Clarification regarding Microsoft Email Encryption

Question

Clarification regarding Microsoft Email Encryption

Wajeeh Rehman 0

I want some clarification regarding the Microsoft 365 Mail Encryption features, and I have seen conflicting information, to confirm one thing is that we would want users to send out PDF documents as Encrypted while using the classic outlook desktop app.

Reviewing the article https://learn.microsoft.com/en-us/purview/ome-faq

It mentions that I would need to enable the use the powershell command Set-IRMConfiguration -EnablePdfEncryption $true

However checking the supported clients, it mentions

Outlook (new) Desktop
Outlook on the web
Outlook for Mac
Outlook for iOS
Outlook for Android

Which I am not sure why Outlook Classic is left out with the setting being global it shouldn't be client agnostic

Also after enabling the setting what would the experience be like for external users that are on Microsoft 365 and those who are on non Microsoft 365 Emails like gmail, yahoo etc

Would users will still be able to download and forward the PDF document unencrypted if sending it through the classic outlook desktop or will the setting be applied to it and only after do the recipient authenticate can they view the document

Any other gotchas or further details would be great.

Ruby-N 13,320 Reputation points Microsoft External Staff Moderator

2026-07-22T22:53:03.4666667+00:00

Good day Wajeeh,

I hope everything is going well on your end.

I am following up on the support thread that has been discussed and wanted to check whether the information shared in my previous response helped address the issue you were experiencing.

If you are still encountering any issues or have additional questions, please feel free to reach out at any time. I would be happy to assist further as needed.

Additionally, ensuring that everything is functioning as expected and that your experience remains smooth is a top priority.

Thank you again for your collaboration throughout the troubleshooting process. I look forward to hearing from you soon.
Ruby-N 13,320 Reputation points Microsoft External Staff Moderator

2026-07-24T22:05:51.4066667+00:00

Hello Wajeeh,

I hope you're having a great day.

It’s been a pleasure working with you on this thread. I understand you may have other priorities at the moment, and I completely respect that.

If you're still experiencing any issues or have come across new challenges, feel free to let me know which steps you're currently stuck on. I’m here and happy to assist whenever it’s convenient for you.

Thank you again for your time and collaboration.

I look forward to hearing from you whenever you're ready.

1 answer

Your answer

Ruby-N 13,320 Reputation points Microsoft External Staff Moderator

2026-07-22T22:53:03.4666667+00:00

Good day Wajeeh,

I hope everything is going well on your end.

I am following up on the support thread that has been discussed and wanted to check whether the information shared in my previous response helped address the issue you were experiencing.

If you are still encountering any issues or have additional questions, please feel free to reach out at any time. I would be happy to assist further as needed.

Additionally, ensuring that everything is functioning as expected and that your experience remains smooth is a top priority.

Thank you again for your collaboration throughout the troubleshooting process. I look forward to hearing from you soon.
Ruby-N 13,320 Reputation points Microsoft External Staff Moderator

2026-07-24T22:05:51.4066667+00:00

Hello Wajeeh,

I hope you're having a great day.

It’s been a pleasure working with you on this thread. I understand you may have other priorities at the moment, and I completely respect that.

If you're still experiencing any issues or have come across new challenges, feel free to let me know which steps you're currently stuck on. I’m here and happy to assist whenever it’s convenient for you.

Thank you again for your time and collaboration.

I look forward to hearing from you whenever you're ready.

Answer 1

Ruby-N 13,320 Microsoft External Staff Moderator

Good day Wajeeh, and I appreciate the clear explanation of your concern.

Just to gently clarify before we go any further, this is a user‑to‑user support forum. I don’t have the ability to access or investigate individual accounts because this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, do not have access to internal systems or the ability to directly take action on Microsoft product features. However, I truly hope I can help review your situation, offer some guidance, and support you in finding the right next steps as best as possible.

After reviewing the Microsoft documentations, Classic Outlook isn't supported for PDF attachment encryption because it doesn't support applying Rights Management protection to PDF files.

While tenant-level settings such as Set-IRMConfiguration can enable the feature organization-wide, the client application must also support protecting PDF attachments. Classic Outlook only supports automatic rights protection for Office file formats and XPS, not PDFs. Therefore, PDF attachment encryption isn't supported in Classic Outlook.

Additionally, Microsoft is gradually transitioning customers from Classic Outlook to New Outlook. While users can still use Classic Outlook today, Microsoft has indicated that future stages will move users to New Outlook, with advance notice provided to administrators.

Given that PDF attachment encryption is supported in newer Outlook experiences, it may be worth validating this workflow in New Outlook or Outlook on the web as part of your future migration planning.

Additional information is available in the following resources:

Stages of migration to new Outlook for Windows | Microsoft Learn

Migrate from classic Outlook to new Outlook | Microsoft Learn

I hope this helps clarify the behavior. If you have any questions or need further support, please don’t hesitate to reach out at any time.

Thank you for your patience and understanding.

If you have any extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Wajeeh Rehman 0 Reputation points

2026-07-18T00:56:12.0266667+00:00

Thank you for your detailed answer, that explains a lot one more thing say if we have the Microsoft Business Premium Licensing Suite, would publishing sensitivity labels would allow users to be able to send out encrypted emails using the classic Outlook app and any known issues when sending out emails with sensitivity labels to non-Microsoft users
Hornblower409 12,390 Reputation points

2026-07-19T03:34:57.29+00:00

@Wajeeh Rehman said

one more thing

If you don't get an answer to your follow up questions in this thread within a day or two, I would suggest that you start a new thread using the "Ask a question" button at the top of this page to create a new Question and include the details for these new Questions.

(You can put the link for this page in your new Question for reference)
Ruby-N 13,320 Reputation points Microsoft External Staff Moderator

2026-07-21T16:02:46.37+00:00

Dear Wajeeh,

Thank you for the follow up and I’m glad the information helped clarify your concerns.

Certainly, if your organization has Microsoft 365 Business Premium, it includes the licensing required for Sensitivity Labels, Microsoft Purview Message Encryption, and Data Loss Prevention (DLP).

1/ To use encrypted emails with Sensitivity Labels, the labels must be configured with encryption settings in Microsoft Purview and then published to users through a label policy. Once this is completed, users can apply those labels in Classic Outlook and any encryption configured in the label will be applied automatically when sending the email.

However, please note that PDF attachment encryption isn't supported in Classic Outlook for Windows, even if PDF encryption is enabled at the tenant level. This feature is only supported in New Outlook and Outlook on the web.

2/ For external recipients, encrypted messages can be sent to users both inside and outside your organization, including Gmail, Yahoo, Outlook.com and Microsoft 365 tenants. The viewing experience may vary depending on the recipient's email provider and client, but external recipients can authenticate and access the protected message through Microsoft's secure message portal if needed.

3/ My recommendation is to run a small pilot with a few internal users and a couple of external recipients (for example: one Microsoft 365 user and one Gmail user) to validate the email encryption and recipient experience before rolling it out more broadly.

Additional information is available in the following resources:

Set up information protection capabilities - Microsoft 365 admin | Microsoft Learn

Apply encryption using sensitivity labels | Microsoft Learn

Microsoft Purview Message Encryption | Microsoft Learn

If you found the response useful, please consider marking it as accepted, as this may help other community members who are looking for similar guidance. 

Please let me know if you have any questions.