O365 Email Encryption to internal tenants not working

[Rmartin0000]

Hi,

We are using O365 Business Premium E1 license.....We've created new exchange rule for encryption for one of the test user only and assigned the Right mgmt license to that specific user but while sending an email with encrypt option enabled it works only for Gmail services whereas internal tenants and Hotmail appears plain text with a mail tip.

checked the rule is correctly configured but Right mgmt service shows disabled tried to manually activate the service but didn't work so we've raised the ticket to Microsoft to investigate on this and as per their confirmation, Encryption works only 3rd party services like Gmail not for own domain users and Hotmail.

However, I disable the encryption rule and remove the Right mgmt license to everyone yet all users can still able to send encrypt msg to Gmail and it works but not for internal users and Hotmail, I've attached the IRM test config for your easy reference, kindly review and advice if this is normal or do I need to do some changes in order to work 

Appreciate your support.

Thank you

[#2]

Have you gone through this article? https://docs.microsoft.com/en-us/microsoft-365/compliance/set-up-new-message-encryption-capabilities...

[#3]

Thank you @ChristianJBergstrom 

As said, Right mgmt service still disable whereas IRM config says pass result, pls. find attached snapshot.

[#4]

Are your org in cloud-only? Have you migrated to unified labeling from AIP classic? What's the outcome with Get-AipService? https://docs.microsoft.com/en-us/azure/information-protection/what-is-azure-rms

Do you want to use the new OME for encryption of email and attached documents only, or sensitivity labels for all services? (AIP)

[#5]

@ChristianJBergstrom 

Would like to know, Is there a way to encrypt email for internal tenants either outlook client / web based? regards to the AIP service pls. find below the outcome of AIP service.

[#6]

Hi, well it looks good at least from what's being attached and judging from what you're saying you only want to encrypt email. Encryption with built-in Office Message Encryption is using Azure RMS part of the AIP and it's seamless (no further action required) unless using other products than Microsoft. So when encrypting internally for example, you don't have to do anything. You can either let the users choose between the options DNF or Encrypt-only or using a mail flow rule. If you need further assistance I suggest you reach out to the official support.

[#7]

@ChristianJBergstrom 

our simple requirement is, to use encryption for both internal tenant & external domains irrespective of the platforms, same time we don't want all outgoing emails to be encrypt using exch. rule but selected users / group when needed.  currently encrypt is happening only for Gmail with or without exch. rule.

This issue is under investigation with MS since more than 2 months and based to their yesterday's confirmation, encrypt works only for 3rd party services like gmail not for internal / Hotmail. so would like to reconfirm if this is true?

[#8]

That is not true. Of course you can use encryption with both internal and external users. The difference with Gmail for example is that you receive a "wrapper" with direction to the OME portal (or OTP). That is not necessary with Outlook.com (Hotmail). If only wanting to encrypt email one just use Office Message Encryption but if wanting to encrypt content in the other services internally/externally there are sensitivity labels.

[#9]

@ChristianJBergstrom 

Thank you and appreciate your valuable suggestion!

Will check with MS on this and update accordingly.

[#10]

No worries, you can have this as a reference for the sensitivity labels https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption-sensitivity-labels?view=o365-wo... (general encryption)

And for OME https://docs.microsoft.com/en-us/microsoft-365/compliance/manage-office-365-message-encryption?view=... (only email)