Microsoft Purview Message Encryption Guide: Set Up, Brand, Expire and Revoke Encrypted Email

Sensitive email leaves Microsoft 365 every day, and once it reaches an outside mailbox the sender's only lasting control is the protection that travels with the message. Microsoft Purview Message Encryption applies Azure Rights Management protection to email so that only intended recipients can read it, whether they use Outlook, Gmail, Yahoo or another service. This guide covers how the service authenticates internal and external recipients, the admin roles that control it, the mail flow rules, branding templates, expiration and revocation features of Advanced Message Encryption, and a hardening baseline you can apply in Exchange Online PowerShell. It is written for Microsoft 365 administrators, messaging engineers and security teams. Certificate based end-to-end email encryption is covered in the OpenPGP and S/MIME Email Encryption Guide; this page stays on the Purview service.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public Purview Message Encryption documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Confirm the foundation first. Message Encryption is activated automatically once the Azure Rights Management service is active; verify with Get-IRMConfiguration (AzureRMSLicensingEnabled should be True) and Test-IRMConfiguration.
• Pick the right protection per message. Encrypt-Only keeps the message encrypted but lets recipients forward, copy and print; Do Not Forward blocks forwarding, printing and copying and limits access to the original recipients.
• Mail flow rules make encryption automatic. Use Exchange transport rules (and Purview DLP actions) so that encryption does not depend on each user remembering to press Encrypt.
• Custom branding unlocks control. Expiration, revocation and portal activity tracking for external recipients all depend on a custom branding template that sends recipients through the encrypted message portal.
• Govern who can decrypt and revoke. Scope Compliance Administrator and Exchange Administrator roles tightly, and decide deliberately whether attachments stay encrypted after download.

How identity and access work in Purview Message Encryption

Purview Message Encryption is an online service built on the Azure Rights Management service, part of Microsoft Purview Information Protection. Protection is applied to the message (and to supported attachments), and every recipient must authenticate before the service issues a licence to read it. How that authentication happens depends on who the recipient is and which client they use.

Replies from recipients of an encrypted message are encrypted as well, so a conversation stays protected in both directions. Inbound mail from outside your Exchange Online organisation cannot be encrypted by your rules: it arrives as it was sent, even if a rule targets it.

Encryption options and what recipients can do

The difference between Do Not Forward and a custom template without the Forward right matters: Do Not Forward limits access to the sender's chosen recipients, while a template uses a static list the administrator defined in advance, inside which people can still share content. To give an attachment different rights from the email, or to protect a file type that does not support inherited encryption, encrypt the file before attaching it. Setting Set-IRMConfiguration -EnablePdfEncryption $True extends protection to PDF attachments, which recipients then open in Microsoft Edge or the portal.

Admin roles and privileged access

Microsoft's documentation uses Compliance Administrator as the example role for configuring and testing Message Encryption, and recommends the role with the fewest permissions rather than Global Administrator. The actions below are the ones worth controlling.

Two settings deserve the same scrutiny as role assignments because they change who can read protected content. The first is any mail flow rule with the action Remove Office 365 Message Encryption and rights protection applied by the organization (or Remove attachment rights protection applied by the organization), which strips protection from matching mail. The second is DecryptAttachmentForEncryptOnly: when set to $true, the service sends Encrypt-Only attachments decrypted when downloaded from a browser. The default is $false. Make both a documented decision. For the wider admin model across the admin centres, see the Microsoft 365 admin centres and admin roles guide, and make privileged roles eligible rather than permanent as described in the Least Privilege Techniques Guide.

Integrations, API tokens and service accounts

Message Encryption touches several other parts of the mail path. Each integration below has a setting the customer owns.

