iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
When Outlook refuses to send an encrypted message, the cause depends on which encryption method you selected. Outlook supports two separate systems:
- S/MIME uses digital certificates. The recipient’s public certificate is needed to encrypt a message for that person.
- Microsoft Purview Message Encryption uses Microsoft 365 rights-management protection. It can send protected mail to external addresses without requiring the recipient to install an S/MIME certificate.
They have different buttons, prerequisites, error messages, and fixes. Start by identifying which method you are using, then follow the relevant section below.
First, identify the encryption method
| What you selected | Encryption system | Main requirement |
|---|---|---|
Encrypt this message (S/MIME) |
S/MIME | A usable sender certificate and the recipient’s public certificate |
Options > Encrypt, then Encrypt or Do Not Forward |
Microsoft Purview Message Encryption | A qualifying Microsoft 365 license and an administrator-enabled protection service |
S/MIME is certificate-based encryption. It is usually used where an organization has issued digital IDs to its users. Purview encryption is controlled by Microsoft 365 and can protect messages sent to people outside the organization, including Gmail and Yahoo addresses.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not try to combine both systems on one message. Microsoft advises removing S/MIME signing or encryption before applying Purview IRM protection, and removing IRM protection before applying S/MIME protection.
#1 Best Overall
- Ergonomic Posture Correction: Designed to elevate your laptop to the perfect eye level, this adjustable laptop stand significantly reduces neck, shoulder, and spinal fatigue. Transform your desk into a healthier workstation, ideal for long hours of typing, Zoom meetings, or gaming.
- Unshakable Dual-Rod Stability: Unlike single-hinge models, our stand features a highly engineered dual-support rod mechanism. It perfectly distributes weight to ensure a 100% wobble-free typing experience, safely supporting heavy-duty devices up to 22 lbs (10kg).
- Advanced Thermal Cooling Panel: Maximize your device's performance. The unique geometric heat-vent design on the upper panel provides superior airflow compared to standard solid stands. This continuous heat dissipation prevents your laptop from thermal throttling and hardware damage during intensive tasks.
- Universal 10-16” Compatibility: A versatile computer riser that seamlessly fits all 10 to 16-inch laptops. Broadly compatible with MacBook Pro/Air, Dell XPS, HP, Lenovo, ASUS, Chromebook, and large gaming laptops. The anti-slip silicone pads firmly grip your device and protect it from scratches.
- Foldable, Portable & Ready to Go: Maximize your productivity anywhere. The dual-foldable design allows the stand to collapse completely flat in seconds. Easily slip it into your backpack or briefcase, making it the ultimate portable office accessory for business trips, cafes, or hybrid work setups.
Check the Microsoft 365 license and account
Purview Message Encryption is not guaranteed to be available in every Outlook account. Microsoft documents Office 365 Enterprise E3 as a qualifying license for Microsoft 365 Message Encryption. Your organization may also use another qualifying subscription or an administrator-controlled configuration.
If the Encrypt button is missing, or Outlook reports that you cannot use the required permission, ask your Microsoft 365 administrator to check:
- Whether the account signed in to Outlook has a qualifying license.
- Whether Microsoft Purview Message Encryption or Azure Rights Management is enabled for the tenant.
- Whether an administrator policy has removed the protection level you need.
- Whether you are using the correct work or school account.
A user cannot add a missing Purview permission level locally. If the account is unlicensed or the service is disabled, changing Outlook’s local settings will not fix the problem.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fix S/MIME sending problems
1. Install and verify the certificate
S/MIME requires a certificate that contains the private key for your account. Outlook must also be able to access the recipient’s public certificate. In New Outlook, certificates and digital IDs are not automatically installed. Install the certificate manually, or have your administrator deploy it through policy.
If the certificate is stored on a smart card, insert the card before sending. Outlook may also ask for the card’s PIN.
For an external recipient, Microsoft specifically requires the recipient’s certificate to be installed on the local computer. A contact entry or an ordinary email address is not enough for S/MIME encryption.
2. Obtain the recipient’s public certificate
Outlook cannot encrypt an S/MIME message for a recipient if it has no usable public certificate for that address. Common ways an organization obtains it include:
Rank #2
- Broad Compatibility: Besign LS03 Laptop Mount is compatible with all laptops from 10''-15.6'', such as Air 13, Pro 13 / 15 / 2018 / 2017 / 2016, Lenovo ThinkPad, Dell, HP, ASUS, Chromebook, and other notebooks.
