Outlook Classic for M365 - File > Encrypt > 'Encrypt-Only' option applies 'Do Not Forward' label?

Would suggest taking a look at the following:

1. Review Sensitivity Label Configuration in Purview

• Go to Microsoft Purview portal > Information Protection > Labels.
• Check the Encrypt-Only label:
• Ensure it’s not configured with “Do Not Forward” permissions.
• Confirm it’s published to the correct users/groups.
• Verify that Outlook and OWA are selected under “Apps that support this label.”

2.  Check Outlook Client behavior

• Ensure users are on the latest Outlook Classic build.
• Clear Outlook cache and restart the client.
• Optionally, check registry keys under:

HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Common\Security

Look for any overrides related to IRM or encryption.

3. Test with a Clean Profile

• Create a new Outlook profile and test the File > Encrypt > Encrypt-Only path.
• If it works correctly, the issue may be profile-specific or cached label metadata.

4. Consider Disabling Legacy IRM Mapping

• If your org migrated from legacy IRM templates, they may still be influencing behavior.
• You can disable legacy IRM mapping via PowerShell:

Set-IRMConfiguration -SimplifiedClientAccessEnabled $true

5. Educate Users to Use the Options Ribbon

• Until resolved, recommend users always use the Options ribbon > Encrypt method.
• You can even customize the ribbon or disable the File > Encrypt path via GPO or UI customization.

Apply encryption using sensitivity labels | Microsoft Learn