How to enforce email confidentiality in Exchange

Introduction

The “Private” sensitivity level in Outlook is a property of the message. In transit, it is represented by the SMTP header “Sensitivity: Private”, which Exchange maps to the MAPI sensitivity property on delivery. Mail flow rules (transport rules) have a native action to set a message header (“SetHeaderName” / “SetHeaderValue”), so it is possible to apply the “Sensitivity: Private” header server-side.

But this header is only a courtesy indicator, not a security mechanism ; its behavior depends on the client application used. Hiding private emails only works reliably in the classic version of Outlook for Windows. The “new Outlook” and OWA display private emails without restriction to anyone with full access (Full Access).

Prerequisites

Administrator role

• An account with the Global Administrator or Exchange Administrator role to access the Exchange Admin Center.

Other

• Microsoft Purview Message Encryption enabled.

Step 1 : Sign in to the Exchange Admin Center

Sign in to the Exchange Admin Center by opening your web browser to https://admin.exchange.microsoft.com.

Step 2 : Create a transport rule

In the left menu, click Mail flow, then Rules, and Add a rule to create a new rule.

Apply the following settings to the rule :

• Condition #1 : “The sender is a member of this group” and choose the group containing the management team members.
• Condition #2 : “The recipient is a member of this group” and choose the group containing the other relevant members (or all internal people).
• Action #1 : “Modify the message properties”, “set a message header”, and assign the value Private to the Sensitivity header.

Step 3 : Test the behavior in Outlook

Here, a user who is a member of the Exchange_Private_Associates group sends an email to a member of the Exchange_Private_Management group without assigning the “Private” attribute.

The management team member receives the email with a “Private” tag automatically added …

… but the delegate sees the content of the email without any restriction, through the delegation. The “Private” mode does not apply on the new Outlook version or on the web version.

Step 4 : Enable encryption

Edit the Exchange rule and add a setting :

• Action #2 : “Modify the message security”, “Apply Office 365 Message Encryption and rights protection”, and choose Encrypt.

Step 5 : Sign in to Microsoft Exchange Online in PowerShell

Sign in to Microsoft Exchange Online via the following PowerShell command :

Connect-ExchangeOnline

Step 6 : Block access to protected messages

Block delegates’ access to messages protected by IRM (Information Rights Management) via the following PowerShell command :

Set-MailboxIRMAccess -Identity User.3@hiez.ca -User User.1@hiez.ca -AccessLevel Block

Results

The delegate sees the new emails come in, but this time they are encrypted and unreadable. Emails carrying the “Private” attribute before the encryption setup are not affected by this configuration and remain visible.

Conclusion

You now know how to enforce email confidentiality in Exchange Online.

Sources

Microsoft Learn - Set-MailboxIRMAccess

Did you enjoy this post ? If you have any questions, comments or suggestions, please feel free to send me a message from the contact form.

Don’t forget to follow us and share this post.