Email encryption solutions in Microsoft 365 fall under the umbrella service Microsoft Purview Message Encryption, formerly Office Message Encryption - OME. We’ll see the old acronym crop up when we look at PowerShell commands, and OME is extensively referenced in Microsoft documentation.  The Microsoft Purview Message Encryption service is based on the Azure Rights Management Service, which is, in turn, part of Aure Information Protection. The service encrypts message content (it is in the name), provides email sender identity verification, and protects against the unauthorized sending or exfiltration of content that should not be shared. Microsoft Purview message encryption has three functions that broadly map to these use cases. Message content encryption, secure multipurpose internet mail extensions, and information rights management.

Email encryption involves several stages and components. A message is initially encrypted from plain or HTML text into unintelligible ciphertext. This can happen within the sender’s email client or at the email server. When the message is received, it is decrypted back to its plain text format by the email server, which may or may not be the same as the sending server, or the receiver’s email client uses a key to decrypt the message. In addition to message content encryption, Microsoft 365 transmits the message over a TLS (Transport Layer Security) connection. TLS connections are the de facto standard for most email services. While TLS is on by default, message content encryption needs to be configured.