• Mail flow rules: The core integration. In the Exchange admin center, go to Mail flow, Rules, New, Create a new rule; set a condition such as "The sender is located Inside the organization" plus a recipient, domain or keyword condition; then choose Modify the message security, Apply Office 365 Message Encryption and rights protection, and select Encrypt or Do Not Forward. In PowerShell, New-TransportRule takes -ApplyRightsProtectionTemplate (for example "Encrypt" or "Do Not Forward") and -ApplyRightsProtectionCustomizationTemplate (the branding template name).
• Purview DLP: A DLP policy action can apply encryption when sensitive information types are detected, which is how Advanced Message Encryption's automatic policies identify personal, financial or health data. See the Data Loss Prevention (DLP) Guide.
• Sensitivity labels: A label configured for "Let users assign permissions" with Encrypt-Only gives users a labelled route to encryption in Outlook on Windows, macOS, iOS and Android.
• Hybrid Exchange: On-premises users get Message Encryption only when their mail routes through Exchange Online, so configure hybrid connectors first.
• Third-party mail processing: Applications that scan and modify mail can stop branding being applied correctly. Test branding end to end after adding any gateway or signature service to the outbound path.
• iOS Mail and other unenlightened apps: Set-ActiveSyncOrganizationSettings -AllowRMSSupportForUnenlightenedApps $true lets the service send decrypted messages to apps such as iOS Mail. It is not enabled by default, and an OWA or ActiveSync mailbox policy with IRMEnabled set to $false overrides it.
• Automation accounts: Scripts that manage branding templates, rules or revocation run against Exchange Online PowerShell. Run them under an app registration with certificate based authentication and only the Exchange roles they need, not a shared admin account, and review apps that hold mail permissions as described in How to review Microsoft 365 app registrations with mail permissions.
• Tenant keys: Microsoft-managed tenant root keys are the default and suit most organisations. If compliance needs bring your own key (BYOK), complete that before setting up Message Encryption. See the BYOK, HYOK and External Key Management Guide.

Branding, expiration and revocation with Advanced Message Encryption

Advanced Message Encryption builds on Message Encryption for organisations that need tighter control over what external recipients can do and for how long. Its capabilities are multiple branding templates, automatic policies that pair sensitive information detection with a template, message expiration, message revocation and encrypted message portal activity logs. Licensing is set out in the Microsoft Purview service description; confirm your plan there before designing around these features.

Branding templates

Every tenant has a default template, called "OME Configuration", that you can modify but not remove. Creating, modifying and removing additional templates requires Advanced Message Encryption. The main Set-OMEConfiguration parameters are:

Apply a template with a mail flow rule whose action is Modify the message security, Apply custom branding to OME messages, and make sure the encryption rule runs at a higher priority than the branding rule.

Expiration

Create a template such as New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7 and apply it with a mail flow rule. The expiry date appears in the wrapper email, and a recipient who opens an expired message sees an error in the portal. Expiration applies only to external recipients who read through the portal.

Revocation

Revocation works only for recipients who received the link-based, branded experience; Microsoft 365 and Microsoft account recipients who read inline in Outlook cannot be revoked. A sender can revoke from the Sent folder in Outlook on the web using Remove external access, but only for a message sent to a single recipient on the link-based experience. Administrators revoke with the message ID, found through Message trace or the Message encryption report in the Microsoft Purview portal:

1. Check the message is revocable: Get-OMEMessageStatus -MessageId "<message id>" | ft -a Subject, IsRevocable.
2. Revoke it: Set-OMEMessageRevocation -Revoke $true -MessageId "<message id>", or choose Revoke message in the Encryption report details.
3. Confirm with Get-OMEMessageStatus that Revoked shows True. A recipient who opens it in the portal then sees that the message has been revoked by the sender.

To keep every external message revocable, apply encryption together with a custom branding template to all outgoing mail in scope.

Logging and detection

Encryption only helps if you can show it is being applied and spot when it is bypassed. Build monitoring around these sources.

• Message encryption report: In the Microsoft Purview portal, the Encryption report shows encrypted messages, their details and revocation status. Review it for volume trends by rule and for the share of external mail sent through the portal.
• Message trace: Message trace details show how a message was processed and give the message ID needed for revocation. See the Email Gateway and Message Trace Detection Guide.
• Portal activity logs: Advanced Message Encryption records access to encrypted messages through the portal, which lets you see whether and when an external recipient opened a message before you decide to revoke it.
• Configuration changes: Alert on changes to mail flow rules (especially new or edited rules with a remove encryption action), to IRM configuration values such as AzureRMSLicensingEnabled and DecryptAttachmentForEncryptOnly, and to branding templates. Admin activity in Exchange Online is recorded in the audit log; forward it to your SIEM.

Metrics that show the programme is working:

• Percentage of outbound messages matching a sensitive information policy that were encrypted.
• Percentage of encrypted external mail sent with a custom branding template (and therefore revocable).
• Number of mail flow rules with a remove encryption action, each with a named owner and justification.
• Median time from a revocation request to confirmed revocation.
• Count of unapproved changes to IRM or OME configuration in the period (target zero).

Hardening baseline

Roll out in phases so that recipients and support teams are ready before encryption becomes automatic.

