Office 365 Encryption

[Warwick_Tech]

Hi All,

 

I know Office 365 is encryped naturally, however there are the extra encryption options in Outlook and the web client;

 

Does anyone have these turned on by default? Do you encrypt 'everything' or have seperate policies?

 

I'm having an issue where some 'encrypted' emails can be read in plain text, others prompt with a 'read this message' button but it just loops new browser windows each time.

 

MS are at a bit of a loss as they say it's working their end (typically)

 

I can't also think of a down side of encrypting EVERYTHING via a rule (it seems to plain text without prompts in both OWA and Outlook)

 

Edited March 29, 2021 by Warwick_Tech

[Steve21]

It'll be a bit of a nightmare with everything encrypted. As you'll end up forcing everyone external to sign up to MS to open emails. (Think parents/external companies etc)

 

The only time we've seen a loop like that is when someone has forwarded an encrypted mail to someone who isn't "allowed it" so it keeps trying to get signed in by the original account. For example, a finance mailbox with delegated permissions, PersonA isn't allowed to open the mail as they're not "finance" so it'll loop back asking for finance again

 

Steve

[Warwick_Tech]

It'll be a bit of a nightmare with everything encrypted. As you'll end up forcing everyone external to sign up to MS to open emails. (Think parents/external companies etc)

 

The only time we've seen a loop like that is when someone has forwarded an encrypted mail to someone who isn't "allowed it" so it keeps trying to get signed in by the original account. For example, a finance mailbox with delegated permissions, PersonA isn't allowed to open the mail as they're not "finance" so it'll loop back asking for finance again

 

Steve

 

Hi Steve,

 

thanks for this; I wonder if only internal emails then should be encrypted (I'll have a ponder)

 

As for the loop, I thought this too, however I've tried 3 outside emails (all MS admittedly) from Outlook and OWA, they all just loop constantly.

[Steve21]

The only ones we encrypt are ones that have tags like [secure] [Encrypt] for use with external LEA/companies for data protection etc.

 

My understanding was internal emails never really need to be encrypted as they're not leaving the MS world of servers so the "internal" encrypt as such doesn't need to come into play? I thought it would only be when going to external email providers etc. Unless I'm misunderstanding something with that

 

Steve

[Boredguy]

If we are sending data that is part of the DLP settings in Office 365, the message is automatically set to be encrypted so it does not actually leave our server, and the recipient gets either gets a message requesting to click the link to view the message if they are using Outlook Client/Other mail app (OWA automatically shows the message with a no entry sign or padlock to show it's encrypted)

 

Users can choose to encrypt the message when going externally via the options in the client, but it's not something we enforce as the bulk of the e-mail is not content that requires it at present.

[mavhc]

Right, the interesting part about encrypting emails is you can then actually see who's read them and recall them. If everyone's using OWA or a MS app, and it's internal, it's seamless, until people starting forwarding things, which may be a good idea.

 

Once you go outside your domain though it's a problem