Secure messages with a digital ID in Outlook

Get a digital ID from a certifying authority to use in new Outlook

You will need to obtain a digital ID issued by an independent certification authority. Your organization, however, may have policies that require a different procedure. See your network administrator for more information.

Import or export a digital ID in new Outlook

Before you can import a digital ID, you need to already have the digital ID and know where it is on your device. Use the following instructions to either import or export a digital ID in new Outlook.​​

Import a digital ID

1. Select Settings > Mail > S/MIME.​​​​​​​

2. Under Digital IDs (Certificates), select Import to import a digital ID.

3. Select Browse to locate the digital ID, and enter the password you used when you exported the certificate to this file.

Export a digital ID

1. To export a digital ID, select Settings > Mail > S/MIME.​​​​​​​

2. Select Export.

3. From the Export Digital ID pane, select Browse to locate the ID.

4. Enter a password to help protect this information. If you don't see any specific certificate in list, it may be because it wasn't marked as Exportable at the time of creation.

Digitally sign a single message

1. In the message, on the Options tab, in More Options, select Digitally sign this message.
   ​​​​​​​​​​​​​​If you don't see the Sign Message button, you might not have a digital ID configured to digitally sign messages, or it not active for you.

2. Compose your message and then send it.

Digitally sign all messages in new Outlook

1. Select Settings > Mail > S/MIME >​​​​​​​

2. Select Add a digital signature to all messages I send. If this option isn't available, it means your admin manages this setting on your behalf.

   Note: The settings in new Outlook and Outlook on the web are synchronized. This means that any changes made in new Outlook will be reflected in Outlook on the web and vice versa.​​​​​​​

Get a digital ID from a certifying authority

You will need to obtain a digital ID issued by an independent certification authority.

Your organization, however, may have policies that require a different procedure. See your network administrator for more information.

Back to top

​​​​​​​ 

Import, export, or delete a digital ID in classic Outlook

Before you import a digital ID, you'll have to have the digital ID or export if from another location. Follow these instructions to both import and export a digital ID in classic Outlook. 

1. On the File tab, select Options > Trust Center.

2. Under Microsoft Outlook Trust Center, select Trust Center Settings.

3. On the E-mail Security tab, under Encrypted e-mail, select Settings.
   
   

4. Under Digital IDs (Certificates), select Import/Export.

5. To Import a digital ID, select Browse to locate the Security Profile. You'll need to enter the password you used when you exported the certificate to this file.

6. To Export a digital ID, select the radio button next to Export your Digital ID to a file. You'll need to enter a password to help protect this information.

7. To Delete a digital ID, select the checkbox next to Delete Digital ID from system.

8. Select OK.

Back to top

Specify the digital ID to use in classic Outlook

You might choose to have more than one digital ID—one for your digital signature, which in many areas can have legal significance, and another for encryption.

1. On the File tab, select Options > Trust Center.

2. Under Microsoft Outlook Trust Center, select Trust Center Settings.

3. On the E-mail Security tab, under Encrypted e-mail, select Settings.

   

   Note: If you have a digital ID, the settings to use the digital ID are automatically configured for you. If you want to use a different digital ID, follow the remaining steps in this procedure.

4. Under Security Setting Preferences, select New.

5. In the Security Settings Name box, enter a name.

6. In the Cryptography Format list, select S/MIME. Depending on your certificate type, you can choose Exchange Security instead.

7. Next to the Signing Certificate box, select Choose, and then select a certificate that is valid for digital signing.

   Note: To learn if the certificate is intended for digital signing and encryption, in the Select Certificate dialog box, select View Certificate. An appropriate certificate for cryptographic messaging (such as digital signing) might state, for example, "Protects email messages."

8. Select the Send these certificates with signed messages check box unless you'll be sending and receiving signed messages only within your organization.

   Note: The settings that you choose become the default when you send cryptographic messages. If you don't want these settings to be used by default for all cryptographic messages, clear the Default Security Setting for this cryptographic message format check box.

