S/MIME, Microsoft 365 Message Encryption, and password-protected files all work differently. See which one to use and how to set each up in Outlook.
Outlook can send a truly secure email in three ways, and they are not interchangeable. S/MIME encrypts a message end to end. But both sides need a digital certificate. Microsoft 365 Message Encryption works between any email address, with no certificate needed. Password-protecting a file is the weakest option, since the password usually travels by the same unsecured channel as the file.
A standard email travels in a form several people can read. A mail admin can read it. So can a network operator, or anyone who gets into a mailbox. Encryption in transit, which most providers now use, protects the message while it moves between servers. It does nothing once the message sits in an inbox.
For example, that gap matters most for three kinds of content: financial details, health information, and anything covered by a confidentiality duty. Outbound email errors already drive a large share of data breaches. An unsecured message sent to the wrong person turns a mistake into exposed data instantly, with no chance to undo it.
Each method trades convenience for protection differently. So the right choice depends on who is on the other end.
| Method | Works with | Setup required | Strength |
|---|---|---|---|
| S/MIME | Mail clients that support S/MIME, both sides with certificates | A digital certificate for each user | Full end-to-end encryption |
| Microsoft 365 Message Encryption | Any email address, including Gmail and Yahoo | A Microsoft 365 plan that includes it | Strong, with no certificate needed |
| Password-protected file | Any email address | A password shared separately | Weak if the password travels the same way |
S/MIME is the strongest option on paper. But it only works when both people have a certificate installed, and both trust each other’s identity. That makes it a fit for regular mail between two companies, not a one-off message to a new contact.
Discover how Threatcop protects your workforce from modern cyber threats.
Most people face the same case: sending something sensitive to a recipient on any email provider.
Microsoft’s own documentation confirms your admin controls which options appear. If you see none of this, message encryption likely needs turning on for your company first.
Email authentication solves a different problem, spoofing, while encryption solves interception. S/MIME takes more setup. So treat it as the option for a regular, trusted contact rather than a single message.
Both sides must finish this setup. If your recipient has no certificate, S/MIME will not work. Microsoft 365 Message Encryption is the better fallback then.
Encryption is not the only setting worth checking. Zero trust applies here: never assume a setting is safe just because it feels familiar. Zipping a file and adding a password to it feels secure. In practice, it usually fails. The password travels by email, text, or chat, often from the same account that sent the file. So anyone who intercepts one channel likely has the other too.
Use this method only as a last resort. Send the password through a different channel entirely, such as a phone call. Even then, treat it as better than nothing, not truly secure.
Encryption secures the message in transit and at rest. It does not stop a message from going to the wrong person, which remains the most common way sensitive email causes harm. Autocomplete, a shared contact name, or a careless reply-all sends an encrypted message just as easily as an unencrypted one.
So treat encryption and good sending habits as separate problems. Add a short send delay where Outlook allows it. Then check the recipient line last, after the message and attachment are ready.
A technical email encryption control only works if people actually use it. Most people do not, until it becomes routine.
Threatcop Learning Management System (TLMS) delivers that part. It runs short, role-based lessons instead of a one-time policy email. Finance and HR staff handle sensitive data daily. So they see lessons built around the exact cases they face. The gamified format and quizzes also hold attention better than a static document. Completion and engagement reporting then shows whether the lesson actually landed, which matters when an audit asks for evidence, not just a policy’s existence.
Pick the method that matches the recipient. Use Microsoft 365 Message Encryption as the default for one-off or external messages. Reserve S/MIME for regular contacts willing to set up certificates on both sides. Treat a password-protected file as a fallback, never a plan. None of these settings replace good habits. So pair encryption with a short send delay and a last look at the recipient line before every sensitive message leaves your outbox. The same habits that stop a misdirected file also protect an encrypted one.
Use Microsoft 365 Message Encryption for most cases, since it works with any recipient and needs no certificate. Select Protect or Encrypt from the ribbon when composing the message. For regular mail with one trusted contact, S/MIME offers stronger end-to-end protection. That holds once both sides have certificates installed.
Most providers, including Microsoft 365, encrypt email in transit between servers on their own. That keeps the message safe while it travels. It does not protect it once it sits in an inbox, and it does not stop the message reaching the wrong recipient.
S/MIME needs a digital certificate on both the sender’s and recipient’s devices. It only works between people who both have certificates and have swapped signed messages first. Microsoft 365 Message Encryption works with any email address and needs no certificate, which makes it the better default choice.
A password-protected file is only a partial fix for secure email. If the password travels through the same email, text, or chat as the file, anyone who intercepts one likely has the other too. Send the password a different way, such as a phone call, if you use this method at all.
No. Encryption protects the content of a message, not where it goes. A message sent to the wrong person through autocomplete, or a careless reply-all, still reaches them. That holds whether it is encrypted or not. That is why sending habits matter as much as the technical setting.
Arpit Rao is a Product Manager at Kratikal, bringing a strong technical foundation and experience in building and managing cybersecurity products. His work spans product strategy, technology, user experience, and solving complex customer challenges. With a focus on translating technical capabilities into practical solutions, Arpit is interested in cybersecurity, AI, product innovation, and user-centric technology. He works on creating products that address evolving security and business needs.
Preventing phishing now means managing human risk as an ongoing program, not a yearly training. See the four parts,...
Vishing hit 11% of initial breach vectors in 2025 while email phishing fell to 6%. See the Mandiant data,...
Most email false positives are not detection failures. See what actually causes them, and how to cut them without...
