'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft 365 Encrypted Email Won't Open for External Recipients
Question details
External recipients and group mailboxes are unable to open encrypted emails sent via Microsoft Purview Message Encryption, encountering permission errors.
- Product
- Microsoft 365 / Microsoft Purview
- Device & OS
- not provided
- Scenario
- Sending sensitive business data (such as invoices) to external providers and group mailboxes using Microsoft 365 encryption.
- Observed behavior
- Recipients receive a "We need permission to open the email" error or similar access failures, preventing them from viewing the message or attachments.
Do not disable your organization's encryption policies or Azure protection as a quick fix, as this exposes sensitive organizational data. Ensure you have collected the exact error messages from the affected external recipients before proceeding.
Guide External Recipients to Use a One-Time Passcode (OTP)
Often, external recipients fail to authenticate correctly, especially if they do not use a Microsoft account. Instructing them to use the OTP method ensures secure and verified access.
Microsoft Purview Message Encryption requires external users to prove their identity. If a recipient does not have an active Microsoft 365 account, they must use a one-time passcode to view the encrypted message.
Instruct the external recipient to open the notification email and click the 'Read the message' button.
On the portal page, ask the recipient to select 'Sign in with a One-Time Passcode' instead of attempting to log in with a corporate account.
A passcode will be sent to their email address. They must retrieve this code, enter it into the portal, and click 'Continue' to view the encrypted email and attachments.
Review Microsoft Purview Encryption Policies for External Access
If a large batch of external recipients suddenly loses access, your organization's encryption labels or policies may have been altered to restrict external domains.
Escalate to Microsoft 365 Support
If the issue persists across many external providers after a service or policy change, the issue may be on the server side and requires Microsoft intervention.
Try WPS Office for Secure Document Management
If Microsoft 365 enterprise encryption features are causing continuous access issues for your external partners, consider sharing secure documents directly using WPS Office. It is a free, lightweight alternative that allows you to password-protect individual files natively, ensuring your partners can access invoices and reports without navigating complex tenant permissions.
- 1. Open your document in WPS Office: Launch WPS Office and open the invoice, report, or document you need to send to an external partner.
- 2. Encrypt the file: Go to 'Menu' > 'Document Encryption' > 'Encryption' and set a secure password for the file.
- 3. Share with partners: Save the encrypted file and attach it to a standard email. Share the password with your recipient via a separate, secure communication channel.
Frequently Asked Questions
Why do external users get the 'We need permission to open the email' error?
This error typically occurs when the recipient's email address does not exactly match the address authorized by the encryption policy, when their authentication session has expired, or when organizational labels restrict access strictly to internal users.
Can external group mailboxes open Microsoft 365 encrypted emails?
Yes, but group mailboxes often struggle with modern authentication for encrypted messages. The most reliable method is for the external recipient to use the 'Sign in with a One-Time Passcode' option, allowing the passcode sent to the group address to authorize the session.
Should I disable Azure Information Protection to fix this issue?
No, disabling Azure Information Protection or message encryption is strongly discouraged as it removes essential security layers for your organizational data. Instead, focus on adjusting the policy permissions to properly accommodate external users.
Does the external recipient need a Microsoft account to view the email?
No. If they do not have a Microsoft 365 account or Azure AD identity, they can choose to receive a One-Time Passcode (OTP) sent directly to their email inbox to verify their identity and decrypt the message.
