the connection between mail servers, so the message is protected in transit but stored in readable form at each end. Message-level encryption, such as a secure portal, encrypted PDF, S/MIME or PGP, protects the content itself so only the intended recipient can open it.
Does UK GDPR require email encryption?
UK GDPR requires appropriate security for personal data and names encryption as an example of an appropriate measure. It does not mandate encryption for every email, but for sensitive personal data sent outside the organisation, encryption is the expected safeguard.
How do recipients open an encrypted email?
It depends on the method. With a secure portal, they follow a link and sign in with an existing account or a one-time code. With an encrypted PDF they enter a password. Microsoft 365 users read Microsoft Purview encrypted mail directly in Outlook.
What does Microsoft Purview Advanced Message Encryption add?
It adds multiple branding templates, automatic encryption policies based on sensitive information types, expiry dates and revocation for mail sent outside the organisation, and logs of portal access. It comes with higher-tier licences such as Microsoft 365 E5 and the Microsoft Purview Suite.
Is Microsoft Purview Message Encryption included in Business Premium?
Yes. Microsoft Purview Message Encryption is included in Microsoft 365 Business Premium, E3 and E5. Business Basic and Business Standard need the Azure Information Protection Plan 1 add-on to use it.