Yes, an email encryption gateway can work with Microsoft 365. The gateway sits between your mail client and Microsoft 365, intercepting outgoing and incoming messages to apply S/MIME or PGP encryption before delivery or storage. This approach extends protection well beyond what Microsoft 365 provides natively, giving organizations centralized key management and standard-based encryption that works with recipients outside the Microsoft ecosystem.

The sections below address the most common questions organizations ask when evaluating this setup: what Microsoft 365 already offers, where it falls short, which standards a gateway adds, how to configure the routing, and how to decide which approach fits your needs.

How does an email encryption gateway actually send mail through Microsoft 365?

An email encryption gateway processes messages at the SMTP level before they reach or leave Microsoft 365. When a user sends a message, it is routed through the gateway first. The gateway looks up the recipient's public key, applies the configured encryption standard, and forwards the protected message onward for delivery. Incoming messages follow the reverse path: the gateway receives them, applies any configured protection, and delivers them to the mailbox.

In practice, the gateway acts as a proxy. Microsoft 365 continues to handle mailbox storage, calendar, and other services, while the gateway takes responsibility for cryptographic operations. The SMTP connections between your mail client, the gateway, and Microsoft 365 must be configured to pass through the gateway for protection to apply consistently.

A gateway also addresses a storage problem that SMTP-only solutions leave open. When a user sends a message, their email client saves a copy to the Sent folder through IMAP. If the gateway only encrypts the outgoing delivery path, that saved copy can remain unencrypted on the mail server. A well-designed gateway handles both operations: SMTP encryption for delivery and IMAP encryption for the stored copy. This distinction matters when evaluating any email encryption gateway for enterprise use.

Does Microsoft 365 already include built-in email encryption?

Yes, Microsoft 365 includes several built-in encryption features. Transport Layer Security (TLS) encrypts the connection between mail servers during delivery. Microsoft Purview Message Encryption allows users to send protected messages to recipients outside the organization, including those without Microsoft accounts. Microsoft 365 also supports S/MIME, but only when administrators provision certificates for each user individually.

These features address different parts of the problem. TLS protects messages while they travel between systems but does not protect message content stored in a mailbox. Purview Message Encryption wraps messages in a proprietary portal experience, which recipients access through a web link. S/MIME within Microsoft 365 uses standard cryptography but requires per-user certificate management handled through the Microsoft infrastructure.

What are the limitations of Microsoft 365's native encryption options?

Microsoft 365's native encryption options have meaningful limitations when organizations need standard-based, interoperable protection. The most significant gap is interoperability: Purview Message Encryption uses a proprietary delivery mechanism that requires recipients without Microsoft accounts to authenticate through a web portal rather than read a message in their own email client. This creates friction and is not equivalent to S/MIME or PGP encryption.

S/MIME support within Microsoft 365 is available but administratively demanding. Each user requires a certificate issued and managed through a compatible infrastructure. There is no centralized gateway-level key management, so scaling S/MIME across an organization means managing certificates individually. PGP is not natively supported at all within Microsoft 365.

A further limitation concerns stored message protection. TLS secures the connection, not the stored content. Messages sitting in mailboxes on Microsoft's servers are protected by Microsoft's own access controls and encryption at rest, but the message content itself is not encrypted with keys controlled exclusively by your organization. For sectors with strict data protection requirements, this distinction is significant.

Which encryption standards does a gateway support that Microsoft 365 doesn't?

An email encryption gateway typically supports both S/MIME and OpenPGP, and it manages both standards centrally without requiring per-user configuration in the mail client. Microsoft 365 does not natively support PGP encryption at all, and its S/MIME support lacks the centralized key handling that a gateway provides.

With a gateway, administrators can configure a preferred standard while keeping the other available as a fallback. For example, an organization might prefer S/MIME for recipients with certificates but automatically apply PGP where only a PGP public key is available. This flexibility accommodates the reality that different recipients use different cryptographic infrastructures.

Gateways also support digital signatures alongside encryption. Signing a message allows the recipient to verify that it came from the stated sender and has not been altered in transit. Signature verification can be handled at the gateway level, meaning users benefit from integrity checking without needing to configure anything in their email client.

For recipients who have no usable key at all, some gateways integrate with secure delivery portals as a fallback, ensuring that a message can still be delivered securely even when standard encryption is not possible. This covers a gap that S/MIME and PGP alone cannot address.

