Unable to Open Encrypted Email in Outlook and Microsoft 365

8.4K

In this tutorial we will show how to open and troubleshoot Microsoft 365 encrypted emails using Outlook, OWA, and mobile apps.

What Is Microsoft Purview Message Encryption?

The Microsoft 365 subscription allows users to use a native email encryption solution called Microsoft Purview Message Encryption (formerly Office 365 Message Encryption, OME). Microsoft Purview Message Encryption can be used to send encrypted emails to internal and external recipients, and it doesn’t require any special client-side software.

There are several reasons why a user might not be able to open an encrypted Microsoft 365 email.

How Microsoft 365 Email Encryption Works

When you open an encrypted email, Outlook does not decrypt the message locally. Instead, the following process occurs:

1. User authenticates with Microsoft Entra ID/OTP.
2. Outlook requests a decryption license from Azure Rights Management Service (RMS).
3. RMS checks permissions.
4. Decryption key is delivered to the client.
5. Outlook displays the content.

Keep in mind that a failure at any stage can prevent the message from opening.

How to View Microsoft 365 Encrypted Email

• Email that is encrypted in Microsoft 365 (Microsoft Purview Message Encryption) can be read in supported MS clients such as Outlook (desktop), Outlook on the web (OWA), and Outlook mobile apps.
• External recipients (e.g., Gmail, Yahoo, AOL) cannot decrypt the message directly in their mail client. They are accessing the content through a secure web viewing page after authentication/one-time passcode verification.

Keep in mind that Microsoft Purview Message Encryption works in 2 different modes (mode depends on the recipient):

• Internal recipients (within the same Microsoft 365 tenant) decrypt messages directly in Outlook or OWA using Azure AD authentication.
• External recipients access encrypted content through a secure Microsoft-hosted web. They are using MS account login/one-time passcode authentication.

Reading Encrypted Email in Outlook and OWA

Recipient doesn’t need Outlook or a Microsoft 365 account to open the encrypted email. External recipients then receive a secure email, seeing only the email subject and a button to read the message. When the user clicks the Read the Message link, they are redirected to Outlook Online to verify their account using a trusted OAuth provider or a one-time passcode.

In case the recipient is already authenticated in Azure AD, Outlook/OWA retrieves a decryption key from the MS Rights Management Service (RMS). This allows the message to be displayed flawlessly.

If you receive an encrypted message and open it in Outlook Web Access, it will be decrypted automatically. In this case, under the subject and recipient in the header of the letter, the following information will appear:

Encrypt: This message is encrypted. Recipient can’t remove encryptions.
Permission granted by: username

Disable all third-party Add-ins/Plugins in Outlook

If encrypted emails are opened in the OWA web client, but not in the Outlook desktop, try to disable all third-party Add-ins/Plugins in Outlook.

1. Select File > Options from the menu;
2. Go to the Add-ins tab;
3. Disable all third-party add-ins (be sure to first disable the antivirus and firewall plugins);

   

4. Restart Outlook and check if encrypted emails are displayed.

Review Microsoft Purview Message Encryption Labels

Emails sent from a Microsoft 365 tenant can be automatically encrypted using sensitivity labels and mail flow (transport) rules. Sensitivity encryption label settings can restrict the list of users who are allowed to decrypt messages.

1. Go to Microsoft Purview compliance portal > Information protection > Labels > find your label that is used for message encryption;
   

   

2. Check which users or groups should be able to access email messages with the label set;
3. Verify that the user who cannot decrypt the email has permissions to view the content;
   

   

4. This is where you can grant permissions to decrypt messages to specific e-mail addresses or domains, or to any authenticated user (which is less secure).

Check Message Delivery Status

Before troubleshooting Outlook, Microsoft Purview Message Encryption, or Azure Rights Management issues, you should check if the encrypted message was successfully delivered to the recipient mailbox.

First, connect to Exchange Online PowerShell:

Connect-ExchangeOnline

Now search for the message delivery status:

Get-MessageTraceV2 `
-RecipientAddress user@contoso.com `
-StartDate (Get-Date).AddDays(-7) `
-EndDate (Get-Date)

Review the trace results and identify the message. Then retrieve detailed transport info:

Get-MessageTraceDetailV2 `
-MessageTraceId <MessageTraceId> `
-RecipientAddress user@contoso.com

The V2 cmdlets support a larger historical search window (up to 90 days, queried in smaller time ranges), making them better suited for investigating older mail delivery issues than the legacy cmdlets.

Note. This article uses the modern Get-MessageTraceV2 and Get-MessageTraceDetailV2 cmdlets. The legacy Get-MessageTrace and Get-MessageTraceDetail cmdlets have been deprecated by Microsoft and you should not use them longer in new scripts.

At this step you should check whether:

• The message was successfully delivered;
• An Exchange Online transport rule applied encryption;
• The message was redirected, quarantined, or rejected;
• Delivery failures occurred before the recipient attempted to open the encrypted email.

In case the message was never delivered successfully, troubleshooting Outlook, OWA, authentication, or Microsoft Purview encryption settings will not resolve the problem. You should always verify successful message delivery first.

We Can’t Display Your Encrypted Message Right Now in Outlook

In some cases, when authenticating with a Microsoft account or one-time passcode, you may receive errors:

An error has occurred.  We’re sorry. An unknown error has occurred. Please try again later.

Or:

Sorry, we can’t display your message right now. Something went wrong and your encrypted message couldn’t be opened. Please try again by following the instructions in the original email message in 5 minutes.

