"Encrypt this email" usually means one of two different things in Outlook, and they work differently. Here's how to use each one, and when.

Option 1: Microsoft 365 Message Encryption (Easiest)

If your business uses Microsoft 365 (Business Premium, E3, E5, or with the Azure Information Protection add-on), built-in message encryption is the simplest option and works even if the recipient uses Gmail, Yahoo, or any other email provider.

1. Start a new email in Outlook.
2. Click the Options tab on the ribbon.
3. Click Encrypt, then choose one of the presets your organization has set up — typically Encrypt, Encrypt & Prevent Forwarding, or, if sensitivity labels are configured, a label like Confidential.
4. Write your email and hit Send as normal.

If the recipient is outside your organization, they'll get an email with instructions to view it securely — either by signing in with a Microsoft or Google account, or by requesting a one-time passcode. Recipients inside your organization won't notice anything different; it just opens.

Option 2: S/MIME (Certificate-Based Encryption)

S/MIME provides end-to-end encryption backed by digital certificates, but it only works if both you and the recipient already have certificates set up and have exchanged them (usually by first sending each other a digitally signed email). It's most common between organizations with an existing internal PKI or that regularly exchange sensitive documents.

1. Obtain a digital certificate from your IT admin or a certificate authority, and make sure it's installed in Windows.
2. In Outlook, go to File > Options > Trust Center > Trust Center Settings > Email Security.
3. Under Encrypted email, select your certificate, then check Add digital signature to outgoing messages and/or Encrypt contents and attachments for outgoing messages if you want these applied by default.
4. To encrypt a single message instead, compose the email, click the Options tab, and click the Encrypt button (S/MIME) before sending.

Common Questions

Isn't email already encrypted in transit?

Most providers use TLS to encrypt email between mail servers, which protects it in transit, but the message can still sit unencrypted on servers along the way. Message encryption (OME or S/MIME) protects the content itself, not just the connection it travels over.

What if the recipient can't open the encrypted email?

With Microsoft 365 Message Encryption, they can always fall back to a one-time passcode sent to their email address — no account or software required. S/MIME has no such fallback: if the recipient doesn't have a compatible certificate set up, they simply can't decrypt the message, so confirm their setup first for anything time-sensitive.

Can I stop a recipient from forwarding an encrypted email?

Yes — choose Encrypt & Prevent Forwarding (or an equivalent "Do Not Forward" sensitivity label) instead of plain Encrypt when sending through Microsoft 365 Message Encryption.