Email Encryption for Small Business: Microsoft 365 and Gmail

Most business email is already encrypted while it travels, through a technology called TLS, as long as the receiving mail server supports it. That protects the connection, not the message, and it happens only when both sides cooperate. To guarantee that a sensitive message can be read only by its intended recipient, you need message-level encryption. In Microsoft 365 that is Microsoft Purview Message Encryption, included in Business Premium and available as an add-on for Business Basic and Standard. In Google Workspace, the equivalent is client-side encryption, which is limited to a few higher editions.

This is general information, not legal advice.

Do You Need More Than Standard Email Security?

Work through these questions:

Question	If yes
Do you email patient information?	HIPAA’s Security Rule expects you to guard electronic patient information in transit, and encryption is the usual safeguard. See our HIPAA IT guide
Are you a tax preparer, mortgage broker, lender, or other firm under the FTC Safeguards Rule?	The rule requires you to encrypt customer information in transit over external networks, or use an alternative control approved in writing by your Qualified Individual. See our Safeguards Rule guide
Are you a California law firm?	State Bar Formal Opinion 2010-179 says an attorney must evaluate the security of a technology before using it for confidential client information, weighing factors such as the sensitivity of the information and the client’s instructions
Do you ever send Social Security numbers, bank details, ID scans, or payroll files?	No single rule may name email, but California’s breach laws center on unencrypted personal information, so message encryption or a secure portal is the prudent choice
Do customers send you card numbers by email?	Stop the practice. PCI DSS does not allow card numbers to be sent through unprotected messaging. Use a payment link. See our PCI DSS guide

If every answer is no, and your email is ordinary scheduling, quotes, and correspondence, default TLS plus good account security is a reasonable position. Whether a particular rule is satisfied by a particular setup is a question for your attorney or compliance adviser.

TLS vs. Message Encryption vs. End-to-End: What Is the Difference?

Type	What it protects	Where it stops protecting
TLS (Transport Layer Security)	The connection between mail servers while the message travels	The message sits readable in both mailboxes. If the receiving server does not offer TLS, the message may go out with no encryption at all
Message-level encryption (Purview Message Encryption)	The message and supported attachments themselves. The recipient must prove their identity to open it, and the sender can block forwarding	The email provider manages the keys by default, so it is not end-to-end in the strict sense
End-to-end encryption (S/MIME, Google client-side encryption)	The message is encrypted on the sender’s device and decrypted only on the recipient’s. The provider cannot read it	Requires certificates or a separate key service, which makes it harder to run and harder to use with outside recipients

Microsoft’s own documentation is direct about the limit of TLS: “TLS doesn’t encrypt the message, just the connection.” Exchange Online uses what is called opportunistic TLS, meaning it always tries TLS first, and by default sends the message without encryption if the recipient’s server does not support it. Gmail works the same way. Microsoft notes that opportunistic TLS is sufficient for most businesses, and that organizations with compliance requirements can force TLS for specific partners by setting up connectors.

Which Microsoft 365 Plans Include Message Encryption?

According to Microsoft’s Message Encryption FAQ, as of September 2026:

Plan	Purview Message Encryption
Microsoft 365 Business Premium	Included
Office 365 E3 and E5, Microsoft 365 E3 and E5	Included
Microsoft 365 Business Basic	Add Azure Information Protection Plan 1
Microsoft 365 Business Standard	Add Azure Information Protection Plan 1
Exchange Online Plan 1 or Plan 2, Office 365 E1 or F3	Add Azure Information Protection Plan 1

Each user who sends encrypted mail needs a license. The older product name, Office 365 Message Encryption (OME), was deprecated on July 1, 2023 and replaced by Purview Message Encryption, although some admin screens still use the old wording. Our comparison of Business Premium and Business Standard covers the other security features that come with the higher plan.

What It Does

Purview Message Encryption is built on Microsoft’s Azure Rights Management service. A sender, or an automatic rule, applies one of two main options:

• Encrypt-only. The message is encrypted, and the recipient can still forward, copy, or print it after opening.
• Do Not Forward. The message is encrypted, and the recipient cannot forward, print, or copy it.