How do you configure Microsoft 365 to route mail through an encryption gateway?

Configuring Microsoft 365 to route mail through an encryption gateway requires changes to your mail flow rules and connector settings in the Microsoft 365 admin center. The core steps are to create an outbound connector that routes messages to the gateway's SMTP address, and an inbound connector that accepts messages from the gateway for delivery to mailboxes.

For outgoing mail, you configure a send connector or transport rule that directs messages through the gateway before external delivery. The gateway processes the message, applies encryption, and forwards it. For incoming mail, you update your domain's MX record to point to the gateway rather than directly to Microsoft 365. The gateway receives inbound messages, applies any configured protection, and delivers them to Microsoft 365 mailboxes.

IMAP configuration is a separate consideration. If the gateway also protects messages stored through IMAP, such as copies saved to the Sent folder, the client's IMAP connection must also pass through the gateway. This may require reconfiguring email client profiles so that IMAP access goes through the gateway address rather than connecting directly to Microsoft 365.

Deployment options vary. A cloud-based gateway processes messages as a hosted service while Microsoft 365 retains the mailboxes. An on-premises gateway runs within your own infrastructure alongside your existing mail environment. The right choice depends on your data residency requirements, IT resources, and the level of control your organization needs over cryptographic operations.

Should organizations use a gateway or Microsoft 365's native encryption?

Organizations that need standard-based, interoperable encryption with centralized key management should use a gateway. Microsoft 365's native options are sufficient for basic scenarios, particularly where all recipients are within the Microsoft ecosystem, but they do not provide the flexibility, standard compliance, or administrative control that regulated industries and security-conscious organizations typically require.

The right choice depends on several factors:

• Recipient diversity: If your recipients use a range of email clients and providers, S/MIME and PGP delivered through a gateway ensure they can read protected messages without a portal login.
• Regulatory requirements: Sectors such as healthcare, finance, and legal services often require message-level encryption with organization-controlled keys. A gateway makes this achievable at scale.
• Key management: Centralized key handling at the gateway reduces the administrative burden of per-user certificate provisioning and supports gradual rollout across the organization.
• Stored message protection: If protecting the content of messages at rest in mailboxes is a requirement, a gateway that covers both SMTP delivery and IMAP storage provides more complete coverage than Microsoft 365's native features alone.
• Existing infrastructure: Organizations that want to retain Microsoft 365 mailboxes and familiar email clients while adding stronger encryption will find the gateway model compatible with that goal.

Microsoft 365's built-in encryption is a reasonable starting point for organizations with simple requirements and homogeneous recipient environments. For organizations that exchange sensitive information with external parties, need audit-ready protection, or operate under sector-specific data protection obligations, a dedicated email encryption gateway provides the depth of control and interoperability that native options cannot match.

How Savignano Software Solutions helps with email encryption for Microsoft 365

Savignano Software Solutions has developed Uptrust Email Encryption, a gateway-based encryption platform designed to work alongside existing mail infrastructure, including Microsoft 365 environments. Uptrust addresses the gaps that Microsoft 365's native encryption leaves open, giving organizations centralized, standard-based protection without replacing familiar email workflows.

Uptrust Email Encryption provides:

• S/MIME and OpenPGP support: Administrators can configure a preferred standard with the other available as a fallback, accommodating recipients across different cryptographic infrastructures.
• SMTP and IMAP protection: Uptrust encrypts messages during delivery and also protects copies stored in the Sent folder or any other mail folder through IMAP, closing the storage gap that delivery-only solutions leave open.
• Centralized key management: Cryptographic operations are handled at the gateway level, reducing the per-user configuration burden and supporting gradual rollout across the organization.
• Cloud and on-premises deployment: Organizations can choose a hosted cloud gateway or an on-premises installation, depending on their data residency and infrastructure requirements.
• Flexible adoption path: Protection can be scoped to selected domains or individual addresses and expanded over time, without requiring every user or external recipient to be ready simultaneously.

Savignano brings over fifteen years of experience in software development and IT consulting, with deep expertise in email security and systems integration. If your organization is evaluating how to strengthen email encryption alongside Microsoft 365, get in touch with Savignano to discuss your requirements and explore how Uptrust Email Encryption can fit your environment.