Stop Assuming Outlook Emails Are Encrypted — They’re Not

The first thing most people do when they hear ‘HIPAA-compliant email’ or ‘secure message’ is hit Send — assuming Outlook handles encryption automatically. That’s dangerously wrong. I watched a compliance officer at a midsize health tech firm get flagged for sending unencrypted PHI to a vendor because she thought ‘Outlook 365 = secure’. It wasn’t. And nothing in the interface tells you that.

Quick Answer

No — Outlook emails are never encrypted by default, whether you're using Outlook for Windows (2016/2019/365), Outlook for Mac, or Outlook on the web. Encryption only happens if you manually enable it per message (S/MIME or Microsoft Purview Message Encryption), or if your organization has enforced transport encryption via Exchange Online Protection policies — but even then, the recipient’s client may not decrypt it properly.

All the Methods

Method	Steps	Best For	Limitations
S/MIME signing & encryption	Install cert → File > Options > Trust Center > Trust Center Settings > Email Security → set defaults → check 'Encrypt contents and attachments'	Internal org comms with known S/MIME-capable recipients	Fails silently if recipient lacks cert or uses Gmail/Apple Mail; no fallback
Microsoft Purview Message Encryption (MIP)	Enable policy in Microsoft 365 Compliance Center → apply label or use 'Encrypt' button in compose window	External recipients, regulated industries (healthcare, finance)	Recipient gets portal link + auth prompt; mobile UX is clunky; no offline decryption
TLS transport encryption (server-to-server)	Configured at Exchange Online level (no user action); depends on recipient domain supporting TLS	Bulk internal mail, non-sensitive external traffic	Not end-to-end — only protects in transit; stops at recipient’s mail server
Third-party add-ins (e.g., Virtru, Zix)	Install add-in → click toolbar button → choose encryption level → send	Teams needing consistent cross-platform encryption (web/mobile/desktop)	Requires separate license; adds latency; some break Outlook’s native UI
Manual password-protected ZIP + separate password via SMS	Attach files → compress with password → send ZIP → text password separately	One-off sensitive file shares (e.g., signed contracts)	User error prone; no audit trail; violates many DLP policies

Method Details

S/MIME — The quietest trap. You can turn it on globally in File > Options > Trust Center > Trust Center Settings > Email Security, but here’s what nobody tells you: Outlook won’t warn you if the recipient’s certificate is missing or expired. It just sends the message unencrypted, and shows no indicator. You’ll think it worked — until an auditor asks for proof. Test it: send to yourself using two different accounts (one with cert, one without). Watch the lock icon disappear in the sent item. Purview Message Encryption — works, but looks broken. In classic Outlook (365/2019), click Options > Encrypt before sending. In new Outlook for Windows (v1.2024+), it’s under More actions > Encrypt. The recipient gets a message in their inbox saying “This message is protected” — then clicks through to a Microsoft login page. If they’re on an iPhone, they’ll likely tap the link, land on Edge Mobile, and get stuck. The workaround? Tell them to open it in Chrome or Safari *first*. Yes — really. TLS isn’t encryption you control. It’s negotiated between mail servers. You can verify if it happened by opening the original message in Outlook desktop → right-click header → Properties > Details tab > Internet headers. Look for Received: from [domain] ([ip]) by [yourdomain] with TLS. But again — this only covers the hop between servers. Once it hits the recipient’s mailbox, it’s plain text.

Keyboard Shortcuts

Action	Classic Outlook Shortcut	New Outlook Shortcut	Notes
Open Options dialog	Alt+F+T	Not available (settings in sidebar)	Classic only
Toggle Encrypt button	Alt+S+E	Alt+H+E	Works in compose window only
View message properties	Alt+Enter	Not supported	Critical for verifying TLS
Send encrypted reply	Ctrl+R, then Alt+S+E	Ctrl+R, then Alt+H+E	Only works if original was MIP-encrypted

Cheat Sheet

What You Want	Do This	Verify It Worked	Version Notes
Encrypt one message externally	Click Options > Encrypt (classic) or More actions > Encrypt (new)	Check sent item: lock icon visible + subject says “Encrypted”	New Outlook requires M365 E3/E5 license
Set S/MIME as default	File > Options > Trust Center > Email Security > ‘Encrypt contents and attachments’ + ‘Add digital signature’	Open sent message → Alt+Enter → look for ‘S/MIME Encrypted’ in security info	Does NOT work in Outlook for Mac or web
Confirm TLS was used	Open original message → Alt+Enter → Details tab → scroll to ‘Internet headers’	Look for ‘with TLS’ or ‘with ESMTPS’ near last ‘Received:’ line	Not possible in new Outlook or OWA
Force encryption for all outbound	Admin must create Transport Rule in Exchange Admin Center: ‘Apply encryption if recipient domain is external’	Test with external account — check message source for ‘X-Microsoft-Antispam-Message-Info’ containing ‘encryption’	Requires Exchange Online Plan 2 or EOP add-on