How to Make an Email Confidential in Outlook (and What It Really Blocks)

Yes, you can mark an email as Confidential in Outlook, but that setting is only a notice. It asks people to treat the message as confidential and doesn’t stop them from forwarding it. To actually block forwarding, you need Encrypt or Do Not Forward.

In this tutorial, I’ll show you how to make an email confidential in Outlook on the web, what the recipient sees, and which option really limits what they can do with your message.

Confidential, sensitivity labels, Encrypt, and Do Not Forward compared

Outlook has four different things that people call “confidential,” and they don’t do the same job. Two of them are markings. Two of them add encryption that Outlook enforces.

Option	Where you find it on the web	What it does	Can the recipient forward it?
Sensitivity: Confidential	More options > Message options	Shows a Confidential notice	Yes
Sensitivity label	Options > Sensitivity	Whatever your organization set up for that label	Depends on the label
Encrypt	Options > Encrypt	Encrypts the message; recipients can’t remove encryption	Yes
Do Not Forward	Options > Encrypt	Encrypts it and blocks forward, print, and copy	No

The sensitivity setting also has Personal and Private. Private is a little different from Confidential, which I’ll cover below. It’s the email version of choosing to mark a calendar event as private: a signal, not a lock.

Here’s how I’d pick between them:

• Confidential for a polite heads-up, like salary talk with a coworker you trust.
• A sensitivity label when your company has a policy for this kind of information.
• Encrypt when the content must be protected in transit but sharing is fine.
• Do Not Forward when only the people you picked should ever read it.

I tested all of this in a Microsoft 365 work mailbox I use for a made-up business, Bluebird Landscaping Co. Every test email went only to myself.

Mark an email as Confidential in Outlook on the web

In Outlook on the web, the Confidential setting lives in a dialog that’s a little hidden. Here’s how I got to it from a new message.

1. Select New mail to open a new message.
2. On the message ribbon, select the … (More options) button at the right end.
3. Under Options in that menu, select More options.

The same menu also holds Include Pictures, the Proofing Editor, text direction, Insert Emoji, Table, Quick Parts, Check accessibility, Download, and Scheduling poll. If you send the same kind of note often, a saved email template in Outlook Online saves you some typing.

More options opens a Message options dialog. At the top is a Sensitivity drop-down that starts on Normal.

1. Open the Sensitivity drop-down.
2. Pick Confidential from Normal, Personal, Private, and Confidential.
3. Select OK, then write and send your email as usual.

After I selected OK, a Confidential bar showed up above the Send button in my draft, so I could see at a glance that the setting stuck.

The same dialog has check boxes for a read receipt, a delivery receipt, and two S/MIME options: Encrypt this message and Digitally sign this message. S/MIME is a separate, certificate-based kind of encryption, and Microsoft says the recipient needs a certificate on their computer to unlock it.

What the recipient sees, and why Forward still works

I sent a test called “Bonus plan for 2026 – confidential” to myself. When it arrived, Outlook showed a Confidential line right under the To line.

Reply, Reply all, and Forward were all still there. That matches what Microsoft says: the sensitivity level doesn’t stop recipients from taking any actions on a message. It’s there so people know your intention.

In classic Outlook, Microsoft says the recipient sees “Please treat this as Confidential” in the InfoBar. Anyone who gets the message can still forward the email like any other, print it, or copy the text out of it.

Private does one extra thing. Microsoft says a message marked Private isn’t forwarded or redirected by the recipient’s inbox rules in Outlook. A person can still forward it by hand, though.

Microsoft also notes that only emails that come from you can be marked confidential, private, or personal. You can’t add the marking to a message someone else sent you.

Set Confidential in classic Outlook, plus a default level

I didn’t test classic Outlook for Windows, so these are Microsoft’s steps. In a new message or a reply, select File > Info > Properties.

Under Settings, open the Sensitivity list, choose Confidential, Private, or Personal, and select Close. Then send the message as you normally would.

If you want every new message to start with the same level, Microsoft’s steps for classic Outlook are File > Options > Mail, then pick a level in the Default Sensitivity level list.

I didn’t find a default sensitivity setting in my web mailbox, and I didn’t test one, so I’m only describing the classic Outlook option here. Since the marking doesn’t restrict anything, a default mostly helps you remember to be careful.

While you’re in a draft, the way the message looks is up to you. If you need a different look for a formal note, you can change the fonts in Outlook Online.

Use a sensitivity label if your organization has them

Sensitivity labels are a different feature from the Normal/Confidential list. In my web mailbox, the Options tab has High importance, Low importance, Sensitivity, and Encrypt buttons.

Selecting Sensitivity opened the list of labels my organization set up. My test tenant only had one label, and I didn’t apply it. Your list will look different, because Microsoft says your organization customizes the label names and descriptions.

What a label does is up to your admin. Microsoft says a label can apply encryption, add permissions your admin chose, or let you choose who can read the item. So one label might be just a tag, and another might block forwarding.

Admins can also require a label on every item, have Office suggest one, or apply one automatically when content contains certain sensitive information, like credit card numbers. If your organization requires labels, you can change a label but you can’t remove it.