Back to top

Add a recipient's digital ID to your Contacts in classic Outlook

To send and receive encrypted email messages, both the sender and the receiver must share their digital ID certificates with each other.

1. Open a message that is digitally signed as indicated in the message list by a Signature icon.

2. Select and hold (or right-click) the name in the From box, and then select Add to Outlook Contacts.

3. If you already have an entry for this person, select and hold (or right-click) their name in the From field. Select Edit contact, and then select Save & Close.

Back to top

View a certificate for a contact

1. On the Navigation bar, select People.

2. Select the person's name, and then on the Contact tab, select Certificates.

   

Back to top 

Digitally sign a single message in classic Outlook

1. In the message, on the Options tab, in the Encrypt group, select Sign.

   • If you don't see the Sign Message button, do the following:

     • In the message, select Options.

     • In the More Options group, select the dialog box launcher in the lower-right corner.

     • Select Security Settings, and then select the Add digital signature to this message check box.

     • Select OK, and then select Close.

   • If you don't see the Sign Message button, you might not have a digital ID configured to digitally sign messages, and you need to do the following to install a digital signature.

     • On the File menu, select Options > Trust Center.

     • Under Microsoft Outlook Trust Center, select Trust Center Settings > Email Security

     • Select Import/Export to import a digital ID from a file on your computer.

2. Compose your message, and then send it.

Back to top

Digitally sign all messages in classic Outlook

1. On the File tab, select Options >Trust Center.

2. Under Microsoft Outlook Trust Center, select Trust Center Settings.

3. On the Email Security tab, under Encrypted Mail, select the Add digital signature to outgoing messages check box.

4. If available, you can select one of the following options:

   • If you want recipients who don't have S/MIME security to be able to read the message, select the Send clear text signed message when sending signed messages check box. By default, this check box is selected.

   • To verify that your digitally signed message was received unaltered by the intended recipients, select the Request S/MIME receipt for all S/MIME signed messages check box. You can request notification telling you who opened the message and when it was opened, When you send a message that uses an S/MIME return receipt request, this verification information is returned as a message sent to your Inbox.

5. To change additional settings, such as choosing between multiple certificates to use, select Settings.

6. Select OK on each open dialog box.

Back to top

Special cases: Get a digital ID for sending messages by using Microsoft Exchange

To get an Exchange Server digital ID—for example, through Key Management Service—the administrator of your Exchange account must have security running on the server and give you a special password, which is known as a token. For more information, see your Exchange administrator.

1. On the File tab, > Options > Trust Center

2. Under Microsoft Outlook Trust Center, select Trust Center Settings.

3. On the E-mail Security tab, under Digital IDs (Certificates), select Get a Digital ID.

4. Select Set up Security for me on the Exchange > OK

5. In the Digital ID Name box, type your name.

6. In the Token box, type the special password that your Exchange administrator assigned to you.

7. In the Microsoft Office Outlook Security Password dialog box, type a different password for the digital ID, and then type the password again in the Confirm box.

   Note: You'll receive a message in your Inbox from the Exchange administrator which requires you to enter the password created in this step.

8. In the dialog box that appears, enter your password, select the Remember password for check box, and then enter the number of minutes that you want Outlook to remember your password.

9. In the Root Certificate Store message that appears, select Yes.

Back to top

​​​​​​​

Get a digital ID from a certifying authority to use in Outlook on the web

You will need to obtain a digital ID issued by an independent certification authority. Your organization, however, may have policies that require a different procedure. See your network administrator for more information.

Digitally sign a single message in Outlook on the web

1. In the message, on the Options tab, in More Options, select Digitally sign this message.

2. Compose your message and then send it.

Digitally sign all messages in Outlook on the web

1. Select Settings > Mail > S/MIME >​​​​​​​

2. Select Add a digital signature to all messages I send. If this option isn't available, it means your admin manages this setting on your behalf.

   Note: The settings in new Outlook and Outlook on the web are synchronized. This means that any changes made in Outlook on the web will be reflected in new Outlook and vice versa.