- Ergonomic Design: This LS03 Laptop Stand could elevate your laptop by 6’’ to a perfect viewing level, help you improve your posture and reduce neck and shoulder pain. This laptop stand is super easy to detach and assemble.
- Stable And Protective: This laptop stand is made of premium Aluminum alloy, it is sturdy, support up to 8.8 lbs(4kg), no worry any wobble at all; the rubber on the holder hands sticks tightly, ensure your laptop stable on the stand and prevent any scratches.
- Keep Laptop Cool: the open aluminum design provides good ventilation and airflow to prevent your laptop from overheating. It folds flat if you need to store it, create extra space on your desk and keep your desk clean and organized.
- Easy to Use: thanks to the detachable design, you could assemble it very easily it 3 steps.
- Receiving a digitally signed message from the recipient and saving the certificate from that message.
- Using an organization directory or certificate directory.
- Importing the certificate supplied by the recipient’s IT department.
The certificate must match the email address you are using. A certificate issued for another address, an expired certificate, or a certificate that has been revoked can trigger an encryption failure.
3. Check the exact error in the Encryption Problems dialog
The S/MIME Encryption Problems dialog can identify missing, invalid, conflicting, or unsupported recipient capabilities. Do not automatically choose Send unencrypted if the message must remain protected.
There is one documented false positive: the sender’s S/MIME certificate uses RSA and the recipient’s certificate uses ECC. In that specific combination, Microsoft says selecting Continue sends the message encrypted even though Outlook displays the warning. This behavior is suppressed in Outlook for Microsoft 365 version 16.0.18227.20000 and later. The suppression does not apply to genuinely missing or invalid certificates.
If your organization has confirmed that the warning is only the RSA/ECC mismatch, Microsoft documents this per-user registry setting:
HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0OutlookSecurityCreate a DWORD value named:
SkipProblemsDialogForDhCertMismatchSet it to:
1Restart Outlook afterward. For domain-joined users, the documented policy location is:
HKEY_CURRENT_USERSoftwarePoliciesMicrosoftOffice16.0OutlookSecurityDo not use this setting as a general workaround for certificate errors. It is intended for the documented certificate-capability mismatch.
4. Send one S/MIME message using the correct menu
The menu differs between Outlook versions.
New Outlook for Windows
- Start a new message.
- Select
Options > More Options > Message options. - Select
Encrypt this message (S/MIME). - If required, select
Digitally sign this message (S/MIME). - Select OK, then send the message.
You can also request read and delivery receipts in the same dialog. A receipt request requires Digitally sign this message (S/MIME) to be selected.
Rank #3
- ✔️[Foldabe & Protable] - Foldable laptop stand for desk & Protable computer stand, It combines the advantages of market brackets, convenient travel laptop stand. Easy to use. Suitable for working at home, office and outdoor, improve comfort.
- ✔️[360°Rotation] - The computer stand with 360° rotating base, 360° rotation connected with the base is more flexible, the computer stand allows you to rotate the laptop to any angle.
- ✔️[Stable & Durable] - The Computer stand is made of one-piece fiber metal material, which is more durable and stable than ordinary aluminum alloy computer stands. The upgraded rotating base makes the stand performance more stable, and the non-slip silicone protects the laptop from sliding.Only supports laptops up to 16 inches.
- ✔️[Ergonmic Desing] - You can freely adjust the height and angle of the laptop stand to keep it at eye level, which helps to reduce the pressure on your body while working. Whether sitting or standing, there is a comfortable angle.
- ✔️[Wide Compatibility] - Our laptop stand is compatible with all laptops from 10-16 inches, such as MacBook Air/Pro, Google PixelBook, Dell XPS, HP, ASUS, Lenovo ThinkPad, Acer, Chromebook and Microsoft Surface, etc. It is an ideal companion for computer workers.
Outlook on the web
- Compose the message.
- Select
More options > Message options. - Choose
Encrypt this message (S/MIME). - Optionally select the digital-signature and receipt options.
- Send the message.
5. Turn on S/MIME for every outgoing message
If every message from the account needs S/MIME protection, use the all-message setting rather than selecting encryption manually each time.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In New Outlook or Outlook on the web, after the S/MIME control and certificate are installed, open:
Settings > Mail > S/MIME
Available settings include:
Encrypt contents and attachment for all messages I sendAdd a digital signature to all messages I sendAutomatically choose the best certificate for digital signing
In classic Outlook for Windows, open:
File > Options > Trust Center > Trust Center Settings > Email Security
Under Encrypted email, select Encrypt contents and attachments for outgoing messages. Select Settings to choose or change the certificate and related options.
