Study guide
8.2 Design and Implement Advanced Message Encryption
SC-401: Administering Information Security in Microsoft 365 Exam
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SC-401 Exam Facts 1.2 Scoring, Retakes, and Annual Renewal 1.3 Role, Blueprint, and Prep Path
2 Data Classification Foundations
2.1 Identify Sensitive Information Requirements 2.2 Translate Requirements into Sensitive Info Types 2.3 Create and Manage Custom Sensitive Info Types
3 Specialized Classification Methods
3.1 Document Fingerprinting 3.2 Exact Data Match Sensitive Info Types 3.3 Trainable Classifiers
4 Classification Monitoring and OCR
4.1 Monitor Classification with Data Explorer and Content Explorer 4.2 Configure OCR Support for Sensitive Info Types
5 Sensitivity Label Design
5.1 Roles and Permissions for Sensitivity Labels 5.2 Define and Create Sensitivity Labels for Items and Containers 5.3 Protection Settings and Content Marking
6 Label Policies, Containers, and Defender for Cloud Apps
6.1 Configure Publishing Policies for Sensitivity Labels 6.2 Configure Auto-Labeling Policies 6.3 Apply Sensitivity Labels to Containers 6.4 Apply Sensitivity Labels with Microsoft Defender for Cloud Apps
7 Information Protection Client and Scanner
7.1 Plan and Implement the Microsoft Purview Information Protection Client 7.2 Manage Files with the Information Protection Client 7.3 Bulk Classification with the Information Protection Scanner
8 Microsoft Purview Message Encryption
8.1 Design and Implement Microsoft Purview Message Encryption 8.2 Design and Implement Advanced Message Encryption
9 DLP Policy Design
9.1 Design Data Loss Prevention Policies 9.2 Roles and Permissions for Data Loss Prevention 9.3 Create and Manage DLP Policies
10 Adaptive Protection, DLP Precedence, and MDCA File Policies
10.1 Configure DLP Policies for Adaptive Protection 10.2 Interpret DLP Policy and Rule Precedence 10.3 Create File Policies in Defender for Cloud Apps Using DLP
11 Endpoint DLP Configuration
11.1 Device Requirements for Endpoint DLP Including Extensions 11.2 Configure Advanced DLP Rules for Devices 11.3 Configure Endpoint DLP Settings
12 Just-in-Time Protection and Endpoint Monitoring
12.1 Configure Just-in-Time Protection 12.2 Monitor Endpoint Activities
13 Retention Labels and Adaptive Scopes
13.1 Plan Information Retention and Disposition with Retention Labels 13.2 Create and Manage Adaptive Policy Scopes 13.3 Create Retention Labels for Data Lifecycle Management
14 Publishing, Auto-Apply, and Retention Precedence
14.1 Publish Retention Labels 14.2 Auto-Apply Retention Labels 14.3 Retention Precedence and Policy Lookup
15 Retention Policies and Recovering Retained Content
15.1 Create and Configure Retention Policies 15.2 Recover Retained Content in Microsoft 365
16 Insider Risk Management Foundation
16.1 Roles and Permissions for Insider Risk Management 16.2 Plan and Implement Insider Risk Management Connectors 16.3 Integrate Insider Risk Management with Microsoft Defender for Endpoint
17 IRM Settings, Indicators, and Templates
17.1 Configure Insider Risk Management Settings 17.2 Configure Policy Indicators 17.3 Select an Appropriate Policy Template
18 IRM Policies, Forensic Evidence, and Adaptive Protection
18.1 Create and Manage Insider Risk Management Policies 18.2 Manage Forensic Evidence Settings 18.3 Enable Insider Risk Levels for Adaptive Protection
19 IRM Alerts, Cases, and Workflow
19.1 Manage Insider Risk Alerts and Cases 19.2 Insider Risk Workflow and Notice Templates
20 Purview Audit and Activity Explorer
20.1 Assign Microsoft Purview Audit (Premium) User Licenses 20.2 Investigate Activities with Microsoft Purview Audit 20.3 Configure Audit Retention Policies 20.4 Analyze Purview Activities with Activity Explorer
21 DLP, Insider Risk, and Defender XDR Alert Response
21.1 Respond to DLP Alerts in the Microsoft Purview Portal 21.2 Investigate Insider Risk Activities in the Microsoft Purview Portal 21.3 Respond to Purview Alerts in Microsoft Defender XDR
22 MDCA File Policy Alerts and eDiscovery
22.1 Respond to Defender for Cloud Apps File Policy Alerts 22.2 Perform Searches by Using eDiscovery
23 Protecting Content Used by AI Services
23.1 Implement Purview Controls for AI Services 23.2 Implement Microsoft 365 Workload Controls for AI
24 Data Security Posture Management for AI
24.1 Prerequisites for DSPM for AI 24.2 Manage Roles and Permissions for DSPM for AI 24.3 Configure DSPM for AI Policies 24.4 Monitor Activities in DSPM for AI
8.2 Design and Implement Advanced Message Encryption
Key Takeaways Explain This Topic AI
Advanced Message Encryption requires Microsoft Purview Message Encryption to be set up first, and revocation, expiration, and portal logs work only when external recipients use the encrypted message portal.
