Outlook Encrypt vs Do Not Forward vs Confidential: What Each One Actually Does

Open a new message in Outlook, go to Options → Encrypt, and you get a short list that looks self-explanatory and is not: Encrypt, Do Not Forward, and — in many companies — labels such as Confidential and Highly Confidential.

They do quite different things, and the difference that matters most is not the one in their names.

Based on Microsoft’s documentation as of September 2026. Microsoft renames these options from time to time; the behaviour below is what they do, whatever they are called in your version.

The short answer

• Encrypt (called Encrypt-Only in business settings) encrypts the message in transit and at rest. The recipient can still forward, print and copy it.
• Do Not Forward encrypts it and tells the recipient’s email software not to forward, print or copy it. Office attachments stay protected even after they are downloaded.
• Confidential is not a built-in option. It is a sensitivity label your organisation’s administrator created, and it does whatever they configured — which may be the same as Do Not Forward, or may be nothing more than a marking.

Encrypt: private on the way, free once it arrives

Encrypt is the right choice when the problem is the journey — you do not want the content sitting readable on mail servers or in transit — but you are happy for the recipient to do anything they like with it once they have it.

Things to know:

• The recipient can forward it, print it and copy from it.
• Attachments download unprotected. Once saved, a file is an ordinary file.
• A recipient outside Microsoft 365 — a Gmail address, say — reads it in Microsoft’s encrypted message portal, signing in with their own Google or Yahoo account or with a one-time passcode.

Do Not Forward: the restrictions follow the message

Do Not Forward adds usage restrictions on top of the encryption. In Outlook the Forward button disappears, Print and Save As are unavailable, and the recipient cannot add people to the conversation.

Two details that are easy to miss:

• Office attachments stay protected after download. If the recipient saves a Word, Excel or PowerPoint file and emails it to someone else, that person cannot open it.
• PDFs and images are a different story. Microsoft’s own documentation for home users says PDFs and images download unencrypted under Do Not Forward. In business tenants an administrator can switch on PDF encryption; unless yours has, a PDF behaves like an ordinary file the moment it is saved.

Confidential: read the label before you trust it

“Confidential” and “Highly Confidential” are sensitivity labels, defined by your organisation in Microsoft Purview. A label can apply encryption, block forwarding, add a watermark, or simply stamp the word Confidential on the message — all of them are possible, and the name alone does not tell you which.

This catches people out. Microsoft’s own support forums include administrators discovering that their “Confidential” labels carried no forwarding restriction at all. If you are about to rely on a label, ask your IT team what it actually does, or test it by sending one to yourself and trying to forward it.

What none of them does

This is the part the option names hide.

None of them stops a screenshot. Microsoft says so plainly. Information Rights Management — the mechanism underneath Do Not Forward — “can’t prevent restricted content from being hand-copied or retyped, or prevent a digital photograph or screen capture being taken of the restricted content.” Do Not Forward limits what the recipient’s software will do. It cannot limit what the recipient can see, and a second phone photographs anything.

None of them is end-to-end encryption. Microsoft’s service holds the keys by default (organisations can bring their own key), so the provider is part of the trust. That is the same position as Gmail’s confidential mode — see Is Gmail Confidential Mode Actually Secure? — and it is fine for most business mail, as long as nobody describes it as something it is not.

None of them works without a licence. Microsoft Purview Message Encryption comes with Microsoft 365 Business Premium and the E3 and E5 plans, and can be added to Business Basic and Business Standard. Home users with Microsoft 365 Personal or Family get Encrypt and Do Not Forward in Outlook.com and Outlook. If the Encrypt button is missing, the licence is usually why.

Which one to use

When the thing you are sending is a password, not a document

Email encryption is built for documents and correspondence. For a credential — a password, an access code, a bank detail for one colleague — the problems are different: you want it to open on one named person’s device, not in whatever inbox it lands in, and you want to be able to take it back.

That is the case WaxSeal is built for. The secret is encrypted on the sender’s device for the recipients’ devices; the vault holds ciphertext it cannot read; and what you send is an ordinary photo carrying a short reference, in any chat or in email. There is no portal link to click, and a forwarded photo opens for nobody else. The sender can set it to open once, expire, or need a PIN given by phone, and can revoke it afterwards. Those controls govern future access — like every option on this page, they cannot un-show what has already been read.

WaxSeal carries text, not documents. For a contract or a tax return, Outlook’s Do Not Forward is the right tool; for the password that opens the portal the contract lives in, it is not. More on handing over credentials in How to Send a Password Securely.

The short version

1. Encrypt protects the journey. The recipient can still forward, print and copy.
2. Do Not Forward adds restrictions that follow the message and its Office attachments — not its PDFs or images, unless your admin enabled PDF encryption.
3. Confidential is a label; it does whatever your organisation configured. Check before you trust it.
4. None of them stops a screenshot, and none is end-to-end encryption.