Fix Purview Message Encryption sending problems
Use the correct one-message path
In New Outlook, compose the message and select:
Options > Encrypt
Choose an available protection level, such as:
- Encrypt — protects the message and attachments.
- Do Not Forward — applies a stronger restriction on forwarding and use of the content.
In classic Outlook for Windows, open a message, select:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOptions > Encrypt
Choose the required restriction, such as Do Not Forward, and then select Send.
If these controls are absent, the issue is normally licensing, tenant configuration, Outlook account selection, or an administrator policy—not a missing certificate.
Rank #4
- 【Adjustable & Ergonomic】：This laptop stand can be adjusted to a comfortable height and angle according to your actual needs, letting you fix posture and reduce your neck fatigue, back pain and eye strain. Very comfortable for working in home, office and outdoor.
- 【Sturdy & Protective】 ：Made of sturdy metal, it can support up to 17.6 lbs (8kg) weight on top; With 2 rubber mats on the hook and anti-skid silicone pads on top & bottom, it can secure your laptop in place and maximum protect your device from scratches and sliding. Moreover, smooth edges will never hurt your hands.
- 【Heat Dissipation】 ：The top of the laptop stand is designed with multiple ventilation holes. The open design offers greater ventilation and more airflow to cool your laptop during operation other than it just lays flat on the table.
- 【Portable & Foldable】：The foldable design allows you to easily slip it in your backpack. Ideal for people who travel for business a lot.
- 【Broad Compatibility】：Our desktop book stand is compatible with all laptops from 10-15.6 inches, such as MacBook Air/ Pro, Google Pixelbook, Dell XPS, HP, ASUS, Lenovo ThinkPad, Acer, Chromebook and Microsoft Surface, etc.Be your ideal companion in Home, Office & Outdoor.
Pop out replies from the Reading Pane
When replying from the Reading Pane, Outlook may not show the permission control. Use this sequence:
- Select the Pop out icon above or beside the Reading Pane.
- In the separate message window, select Options.
- Select Permission.
- Choose the available protection level and send the reply.
Check whether the simplified Encrypt experience is disabled
Microsoft 365 administrators can control the simplified encryption interface in Outlook on the web. If it has been disabled, users may not see the expected Encrypt experience.
An administrator with sufficient Exchange Online PowerShell permissions can check or change the setting. Microsoft documents the command to disable the simplified client experience as:
Set-IRMConfiguration -SimplifiedClientAccessEnabled $falseThe underlying Purview Message Encryption service can be disabled with:
Set-IRMConfiguration -AzureRMSLicensingEnabled $falseThese are tenant-level administrative commands. Do not run them as a standard user, and do not change them merely to fix one mailbox without confirming the organization’s protection policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When the recipient cannot open the encrypted message
Purview-encrypted mail sent outside the organization
Purview encryption can send protected mail to external recipients. Depending on the recipient’s client and your tenant’s policy, the recipient may see instructions or a Read the message link that opens the Microsoft Purview message-encryption portal. They may authenticate with their account or follow the portal’s verification process.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA desktop Outlook recipient can sometimes see a blank body or a Read the message link instead of the message contents. Microsoft identifies one cause as the recipient’s Outlook client being unable to connect to the Exchange Online tenant’s Microsoft Azure Information Protection endpoint. In that case, opening the message through the portal or using Outlook on the web may work.
Best Value
- ✅【Adjustable & Ergonomic】：This laptop stand can be adjusted to a comfortable height and angle according to your actual needs, letting you fix posture and reduce your neck fatigue, back pain and eye strain. Very comfortable for working in home, office and outdoor.
- ✅【Sturdy & Protective】 ：Made of sturdy metal, it can support up to 17.6 lbs (8kg) weight on top; With 2 rubber mats on the hook and anti-skid silicone pads on top & bottom, it can secure your laptop in place and maximum protect your device from scratches and sliding. Moreover, smooth edges will never hurt your hands.
- ✅【Heat Dissipation】 ：The top of the laptop stand is designed with multiple ventilation holes. The open design offers greater ventilation and more airflow to cool your laptop during operation other than it just lays flat on the table.
- ✅【Portable & Foldable】：The foldable design allows you to easily slip it in your backpack. Ideal for people who travel for business a lot.