1. Verify the service: Confirm Azure Rights Management is active, AzureRMSLicensingEnabled is True and Test-IRMConfiguration passes. If the test reports "Failed to acquire RMS templates", follow Microsoft's steps to set the licensing location from Get-AipServiceConfiguration. Organisations still on AD RMS must migrate to Azure Rights Management first.
2. Retire legacy rules: Legacy Office 365 Message Encryption was deprecated on 1 July 2023. Edit each existing rule to use Apply Office 365 Message Encryption and rights protection with the Encrypt template and remove any Apply the previous version of OME action, otherwise recipients keep receiving the older HTML attachment format.
3. Decide sign-in options: Choose whether external recipients may use social ID sign-in (-SocialIdSignIn), one-time passcodes (-OTPEnabled) or both, per branding template, based on who your recipients are.
4. Decide attachment handling: Keep DecryptAttachmentForEncryptOnly at its default of $false unless there is a documented need, and turn on EnablePdfEncryption so PDF attachments are protected.
5. Build branding templates: Create a default branded template and, where Advanced Message Encryption is licensed, templates with expiry periods that match your retention needs (for example 7, 30 or 90 days).
6. Pilot rules: Start with a narrow rule (a test group of senders, or one partner domain) and test each recipient type from the identity table, including Gmail, Yahoo and a one-time passcode recipient. Check replies are encrypted.
7. Expand with DLP: Add DLP policies that encrypt mail containing sensitive information types, then rules for keywords such as "[secure]" in the subject if users need a manual trigger.
8. Roll back safely: To back out a rule, disable it rather than delete it. To disable the service entirely, remove rules that use Message Encryption, turn off the Encrypt button, then set AzureRMSLicensingEnabled to $false.

Choosing the right approach for your organisation:

Common misconfigurations

• Expecting revocation without branding: Revocation and expiration only work for link-based portal delivery. Without a custom branding template applied by rule, many external messages are delivered inline and cannot be revoked. Apply branding to the mail you may need to pull back.
• Rule order reversed: If the branding rule runs before the encryption rule, branding may not apply. Give the encryption rule the higher priority.
• Unreviewed remove encryption rules: A rule created to fix one partner's workflow can quietly decrypt far more mail than intended. Scope it to named recipients and review it each quarter.
• Attachment decryption switched on without a decision: Setting DecryptAttachmentForEncryptOnly to $true means downloaded attachments leave protection behind. Record why, or keep the default.
• Broad admin roles for routine tasks: Using Global Administrator to run branding or revocation work widens the impact of a compromised account. Use Compliance Administrator, made eligible through privileged access processes, and service principals for automation.

Framework mapping

Practitioner checklist

• Confirm Azure Rights Management is active, AzureRMSLicensingEnabled is True and Test-IRMConfiguration passes.
• Migrate every rule that uses Apply the previous version of OME to the current encryption action.
• Document when staff should use Encrypt-Only, Do Not Forward or a custom template.
• Create a custom branding template with a clear disclaimer and privacy link, and decide social ID and one-time passcode sign-in.
• Apply branding (and an expiry period where licensed) to external mail you may need to revoke, with the encryption rule at higher priority.
• Drive encryption from DLP policies for sensitive information types, not only from user choice.
• Keep DecryptAttachmentForEncryptOnly at $false unless justified, and enable EnablePdfEncryption.
• List every rule with a remove encryption action, with an owner and review date.
• Assign Compliance Administrator on an eligible basis and run automation under certificate authenticated app registrations.
• Rehearse a revocation with Get-OMEMessageStatus and Set-OMEMessageRevocation, and alert on changes to IRM and OME configuration.

Standards and references

• Microsoft Learn: Microsoft Purview Message Encryption
• Microsoft Learn: Microsoft Purview Advanced Message Encryption
• Microsoft Learn: Set up Microsoft Purview Message Encryption
• Microsoft Learn: Define mail flow rules to encrypt email messages
• Microsoft Learn: Manage Message Encryption
• Microsoft Learn: Add your organization's brand to encrypted messages
• Microsoft Learn: Revoke email encrypted by Advanced Message Encryption
• Microsoft Learn: Configure usage rights for Azure Information Protection

Related NHI Mgmt Group resources: OpenPGP and S/MIME Email Encryption Guide · Exchange Online Security Guide · Microsoft Purview Information Protection Guide · Email Security Guide · Data Loss Prevention (DLP) Guide