External users cannot open encrypted email

[ashmelburnian]

Hi all, I searched the communities but couldn't find the answers I need in regards to Office 365 Message Encryption.

We have a customer that wants to send encrypted emails from Outlook.

When a non-Microsoft recipient (e.g. Gmail user) receives these emails they cannot open them. They get the following:

It's my understanding that external recipients should be able to view encrypted email as per this article.

Can someone please help?

The sending user has a Microsoft 365 Business Premium license, and Azure Information Protection is active under the 365 tenant.

Thanks

Ash

[#2]

@piekedahla Hello, well I have used and configured the new OME so that external users that are not using EXO for ex. but instead Gmail, Yahoo etc. use either a OTP or their Social ID sign-in, to enter the OME portal.

How does your IRM-config and OME-config and mail flow rules look like? You said you're using AIP now. That's quite different as OME only have the "Encrypt-Only" and "Do not Forward" as options. The other options you get from your client are based from AIP.

You can even force all external users to go to the OME portal Manage Office 365 Message Encryption - Microsoft 365 Compliance | Microsoft Docs 

Out of curiosity does the rule look similar to this? (sorry about the quality)

I suggest you reach out to Microsoft for tech assistance. Something is obviously not configured properly.

[#3]

@ChristianBergstrom 

Hi Folks just wondering if there is a simple fix to this yet? I am very much a non tech person just trying to help my wife send encrypted mail for her business via 365. All works fine as per the previous threads outlook to outlook but not with Gmail. All the advice in the previous threads looks too daunting for me to try! Hoping a simple fix has been found? Thanks Phil

[#4]

@ashmelburnian 

We had to move to Azure and start using the new encryption method.  When we made the change, encrypted messages sent to Gmail, Hotmail, Outlook, and other e-mail services could be decrypted.  Azure enabled the authentication needed to make the decryption process seamless.  Now, all is well.  Our external partners and collaborators can open and respond to secured messages sent to their corporate and personal accounts.

[#5]

@piekedahla 

Thanks for the reply. So a full switch to Azure rather that just the Azure access given to you via a 365 subscription?

[#6]

We had to migrate to Azure Information protection:

Set up new Message Encryption capabilities (https://docs.microsoft.com/en-us/microsoft-365/compliance/set-up-new-message-encryption-capabilities...)

Important
If you use Active Directory Rights Management service (AD RMS) with Exchange Online, you need to migrate to Azure Information Protection before you can use the new OME capabilities. OME is not compatible with AD RMS.

[#7]

@ashmelburnian I am with you.  Microsoft and Google need to work together on this.

I use Gmail.  When an outlook user sends me an email I get this.

If I click the message.html attachment I get a new Chrome window with this message.

If I download the message.html and doubleclick/run the file it does nothing different that if I click the file from within Gmail (i.e. it opens a new chrome window/tab) like this.

Now I have to sign in with my Microsoft account to see the message.

My issues is the I'm already signed in to my Microsoft account with "stay signed in checked" so when I get an encrypted message in Gmail just display the freaking message.  I'm already signed in to my Microsoft account so stop making me jump through hoops to see the message.  Sometimes I get a couple dozen encrypted messages a day and I have to go through the ridiculous process for every single message.