AME adds message revocation, message expiration (ExternalMailExpiryInDays from 1 through 730), multiple branding templates via New-OMEConfiguration, and encrypted message portal activity logs.
Custom branding wraps external mail so recipients open the portal; without that wrapper, native Outlook inline mail cannot be expired or revoked.
Senders can revoke only link-based mail to a single Gmail or Yahoo recipient from Outlook on the web; admins revoke with Set-OMEMessageRevocation or the Encryption report after confirming the message is revocable.
Microsoft publishes Advanced Message Encryption as Yes for Microsoft 365 E5/A5/G5, Purview Suite variants, Microsoft 365 E5 Information Protection and Governance, and Office 365 E5/A5/G5.
Last updated: August 2026
Microsoft Purview Advanced Message Encryption (AME) sits on top of Purview Message Encryption. Microsoft's version comparison is explicit: you must have Microsoft Purview Message Encryption set up in the organization before you can use AME, and the advanced controls work only when recipients view and reply through the Microsoft Purview Message Encryption portal . If the exam scenario needs time-bounded or revocable access for people outside the tenant, AME is the feature—not base Encrypt-Only in native Outlook.
AME helps meet compliance obligations that require more flexible control over external recipients. Typical design is an automatic policy that detects sensitive information types (PII, financial, or health IDs) or keywords, pairs that policy with a custom branded template , and optionally sets an expiration so portal access ends after a defined number of days. Admins can also revoke portal access at any time and review encrypted message portal activity logs .
You can revoke and set expiration only for email sent to external recipients , and only when those recipients use the portal . Custom branding applies the wrapper that forces the portal. Without that wrapper, Microsoft 365 work or school recipients and Microsoft account recipients (for example outlook.com) often get native Outlook inline mail, which is not revocable and does not expire through AME.
What AME adds on top of Message Encryption
Capability Base Message Encryption Advanced Message Encryption
Branding templates Customize the default template with Set-OMEConfiguration ; you cannot create additional named templates New-OMEConfiguration creates additional templates; Remove-OMEConfiguration deletes custom ones but never the default
Message expiration Portal access lasts while the sender organization is active unless AME expiry is configured ExternalMailExpiryInDays on a custom branded template; published range 1 through 730 days
Message revocation Tracking and revoke are not guaranteed without branding that forces the portal Admins and, in limited cases, senders revoke portal-delivered mail
Portal activity logs An Encryption report exists in the Purview portal EnablePortalTrackingLogs captures external portal sign-in, reads, downloads, replies, and forwards
If Message Encryption is not already working ( AzureRMSLicensingEnabled and a passing Test-IRMConfiguration ), do not start with AME cmdlets. Fix the RMS pipeline first, then add branding.
Multiple branding templates
Base Message Encryption lets you brand the default template: introductory text, disclaimer, privacy-statement URL, portal text, logo, and background color. Logo files may be .png , .jpg , .bmp , or .tiff . Microsoft recommends a file under 40 KB and 170×70 pixels ; larger images are resized for display. Microsoft cites Compliance Administrator as an example least-privilege role for these cmdlets.
AME is required to create multiple templates so Finance, Sales, regions, or products can present different wrapper and portal chrome. Templates also toggle OTPEnabled and SocialIdSignIn , and they are the place you attach expiry and enable tracking and revocation. Create a template with New-OMEConfiguration -Identity "Finance external" , then Set-OMEConfiguration to set Image , BackgroundColor , IntroductionText , ReadButtonText , EmailText , PrivacyStatementURL , DisclaimerText , PortalText , OTPEnabled , SocialIdSignIn , and ExternalMailExpiryInDays .
Apply templates with Exchange mail flow rules: Modify the message security > Apply custom branding to OME messages . If encryption is not already applied by the user, a label, or DLP, add Apply Office 365 Message Encryption and rights protection in the same rule or in a higher-priority rule. Microsoft's documented order is that the encryption rule must run first (higher priority) and the branding rule second. Third-party scanners that modify mail can prevent branding from applying.
PowerShell pattern to force internal-to-external encrypted messages through a branded portal (Microsoft's documented cmdlet parameters):
New-TransportRule -Name "Brand encrypt external" -FromScope "InOrganization" -ApplyRightsProtectionTemplate "Encrypt" -ApplyRightsProtectionCustomizationTemplate "OME Configuration"
Substitute Do Not Forward when the policy must also block forward, print, and copy. Pair DLP or transport conditions with SITs or keywords, then attach the branded template and an expiration. Branding can also be applied as a supported Exchange action on a Purview DLP policy.