- ✅【Broad Compatibility】：Our laptop holder is compatible with all laptops from 10-17.3 inches, such as MacBook Air/ Pro, Google Pixelbook, Dell XPS, HP, ASUS, Lenovo ThinkPad, Acer, Chromebook and Microsoft Surface, etc.Be your ideal companion in Home, Office & Outdoor.
If there is no Read the message link and the recipient cannot open the mail, use this sequence:
- Verify the recipient has an Internet connection.
- Check whether the encrypted message contains the Read the message link.
- If the link is absent, contact the original sender. The sender’s tenant or message policy may need attention.
S/MIME mail sent outside the organization
S/MIME recipients need a compatible mail client and the matching private key and certificate. This is fundamentally different from Purview encryption: an external recipient cannot open an S/MIME message simply by clicking a Microsoft portal link unless the particular delivery flow provides that option.
Confirm that the recipient has:
- The private key corresponding to the certificate used for encryption.
- A mail client that supports S/MIME.
- A certificate that is valid and associated with the intended address.
One-time passcodes used to open some S/MIME-related encrypted content can expire after 15 minutes. If the code has expired or the opening process fails, reopen the attachment and restart the process.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fast diagnostic checklist
| Symptom | Most likely cause | What to do |
|---|---|---|
Encrypt this message (S/MIME) is unavailable |
S/MIME control or certificate is not installed | Install the digital ID manually or ask an administrator to deploy it. |
| Encryption Problems says the recipient has no certificate | The recipient’s public certificate is missing or unavailable | Obtain and install a valid certificate for the exact email address. |
| RSA sender and ECC recipient trigger a warning | Documented S/MIME capability mismatch false positive | After confirming the certificate types, select Continue, not Send unencrypted. |
Options > Encrypt is missing |
License, tenant configuration, or administrator policy | Ask the Microsoft 365 administrator to verify Purview licensing and IRM settings. |
| Permission is missing only on a reply | Reply is being composed in the Reading Pane | Pop out the reply, then use Options > Permission. |
| External recipient sees a blank body | Recipient Outlook cannot reach the tenant’s AIP endpoint | Use the Purview portal or Outlook on the web; involve the sender’s administrator if necessary. |
| Both S/MIME and Purview controls are being used | Incompatible protection methods are being layered | Remove one protection method before applying the other. |
What not to assume
- The recipient does not always need an S/MIME certificate. That requirement applies to S/MIME, not Purview Message Encryption.
- An Encryption Problems warning does not always mean the message must be sent unencrypted. The RSA/ECC combination is a documented exception.
- New Outlook does not automatically install digital IDs or certificates.
- The Encrypt button is not controlled solely by Outlook’s local installation. Microsoft 365 licensing and administrator policy can determine whether it exists.
FAQ
Why can I not send an encrypted email from Outlook?
The cause is usually a missing S/MIME certificate or recipient certificate, an invalid certificate, a missing Microsoft 365 license, or an administrator policy that disables Purview Message Encryption. Identify whether you selected S/MIME or the Microsoft 365 Encrypt command before troubleshooting.
Does the recipient need a certificate for an encrypted Outlook email?
Only for S/MIME encryption. S/MIME requires the recipient’s public certificate and the recipient needs the matching private key to read the message. Purview Message Encryption can send protected mail to external addresses and may direct the recipient to the Microsoft Purview portal.
What should I select in Outlook’s Encryption Problems dialog?
Check the reported certificate issue first. If Microsoft’s documented RSA-sender/ECC-recipient mismatch is confirmed, select Continue to send the message encrypted. Do not select Send unencrypted when protection is required. For missing or invalid certificates, fix the certificate instead.
Why is Encrypt missing from Outlook?
Purview encryption may be unavailable because the account lacks a qualifying Microsoft 365 license, the service is disabled, or an administrator policy has removed the permission level. A standard user cannot add an unavailable permission locally.
How do I encrypt a reply in Outlook when Permission is missing?
Select the Pop out icon to open the reply in a separate window. Then select Options > Permission and choose the available protection level.
Can I use S/MIME and Purview encryption on the same email?
No. Microsoft advises removing S/MIME signing or encryption before applying Purview IRM protection, and removing IRM protection before applying S/MIME protection.
The Bottom Line
Separate the problem into two paths: S/MIME needs certificates, while Purview Message Encryption needs Microsoft 365 licensing and tenant configuration. For S/MIME, verify both your certificate and the recipient’s public certificate. For Purview, check the account license, administrator policies, and the Options > Encrypt menu. If the recipient is external, Purview usually offers the simpler delivery path because it can use the Microsoft message-encryption portal instead of requiring an S/MIME certificate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
