Office 365 Message Encryption FAQ – Office Support

Have a question about how the new message protection capabilities in Office 365 work? Check for an answer here. Also, take a look at Frequently asked questions about data protection in Azure Information Protection for answers to questions about the data protection service, Azure Rights Management, in Azure Information Protection.

OME combines email encryption and rights management capabilities. Rights management capabilities are powered by Azure Information Protection.

You can use the new capabilities for OME under the following conditions:

If you have never set up OME or IRM for Exchange Online in Office 365.

If you have set up OME and IRM, you can use these steps if you are using the Azure Rights Management service from Azure Information Protection.

If you are using Exchange Online with Active Directory Rights Management service (AD RMS), you can't enable these new capabilities right away. Instead, you need to migrate AD RMS to Azure Information Protection first. When you've finished the migration, you can successfully set up OME.

If you choose to continue to use on-premises AD RMS with Exchange Online instead of migrating to Azure Information Protection, you will not be able to use these new capabilities.

To use the new OME capabilities, you need one of the following plans:

Office365 Message Encryption is offered as part of Office 365 E3 and E5, Microsoft E3 and E5, Office 365 A1, A3, and A5, and Office 365 G3 and G5. Customers do not need additional licenses to receive the new protection capabilities powered by Azure Information Protection.

You can also add Azure Information Protection Plan1tothe followingplans to receive the new Office 365 Message Encryption capabilities: Exchange Online Plan 1, Exchange Online Plan 2, Office 365 F1,Office 365 Business Essentials, Office 365 Business Premium, or Office 365 Enterprise E1.

Each user benefiting from Office 365 Message Encryption needs to be licensed to be covered by thefeature.

For the full list see the Exchange Online service descriptions for Office 365 Message Encryption.

Yes! Microsoft recommends that you complete the steps to set up BYOK before you set up OME.

For more information about BYOK, see Planning and implementing your Azure Information Protection tenant key.

No. OME and the option to provide and control your own encryption keys, called BYOK, from Azure Information Protection were not designed to respond to law enforcement subpoenas. OME, with BYOK for Azure Information Protection, was designed for compliance-focused customers. Microsoft takes third-party requests for customer data very seriously. As a cloud service provider, we always advocate for the privacy of customer data. In the event we get a subpoena, we always attempt to redirect the third party to the customer to obtain the information. (Please read Brad Smiths blog: Protecting customer data from government snooping). We periodically publish detailed information of the request we receive. For more information regarding third-party data requests, see Responding to government and law enforcement requests to access customer data on the Microsoft Trust Center. Also, see Disclosure of Customer Data in the Online Services Terms (OST).

The new capabilities for Office 365 Message Encryption are an evolution of the existing IRM and legacy OME solutions. The following table provides more details.

Capability

Previous versions of OME

IRM

New OME capabilities

Sending an encrypted email

Only through Exchange mail flow rules

End-user initiated from Outlook for PC, Outlook for Mac, or Outlook on the web; or through Exchange mail flow rules

End-user initiated from Outlook for PC, Outlook for Mac, or Outlook on the web; or through mail flow rules

Rights management

-

Do Not Forward option and custom templates

Do Not Forward option, encrypt-only option, default and custom templates

Supported recipient type

External recipients only

Internal recipients only

Internal and external recipients

Experience for recipient

External recipients received an HTML message which they downloaded and opened in browser or downloaded mobile app.

Internal recipients only received encrypted email in Outlook for PC, Outlook for mac, and Outlook on the web.

Internal and external recipients receive email in Outlook for PC, Outlook for Mac, Outlook on the web, Outlook for Android, and Outlook for iOS, or through a web portal regardless of whether or not they are in the same Office 365 organization or any Office 365 organization. The OME portal requires no separate download.

Bring Your Own Key support

Not available

Not available

BYOK supported

See Set up new Office 365 Message Encryption capabilities.

You can still use the previous version of OME, it will not be deprecated at this time. However, we highly encourage organizations to use the new and improved OME solution. Customers that have not already deployed OME cannot set up a new deployment of the previous version of OME.

No. If you are using Exchange Online with Active Directory Rights Management service (AD RMS), you can't enable these new capabilities right away. Instead,you need to migrate AD RMS to Azure Information Protection first.

Today, the sender needs to be in Exchange Online. We plan to support other topologies in the coming months.

You can create protected messages from Outlook 2016, and Outlook 2013 for PC and Mac, and from Outlook on the web.

You can read and respond from Outlook for PC and Mac (2013 and 2016), Outlook on the web, and Outlook mobile (Android and iOS) if you are an Office 365 user. You can also use the iOS native mail client if your organization allows it. If you are a non-Office 365 user, you can read and reply to encrypted messages on the web through your web browser.

You can attach any file type to a protected mail, however protection policies are applied only on the file formats mentioned here.

If a file format is supported, such as a Word, Excel, or PowerPoint file, the file is always protected, even after the attachment has been downloaded by the recipient. For example, if an attachment is protected by Do Not Forward, and the original recipient downloads and forwards the attachment to a new recipient, the new recipient will not be able to open the protected file.

If you attach a PDF file to a protected message, the message itself will be protected, but no additional protection will be applied to the PDF file after the recipient has received it. This means that the recipient can Save As, Forward, Copy, and Print the PDF file.

Not yet. OneDrive for Business attachments are not supported and end-users can't encrypt a mail that contains a cloud OneDrive for Business attachment.

Yes. Use mail flow rules in Exchange Online to automatically encrypt a message based on certain conditions. For example, you can create policies that are based on recipient ID, recipient domain, or on the content in the body or subject of the message. See Define mail flow rules to encrypt email messages in Office 365.

Currently you can only set up mail flow rules in Exchange Online. Encryption is currently not supported in DLP through the Security & Compliance Center.

Yes! For information on customizing email messages and the OME portal, see Add your organization's brand to your encrypted messages. See Add your organization's brand to your encrypted messages.

Not at this time but coming soon.

Yes. All encrypted email messages are discoverable by Office 365 compliance features.

Read more:
Office 365 Message Encryption FAQ - Office Support