What Most People Miss About Outlook Attachment Encryption

No, Outlook attachments are not automatically encrypted when you send an email. But that’s only half the story — because *how* and *where* encryption kicks in depends entirely on what you’ve configured, who you’re sending to, and whether you’re using desktop Outlook, Outlook for Mac, or Outlook on the web.

The Short Version

Method	Encrypts Attachments?	Pros	Cons
S/MIME signing + encryption	Yes — but only if recipient has cert & you encrypt manually	End-to-end, client-side, works offline	Requires certs on both sides; no fallback; fails silently if cert missing
Microsoft Purview Message Encryption (OME)	Yes — but only if policy applies *and* attachment is under 25 MB	Works cross-platform; no cert setup; recipient gets portal link	Attachments over 25 MB bypass encryption; OWA may skip encryption on large files
File-level encryption (e.g., ZIP + password)	Yes — but only if you do it yourself, outside Outlook	No infrastructure needed; works with any recipient	No audit trail; password delivery is insecure; violates most compliance policies
OneDrive/SharePoint links instead of attachments	Indirectly — file stays encrypted at rest; link permissions apply	No size limit; full version history; DLP & sensitivity labels apply	Recipient must have access to your tenant; external sharing must be enabled

Method 1: S/MIME signing and encryption

This is the oldest method — and the only one that truly encrypts the entire message *and* its attachments before leaving your machine. Do this: File > Options > Trust Center > Trust Center Settings > Email Security > Import/Export Settings. Install your personal certificate. Then, when composing, click Options tab > Encrypt. Or use Alt+H, E, C. But here’s what most miss: S/MIME does *not* encrypt unless the recipient’s public key is in your Contacts or Global Address List. If their cert isn’t cached locally, Outlook won’t warn you — it just sends unencrypted. Also: On Outlook for Mac (v16.83+), S/MIME encryption is supported, but signing only works if you use Apple Keychain certificates — not Windows-based PKI certs. And Outlook on the web? It doesn’t support S/MIME encryption at all. Only signing. Test it: Send a test email to yourself. Open the received message, right-click the lock icon in the header, choose “View Certificate.” If it says “Encrypted” and shows your cert *and* the recipient’s cert, it worked. If it only shows your cert, it didn’t.

Method 2: Microsoft Purview Message Encryption (OME)

This is what most enterprises use now. But it’s not automatic — it’s policy-driven. Go to the Microsoft Purview compliance portal > Solutions > Information Protection > Encryption > Create policy. Set conditions like “If subject contains ‘confidential’” or “If attachment name contains ‘_PII’”. Apply to mailboxes. Important: OME *only* triggers on messages sent via Exchange Online. If you’re using Outlook connected to an on-premises Exchange Server (2016/2019), OME won’t apply — even if your tenant has a license. Also: Attachments over 25 MB get stripped from encryption and sent as plain links — with no warning. You’ll see “Some attachments were removed due to size” in the sent item, but only if you open the sent message and check the Info panel (F12). Surprising tip: OME doesn’t encrypt embedded images in HTML bodies — only file attachments. So if you paste a screenshot directly into the message, it stays unencrypted. Save it as a .png first and attach it. On Outlook for Mac, OME works, but the encryption badge in the message header is smaller and easy to miss. On Outlook on the web, look for the shield icon next to the sender’s name — not in the subject line.

Method 3: OneDrive/SharePoint links instead of attachments

This is the most reliable method — and the one Microsoft quietly pushes in every security advisory since 2022. Instead of attaching a file, click Insert tab > Attach File > Browse Cloud Locations. Pick a file from OneDrive or SharePoint. Choose “Link to the file” (default) — not “Insert as attachment.” That link points to a file stored in your tenant. The file stays encrypted at rest (AES-256), and access is governed by SharePoint permissions or sensitivity labels. You can even set expiration dates and disable downloads — something impossible with traditional attachments. But here’s the catch: If the recipient is external and your org blocks anonymous links, the message bounces. Check your Sharing settings in SharePoint Admin Center > Policies > Sharing. Set “Anyone” links to “Existing guests only” if you want tighter control. Folder paths matter. If you upload to Clients/Acme Corp/Contracts/2024, and apply a “Confidential – Legal” sensitivity label there, that label travels with the link — even if the email itself has no label. Outlook desktop (365 & 2021) supports this natively. Outlook 2019? Only if you install the OneDrive sync app and enable “Files On-Demand.” Outlook for Mac v16.75+ supports it — but doesn’t show sensitivity label badges in the message preview.

Which Should You Choose?

Pick based on your real-world constraints — not marketing brochures.

Your Situation	Best Method	Why	What to Do Next
You send sensitive files to external partners with no IT team	OneDrive/SharePoint links	No certs, no portals, no password sharing — just a working link	Upload to Projects/2024/Q3, apply “External – Confidential” label, insert as link
You’re in healthcare or finance, need audit logs & FIPS compliance	S/MIME + manual encryption	Full end-to-end control; logs show exact cert used; meets HIPAA/FISMA requirements	Verify certs are installed in Outlook > File > Options > Trust Center > Email Security > Settings
You manage 500 users and need consistent enforcement	Purview OME + transport rule	Policy applies regardless of user action; integrates with DLP; reports in Compliance Center	Create rule: “If attachment extension is .xlsx AND subject contains ‘payroll’ → apply OME template”
You use Outlook 2016 or older, no cloud services	ZIP + password (last resort)	Only option that works offline without certs or internet	Never reuse passwords. Use 7-Zip with AES-256. Send password via SMS or Teams — never email.