In some scenarios, encrypted emails cannot be opened due to multiple possible causes beyond Outlook add-ins/OWA MIME config. These common root causes include authentication token issues, Azure Active Directory sign-in failures, Conditional Access restrictions, expired/invalid Rights Management (IRM) licenses, or misconfigured Microsoft Purview/Azure Information Protection policies.

Connect to your Exchange Online tenant using the Exchange Online PowerShell:

Connect-ExchangeOnline

Set the current OWA policy settings:

$owapolicy = Get-OwaMailboxPolicy

List the current associations for MIME file types:

$owapolicy|select *MimeTypes*

Reset text/html MIME types to default (Legacy/Advanced method):

Set-OwaMailboxPolicy -AllowedMimeTypes @{remove = "text/html"} -BlockedMimeTypes @{remove = "text/html"} -ForceSaveMimeTypes @{add = "text/html"} -Identity $owapolicy.Identity

Note that Outlook add-ins and OWA MIME config should be treated as secondary checks (only after verifying authentication and policy-level access).

OWA MIME type config problems are rarely related to MS Purview Message Encryption failures. You should only check if OWA fails to render multiple HTML-based emails (not specifically encrypted messages).

In case the problem persists, you need to try the following additional checks:

• Azure AD authentication issues related to expired tokens, broken sign-in session
• Conditional Access policies may be blocking external/unmanaged devices
• Azure Rights Management (RMS) service is unavailable/misconfigured
• Required Microsoft Purview/Information Protection licenses are missing
• User is not in allowed group due to Microsoft Purview sensitivity label restrictions
• Corrupted Outlook profile/Exchange Online mailbox sync issues
• The user opened message under different account than intended
• External recipient not completing OTP/Microsoft account verification flow

Verifying Azure Rights Management Config

Microsoft Purview Message Encryption relies on Azure Rights Management Services (RMS) to issue decryption licenses and enforce message protection policies. In case RMS is misconfigured/unavailable, you may be unable to open encrypted messages even when Outlook and authentication are functioning correctly.

To connect to the Azure Information Protection service, run the command:

Connect-AipService

Review the current Azure Rights Management config with the command:

Get-AipServiceConfiguration

Now check that:

• Azure Rights Management is activated for the tenant;
• Rights Management templates are available;
• No recent configuration changes have affected encryption policies;
• Users have appropriate licenses assigned for Microsoft Purview Information Protection features.

You can also review Rights Management settings through the Microsoft Purview portal:

1. Open Microsoft Purview compliance portal;
2. Navigate to Information Protection;
3. Review Rights Management and encryption policy settings;
4. Check if the required protection templates and labels are available.

In case Azure Rights Management is unavailable/incorrectly configured, Outlook and Outlook on the web may fail to acquire a decryption license and encrypted messages cannot be opened.

Checking Microsoft Entra Conditional Access Policies

Keep in mind that Microsoft Purview Message Encryption requires successful authentication to Microsoft Entra ID before a decryption license can be issued. In many environments, Conditional Access policies may prevent users from accessing encrypted messages even when the message was delivered successfully.

Common Conditional Access cases that may block encrypted email access include:

• Unmanaged/non-compliant devices;
• Geographic location restrictions;
• Multi-Factor Authentication (MFA) requirements;
• Sign-in risk policies;
• Guest/external user restrictions;
• Session controls that block browser-based access.

In case you receive errors such as Sorry, we can’t display your message right now or Something went wrong and your encrypted message couldn’t be opened, you need to review the user’s Microsoft Entra sign-in logs.

First, connect to Microsoft Graph PowerShell with the command:

Connect-MgGraph -Scopes AuditLog.Read.All Directory.Read.All

Now review recent sign-in events using the following command (ensure you are connected to the correct tenant):

Get-MgAuditLogSignIn `
-Filter "userPrincipalName eq 'cyril@theitbros.com'" `
-Top 50

Here you need to check for:

• Conditional Access failures;
• MFA challenges that were not completed;
• Blocked sign-in attempts;
• Device compliance failures;
• Guest access restrictions.

You can also review sign-in activity in the Microsoft Entra admin center:

1. Open Microsoft Entra admin center;
2. Go to Identity > Monitoring & Health > Sign-in logs;
3. Here locate the affected user;
4. Review Conditional Access and authentication details for failed sign-ins.

Note that Conditional Access policies are one of the most common causes of Microsoft Purview Message Encryption access failures (particularly for external recipients and users accessing email from unmanaged devices).

Note that in case Conditional Access blocks token issuance, Microsoft Purview Message Encryption will fail even if the message is successfully delivered and RMS is healthy.

View Encrypted Microsoft 365 Email on iOS and Android

If you want to use an iOS/Android mobile device to read secure emails, be sure to install and use Outlook for Mobile. The native iOS email app doesn’t support encrypted emails from Microsoft 365.

Note that iOS native Mail does not natively support OME encrypted message rendering. But external recipients can still open encrypted emails: they can do that via a secure web browser session triggered from the message link.

When you receive an encrypted message in alternative application, you will see the following text (and the encrypted message file with the *.rpmsg extension — Rights-Managed Email Message will be attached to the email):

This message is protected with Microsoft Information Protection. You can open it using Microsoft Outlook, which is available for iOS, Android, Windows, and Mac OS. Get Outlook for your device.

Microsoft Information Protection allows you to ensure your emails can’t be copied or forwarded without your permissions.