You can revert the default template (empty strings for text fields, $null for logo and background). You cannot delete the default branding template . Remove-OMEConfiguration permanently deletes a custom template only.
Expiration
Expiration is an AME feature on custom branding , not a standalone mail-flow checkbox. Microsoft's example is:
New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7
ExternalMailExpiryInDays accepts any integer from 1 through 730. Only external recipients are in scope. Custom branding causes Microsoft 365 to wrap matching mail so the recipient must use the portal; you can only use expiration if you use custom branding . The wrapper shows the expiry date. Opening after expiry returns an error in the portal.
Do not tell the exam that expiry applies to internal inline Outlook mail, or that you can set hours instead of days. Microsoft publishes days, 1–730, on a branded template.
Revocation
To guarantee the ability to track and revoke, add a custom branding template . Revocation applies to link-based branded mail. If the recipient got native inline Outlook, you cannot revoke.
Sender path (Outlook on the web): In Sent Items, Remove external access appears when the mail is revocable. Microsoft documents this for a single recipient who uses a social account such as gmail.com or yahoo.com and received the link-based experience. The sender cannot revoke mail sent to a Microsoft 365 work or school account or to a Microsoft account (for example outlook.com) that received the inline experience. After revoke, the message status in Sent Items shows as revoked. Outlook on the web is the published client for sender revoke of protected mail.
Admin path:
Get the Message-ID from message trace or the Message encryption report in the Microsoft Purview portal.
Confirm the mail is revocable: Get-OMEMessageStatus -MessageId "<id>" and check IsRevocable , or look for Revocation Status in the Encryption report details.
Revoke in the Encryption report ( Revoke message ) or run Set-OMEMessageRevocation -Revoke $true -MessageId "<id>" .
Verify with Get-OMEMessageStatus showing Revoked: True .
The recipient then sees The message has been revoked by the sender in the encryption portal. Microsoft lists compliance administrator or Exchange administrator permissions for the PowerShell revoke cmdlets.
Admins can revoke messages that were encrypted from Outlook on the web, including Encrypt-Only, when the recipient received the branded portal experience. Do not treat revocation as a general Outlook recall for internal mail.
Encrypted message portal activity logs
Apply custom branding so external recipients use the portal; otherwise there is nothing AME can log for those recipients. Enable logging with:
Set-IRMConfiguration -EnablePortalTrackingLogs $true
Logged activities include:
- External user sign-in timestamp and authentication method
- External user reading messages or attachments
- Attachment download
- Mail replies and forwards
Search in the Microsoft Purview portal Audit solution. Under Activities, filter encrypted message portal activities , pick event types, set a date range (default is the previous week), and optionally scope to a user in your organization.
Microsoft is explicit about scope: these logs capture only external recipients accessing the encrypted message portal . Activities those same people perform inside email clients are not recorded. For internal recipients, use the MailItemsAccessed mailbox-auditing action in Purview Audit (Premium), not the portal log.
Licensing Microsoft publishes
The Microsoft Purview service description lists Advanced Message Encryption as Yes for Microsoft 365 E5/A5/G5 , Microsoft Purview Suite (including EDU/GOV/FLW variants), Microsoft Defender + Purview Suite FLW , Microsoft 365 E5/A5/F5/G5 Information Protection and Governance , and Office 365 E5/A5/G5 . That table does not list E3 or Business Premium as including AME. Confirm current SKU mapping in the service description at exam time. Microsoft does not publish an AME per-user price or a maximum number of branding templates in that article; do not invent those numbers.
Design sequence for SC-401
Confirm Azure RMS and Message Encryption ( Get-IRMConfiguration , Test-IRMConfiguration ).
Create AME branding templates per audience, including ExternalMailExpiryInDays where required.
Author mail flow or DLP policies that detect SITs or keywords on outbound mail.
Apply Encrypt or Do Not Forward, then apply the matching branding template at lower priority than encryption.
Enable EnablePortalTrackingLogs and operate revocation from the Encryption report or Set-OMEMessageRevocation .
Remember AME does not encrypt SharePoint or OneDrive cloud attachments or meeting invites; those remain sensitivity-label and DLP problems.
Exam traps
AME without Message Encryption already set up is the wrong starting point.
Revoke and expire without custom branding (portal wrapper) fail for native Outlook recipients.
Multiple templates need New-OMEConfiguration (AME), not only Set-OMEConfiguration on the default template.
Sender Remove external access is not a general recall for Microsoft 365 or Microsoft account recipients.
Portal logs do not record Gmail activity that happens inside the Gmail client; they record portal access.