If you aren’t sure which label to use, ask your IT team. Microsoft points people to their IT department for exactly this question.

Encrypt vs Do Not Forward: what each one blocks

This is where you get real protection. On the Options tab, select Encrypt. The drop-down is titled “Set permissions on this item” and has three choices.

• Encrypt: encrypts the message without extra restrictions.
• Do Not Forward: encrypts the message and limits what recipients can do with it.
• No permission set: the default, with no encryption on the message itself.

When I chose Do Not Forward, a bar appeared in my draft: “Do Not Forward: Recipients can’t forward, print, or copy content.” It had a Remove encryption button, and the print icon on the ribbon turned grey.

Microsoft’s documentation backs that up. With Do Not Forward, the email is encrypted, recipients have to sign in, and they can’t forward it, print it, or copy from it. In Outlook, they also can’t add or change people in the To, Cc, or Bcc boxes.

When I switched to Encrypt instead, the bar changed to “Encrypt: This message is encrypted. Recipients can’t remove encryption.”

Here’s the part that surprises people. Microsoft says Encrypt leaves recipients with no restrictions except that they can’t remove the encryption. A recipient can copy from the email, print it, and forward it.

Changed your mind before sending? Select Remove encryption on the bar, or open the Encrypt drop-down again and pick No permission set. Both take the protection off the draft.

One thing not to mix: Microsoft says this kind of protection shouldn’t be applied to a message that’s already signed or encrypted with S/MIME. Pick one approach per message.

So if your goal is “nobody else should see this,” Do Not Forward is the one to pick. Encrypt is for protecting the message itself while still letting people share it.

Attachments matter too. Microsoft says unencrypted Office files attached to a Do Not Forward email, like Word, Excel, and PowerPoint files, pick up the same restrictions. They stay protected even after someone tries to download the Outlook email or the file.

Microsoft gives an example: if a recipient downloads a protected file and attaches it to a new message, the new recipient can’t open it. For personal Microsoft 365 accounts, Microsoft adds that PDFs and images can be downloaded without encryption.

How a Do Not Forward email looks when it arrives

I sent “Payroll changes for November 2026” to myself with Do Not Forward. In the message list it had a lock icon, and when I opened it, Outlook showed “Encrypted and disabled forwarding.” with a What’s encryption? button.

Because I was also the sender, this isn’t exactly what an outside recipient sees. I didn’t test an external address, so here’s what Microsoft says happens.

• People using Microsoft 365 can read the message in Outlook for Windows, Mac, on the web, and on mobile.
• People who aren’t Microsoft 365 users can read and reply in a web browser.
• For personal accounts, Microsoft says Google and Yahoo users can sign in with their own account or use a temporary passcode, and other providers use a passcode sent by email.

Sent one to the wrong person? Microsoft’s Message Encryption FAQ says Outlook on the web supports revoking protected mail you sent. I didn’t try revoking a message, so check with your IT team before you count on it.

There’s also a size limit. Microsoft says the largest encrypted message you can send, attachments included, is 25 MB. If you’re not sure how big your messages run, you can sort emails by size in Outlook.

Who can use encryption: work accounts vs Outlook.com

Microsoft says that to use encryption, your account needs a qualifying Microsoft 365 subscription. If the Encrypt button isn’t on your Options tab, that’s usually why.

For work and school accounts, Microsoft Purview Message Encryption is included in plans like Office 365 and Microsoft 365 E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3, and A5, and Government G3 and G5.

Microsoft 365 Business Basic, Business Standard, and Office 365 E1 can get it with an add-on called Azure Information Protection Plan 1. Microsoft also says each person who uses message encryption needs a license.

For personal accounts, Microsoft says Outlook.com users with a Microsoft 365 Personal or Family subscription can choose Options > Encrypt and pick Encrypt or Do Not Forward. I didn’t test a personal account.

Not sure which kind of account you’re using? You can check which email address Outlook shows to see whether it’s a work address or a personal one.

Sensitivity labels are a work-account feature. Microsoft’s labels page lists a work account with an Office 365 Enterprise E3 or E5 license, and your admin has to create the labels before you see any.

Where even Do Not Forward falls short

Even Do Not Forward has limits. Microsoft’s IRM overview says this kind of protection can’t prevent someone from retyping or hand-copying the content, or from taking a photo or screen capture of it.

It also can’t protect content from being erased, stolen, corrupted, or captured by malicious programs or viruses. So encryption cuts down on accidental sharing, but it’s not a guarantee that nobody else ever sees the information.

The plain Confidential marking has no enforcement at all. If the information truly shouldn’t travel, use Do Not Forward or a label your organization set up, and think twice about what you put in writing.

And if you’re on the receiving end of a Confidential or Do Not Forward email, the right move is to respect it. If you need to share it with someone else, ask the sender to send it to them directly.

More Outlook Online how-tos you might like

• Set automatic replies in Outlook
• Block a sender in Outlook Online
• Save Outlook emails to OneDrive
• All Outlook Online tutorials

Marking a message confidential won’t help once it’s gone to the wrong person. For that situation, read how to recall an email in Outlook on the web, new Outlook and classic Outlook.

Common questions