What the Recipient Sees

• Recipients on Microsoft 365 using Outlook (desktop, Mac, web, iOS, Android) open the message normally, even if they are in a different organization.
• Gmail and Yahoo recipients receive a wrapper message with a link to Microsoft’s encrypted message portal, where they sign in with their Google or Yahoo account.
• Everyone else uses the same portal and can request a one-time passcode sent to their email address.

No software installation is needed. If a recipient reports that the passcode never arrived, Microsoft’s guidance is to check their junk folder and quarantine.

Limits to Know Before You Rely on It

• Size. The maximum encrypted message size, including attachments, is 25 MB.
• Attachments. Office files (Word, Excel, PowerPoint in the modern formats) are encrypted and stay protected after download. PDF attachments are encrypted only after an administrator enables it with Set-IRMConfiguration -EnablePdfEncryption $true. Older .doc, .xls, and .ppt formats are not supported.
• Cloud attachments. Links to SharePoint or OneDrive files are not encrypted by the message. Control those through the sharing settings on the file.
• Inbound mail. You cannot encrypt mail that others send to you. If customers send you sensitive documents, give them a secure upload link or portal.
• Revocation and expiration belong to Advanced Message Encryption, a separately licensed feature.

How Do You Set It Up in Microsoft 365?

For a small tenant the configuration itself is short. Most of the effort goes into deciding the rules and testing them.

1. Confirm licensing. In the Microsoft 365 admin center, go to Billing, then Licenses, and check that each sender has Business Premium or the Azure Information Protection Plan 1 add-on.
2. Verify the service is active. Microsoft says Azure Rights Management is activated automatically for most eligible plans. To confirm, connect to Exchange Online PowerShell and run Get-IRMConfiguration. The value of AzureRMSLicensingEnabled should be True. Then run Test-IRMConfiguration -Sender [email protected] -Recipient [email protected] and look for OVERALL RESULT: PASS.
3. Turn on PDF encryption with the command above if you send PDFs, which most offices do.
4. Show staff the manual option. In Outlook, a new message has an Encrypt button under Options, with Encrypt-only and Do Not Forward choices.
5. Create an automatic rule. Following Microsoft’s mail flow rule steps: in the Exchange admin center, go to Mail flow, then Rules, and create a new rule. Set the condition, for example the sender is inside the organization, the recipient is outside the organization, and the subject includes a keyword such as “secure”. Under “Do the following”, select “Modify the message security”, then “Apply Office 365 Message Encryption and rights protection”, and choose the Encrypt template.
6. Consider content-based rules. Data loss prevention (DLP) policies in the Microsoft Purview portal can detect patterns such as Social Security or account numbers and apply encryption automatically. Our overview of Microsoft Purview for small business explains what DLP can do.
7. Test with outside addresses. Send to a personal Gmail account and to a non-Microsoft business address. Open the message and every attachment type you normally send.
8. Write a one-paragraph staff instruction: what must be encrypted, how to trigger it, and what to tell a recipient who is confused by the portal.

What Are the Options in Google Workspace?

TLS by default. Gmail uses TLS whenever the other mail server supports it, and shows a warning icon when a recipient’s server does not. Administrators can require TLS for specific domains or addresses so that mail to a named partner is never sent unencrypted. When TLS is required and unavailable, the message is not delivered.

Client-side encryption (CSE). Google’s client-side encryption encrypts content in the browser before it reaches Google, with keys held in an external key service that your organization controls, so Google’s servers cannot decrypt it. As of September 2026 Google lists it for Frontline Plus, Enterprise Plus, Education Standard, and Education Plus. It is not available in the Business Starter, Standard, or Plus editions that most small offices use, and it requires setting up a key service and an identity provider.

Encrypted mail to any recipient. In October 2025 Google began rolling out the ability for CSE users to send end-to-end encrypted email to recipients on any provider, who open it through a restricted guest account. Google lists this for Enterprise Plus with the Assured Controls add-on.

Confidential mode is not encryption. Gmail’s confidential mode can set an expiration date and block forwarding or downloading. It does not add message encryption beyond TLS, so do not count it as an encryption control.

For an office on a Workspace Business edition that needs message-level encryption, the practical routes are a third-party encryption service that integrates with Gmail, or a secure client portal for documents so that sensitive files stay out of email entirely. If you are choosing between platforms and encrypted email is a requirement, that belongs in the Microsoft 365 versus Google Workspace decision.

