How to Create and Customize Microsoft 365 Email Encryptions

Email is one of the most widely used methods of communication and collaboration in an organisation. However, it can also become a security threat when the question arises of how to securely share sensitive information outside the organisation.

People nowadays use email to share personal and business-related information such as PAN numbers, account numbers, order IDs, invoices, contracts, and other confidential or sensitive data. However, if proper security precautions are not taken, this information may be exposed through impersonation attacks, hacking, or other unauthorized methods.

This is where Microsoft 365 comes in with one of its security features: email encryption. In this article, we will learn how to create a label for email encryption, create and apply a routing rule, and customize the protected message with company branding, a logo, and security policies.

Before configuring the settings, let’s understand how the configuration will work:

Prerequisites:

[A] Office 365 E3 / Office 365 E5 Licenses

[B] A global administrator ID

Configurations:

[A] Create and Publish a sensitivity label:

• Login to https://purview.microsoft.com/ [ using global administrator role ]
• Solution >> Information Protection >> Sensitivity labels
• +create >> Enter the name and a display name for your label >> write a description >> Next
• Under “Define the scope for this label” , just tick on the box for “Emails” only >> Next
• Check the box for control access >> Next
• Now on the access control page, scroll down and select assign permission >> select +add any authenticated users and save and then click on next
• Next >> Next >> Create the label

Come back to the same page,

• Solution >> Information Protection >> Sensitivity labels
• Click on Publish Labels >> select the label which you have created >> then select next >> next >> next >> next >> name the policy >> submit >> Finish

[B] Create a new routing rule :

• Login to https://admin.cloud.microsoft/exchange
• On the left-hand side, select Mail flow >> Rules >> + Add a rule >> select “Apply Office 365 Message Encryption and rights protection to messages.”
• Provide a name for the rule. Under “Apply the rule if,” select “The recipient” >> “is external/internal” >> select “Outside the organisation.”
• Select the +icon on the right-hand side to add another condition
• Select “The subject or body “>> select “subject or body matches these text patterns” >> Enter the sensitive words or patterns that you want to add and save
• Under “do the following”, go to the “right protect message with” >> and select the label which you have created and save
• Click next >> set the severity level>> under “Match sender address in message “ , select header or envelope >> next >> create the rule
• Once the rule has been created, enable the rule.

[C] Now, let’s configure the organisation's branding, logo, and privacy URLs for encrypted emails.

• In your system , run Microsoft powershell and run as administrator
• Type “Connect-ExchangeOnline” and enter >> Login with global admin ID and password and now your powershell is connected with exchange online
• Run the following commands serial wise as listed below>>
•  New-OMEConfiguration -Identity "Custom1"
• Note: In place of “custom1”, you can write your template name
• RUN >> Set-OMEConfiguration -Identity "Custom1" -BackgroundColor "#6495ed" [ Select the background colour based on your requirement ]
• RUN >> Set-OMEConfiguration -Identity "Custom1" -Image ([System.IO.File]::ReadAllBytes('C:\Temp\contosologo.png'))
• Replace ('C:\Temp\contosologo.png')) with the image path file in your system and be sure the image is less than 40KB and optimal size should be 170*70
• RUN >>Set-OMEConfiguration -Identity "Custom1” -IntroductionText "has sent you a secure message. Kindly read it carefully"
• RUN >> Set-OMEConfiguration -Identity "Custom1” -ReadButtonText "Read Secure Message."
• RUN >> Set-OMEConfiguration -Identity "Custom1" -EmailText "Encrypted message from Infiflex technologies private ltd secure messaging system. "
• RUN >> Set-OMEConfiguration -Identity "Custom1" -PrivacyStatementURL “https://www.infiflex.com/policy" [Replace the url with your company privacy or protection policy

Once done, create another rule from the exchange admin centre

• Go to the exchange admin centre >> mail flow >> rules
• Click +add a rule >> select “Apply custom branding to the OME messages” >> Name the rule
• Apply the rule >>if the sender is inside the organisation
• Under “Customize rights protect message with” select the template which you have created
• Select the severity > under “Match sender address in message “ , select header or envelope >> next >> create the rule
• Once the rule has been created, enable the rule.

Now, let's look at the final result. Once a sender in your organisation sends an email containing sensitive information to an external recipient, the email will automatically be encrypted using the label we created. The customised branding will then be applied, and the email will be sent to the recipient.

Below are screenshots showing the difference between the default and customised branding templates.

Conclusion: Protecting sensitive information is an important step that organisations need to take, especially given the major role email plays in corporate environments and industries. When exchanging sensitive information, we need to be particularly careful about how that information is shared and protected.

Thanks to ​Microsoft, features such as sensitivity labels in the Microsoft Purview portal, mail flow rules, and customised branding templates can help organisations protect sensitive emails while also maintaining a professional look and feel.