Businesses that handle private information, such as medical offices, law firms and tax preparers, often send it as an encrypted (protected) email from Microsoft 365. This guide is for the person receiving it: how to open the message, read any attachments and reply, whatever email service you use.
What the email looks like
Depending on your email service, you’ll see one of two things:
- The message opens normally. If you use Outlook with a Microsoft 365 or Outlook.com account, the message usually just opens, with a banner saying it’s encrypted or that you can’t forward it.
- A short email with a button. Gmail, Yahoo, iCloud and most other services get an email saying the sender has sent you a protected message, with a Read the message button. The private content isn’t in this email; it waits on Microsoft’s secure page.
Before you click, check that you were expecting a message from that person. If in doubt, call them on a number you already have. Scammers sometimes copy these emails to steal passwords (see How to spot and report a phishing email).
Open it from Gmail, Yahoo or another email service
- Open the email and click Read the message. A new browser tab opens on Microsoft’s secure page. The message won’t show inside Gmail itself.
- Choose how to confirm it’s you:
- Sign in with Google (Gmail), Sign in with Yahoo, or Sign in with Microsoft, if one of those matches your email address. Sign in as you normally would.
- Otherwise, choose Sign in with a one-time passcode.
- If you chose the passcode, Microsoft emails a short code to the same address. Open that email (check your spam or junk folder if it hasn’t arrived after a minute), copy the code and enter it on the secure page, then click Continue.
- The message and its attachments open in your browser. Click an attachment to view or download it.
The passcode only works for a short time and only once. If it has expired, go back to the original email, click Read the message again and request a new one.
Open it on a phone
- Outlook app (iPhone or Android): with a Microsoft 365 or Outlook.com account, the message usually opens in the app. If it asks, tap View message and sign in.
- Gmail, Yahoo or the built-in Mail app: tap Read the message. The secure page opens in your phone’s browser; then follow the same steps as above.
Reply or forward
- Reply from the secure page with Reply or Reply all. Your reply goes back encrypted, and the sender sees it in their Outlook. Reply from there rather than writing a new email from your own inbox, which would not be encrypted.
- Forward and print may be turned off. If the sender chose Do Not Forward, the message can’t be forwarded, copied or printed. That’s on purpose; ask the sender if you need a copy for someone else.
If it won’t open
| What happens | What to do |
|---|---|
| The passcode email never arrives | Check spam or junk, wait a minute, then request a new code from the secure page. |
| “This code has expired” or it’s rejected | Request a new code; use only the newest one. |
| It asks you to sign in to an account you don’t have | Go back and choose Sign in with a one-time passcode instead. |
| The message was sent to a work address that forwards to a personal one | Open it from the address it was sent to, or ask the sender to resend it to the address you’ll read it from. |
| It worked before but now says you can’t open it | The sender may have revoked the message or it may have expired. Contact them. |
If none of this works, call or email the sender. They can resend the message or share the information another secure way.
Related
- How to send an encrypted email in Outlook
- Share files with clients securely from OneDrive
- Email security services
More guides
- Is this email safe? The 60-second check (Outlook and Gmail)
- Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
- Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
- Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
- How to check your email's SPF, DKIM and DMARC records (and what the results mean)
- How to send an encrypted email in Outlook (Microsoft 365)
- What goes in a WISP: a checklist for small tax offices
- Share files with clients securely from OneDrive (expiring links, no attachments)
- Hand over HOA or office email when a board member or manager changes
- How to spot and report a phishing email in Outlook
- Get back a deleted email or file (Microsoft 365 and Google Workspace)
- Turn on 2-step verification in Google Workspace (and keep your backup codes)
- Google Workspace admin: add staff and offboard someone who leaves
- Share files with clients securely from Google Drive
Microsoft and Google change their menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.