When Is a Portal Better Than Encrypted Email?

Encrypted email suits occasional sensitive messages to many different people. A secure portal suits repeated document exchange with the same people: tax organizers, loan packages, patient intake forms, signed agreements. Many tax, legal, accounting, and practice management applications include one. Portals also solve the inbound problem, since customers can upload to you securely, and they avoid the 25 MB limit.

S/MIME, the certificate-based standard, is true end-to-end encryption. Outlook supports it, and Gmail supports it in some Workspace editions. Both sender and recipient need certificates installed and exchanged in advance. It fits a fixed group of partners who all agree to use it, and is rarely practical for mail to the general public.

Technical Controls Checklist

• Every mailbox protected by multi-factor authentication. Encryption does little if an attacker can sign in as the sender. See why MFA matters
• Licensing for message encryption confirmed for each person who sends sensitive mail
• Test-IRMConfiguration passes
• PDF attachment encryption enabled
• At least one automatic rule (keyword or DLP) so encryption does not depend on memory
• Forced TLS connector or Gmail TLS requirement for partners whose contracts demand it
• SPF, DKIM, and DMARC configured, so recipients can trust that mail from your domain is genuine and portal notifications are less likely to land in spam. See why business email goes to spam
• A secure inbound method (portal or upload link) published for customers
• Full-disk encryption on laptops and phones that hold downloaded mail
• A written instruction for staff and a short explanation for recipients
• A test message to an outside address after any change, with the result recorded

Common Mistakes

• Counting TLS as message encryption. TLS is valuable and automatic, and it stops at the server. It also depends on the other side.
• Relying on staff to remember. Manual encryption works until a busy day. Add at least one automatic rule.
• Forgetting PDFs. PDF encryption is off until an administrator enables it.
• Sending a OneDrive link inside an encrypted message and assuming the file inherits the protection.
• Writing rules that are too broad. Encrypting all outbound mail frustrates recipients and trains them to ignore the portal. Target the content that needs it.
• Using personal email accounts for business information. Organizational rules, logging, and encryption policies do not reach them.
• Overlooking impersonation. Encryption proves nothing about who sent a message. Pair it with defenses against business email compromise.

Common Questions

Is email encrypted by default?

Partly. Microsoft 365 and Gmail both encrypt the connection with TLS whenever the receiving server supports it, which covers most mail between major providers. The message itself is stored readable in each mailbox, and if the other server does not support TLS, the default behavior is to send it unencrypted unless an administrator has required TLS.

Does Microsoft 365 Business Standard include email encryption?

Not by itself. Microsoft lists Purview Message Encryption as included in Business Premium and in the E3 and E5 plans. Business Basic and Business Standard can use it by adding Azure Information Protection Plan 1 for each user who needs it. TLS in transit is included in every plan.

Can recipients without Microsoft 365 open an encrypted message?

Yes. Gmail and Yahoo users sign in to Microsoft’s encrypted message portal with their existing account. Anyone else can request a one-time passcode sent to their email address. Nothing needs to be installed. Replies sent from the portal are encrypted as well.

Is Purview Message Encryption end-to-end encryption?

Not in the strict sense. The message and supported attachments are encrypted and access is tied to the recipient’s identity, which is a large step beyond TLS. By default Microsoft manages the encryption keys. Organizations that need the provider to be unable to decrypt content look at S/MIME, customer-managed keys, or Google’s client-side encryption.

Does HIPAA require encrypted email?

The current Security Rule lists encryption as an addressable specification: a practice must implement it where reasonable and appropriate, or document why not and use an equivalent measure. HHS guidance also permits email with patients when reasonable safeguards are applied. A healthcare attorney or compliance adviser should confirm what is appropriate for your practice.

How Coastal Growth Co. Can Help

We set up message encryption in Microsoft 365, including licensing checks, PDF encryption, automatic rules, forced TLS for named partners, and testing with outside recipients, and we write the short staff instruction that goes with it. For Google Workspace offices we help choose between an encryption add-on and a client portal. See our cloud and email services and Microsoft 365 support pages, or contact us to describe what you send and to whom.