8.2 Design and Implement Advanced Message Encryption

Microsoft Purview Advanced Message Encryption (AME) sits on top of Purview Message Encryption. Microsoft's version comparison is explicit: you must have Microsoft Purview Message Encryption set up in the organization before you can use AME, and the advanced controls work only when recipients view and reply through the Microsoft Purview Message Encryption portal. If the exam scenario needs time-bounded or revocable access for people outside the tenant, AME is the feature—not base Encrypt-Only in native Outlook.

AME helps meet compliance obligations that require more flexible control over external recipients. Typical design is an automatic policy that detects sensitive information types (PII, financial, or health IDs) or keywords, pairs that policy with a custom branded template, and optionally sets an expiration so portal access ends after a defined number of days. Admins can also revoke portal access at any time and review encrypted message portal activity logs.

You can revoke and set expiration only for email sent to external recipients, and only when those recipients use the portal. Custom branding applies the wrapper that forces the portal. Without that wrapper, Microsoft 365 work or school recipients and Microsoft account recipients (for example outlook.com) often get native Outlook inline mail, which is not revocable and does not expire through AME.

What AME adds on top of Message Encryption

If Message Encryption is not already working (AzureRMSLicensingEnabled and a passing Test-IRMConfiguration), do not start with AME cmdlets. Fix the RMS pipeline first, then add branding.

Multiple branding templates

Base Message Encryption lets you brand the default template: introductory text, disclaimer, privacy-statement URL, portal text, logo, and background color. Logo files may be .png, .jpg, .bmp, or .tiff. Microsoft recommends a file under 40 KB and 170×70 pixels; larger images are resized for display. Microsoft cites Compliance Administrator as an example least-privilege role for these cmdlets.

AME is required to create multiple templates so Finance, Sales, regions, or products can present different wrapper and portal chrome. Templates also toggle OTPEnabled and SocialIdSignIn, and they are the place you attach expiry and enable tracking and revocation. Create a template with New-OMEConfiguration -Identity "Finance external", then Set-OMEConfiguration to set Image, BackgroundColor, IntroductionText, ReadButtonText, EmailText, PrivacyStatementURL, DisclaimerText, PortalText, OTPEnabled, SocialIdSignIn, and ExternalMailExpiryInDays.

Apply templates with Exchange mail flow rules: Modify the message security > Apply custom branding to OME messages. If encryption is not already applied by the user, a label, or DLP, add Apply Office 365 Message Encryption and rights protection in the same rule or in a higher-priority rule. Microsoft's documented order is that the encryption rule must run first (higher priority) and the branding rule second. Third-party scanners that modify mail can prevent branding from applying.

PowerShell pattern to force internal-to-external encrypted messages through a branded portal (Microsoft's documented cmdlet parameters):

New-TransportRule -Name "Brand encrypt external" -FromScope "InOrganization" -ApplyRightsProtectionTemplate "Encrypt" -ApplyRightsProtectionCustomizationTemplate "OME Configuration"

Substitute Do Not Forward when the policy must also block forward, print, and copy. Pair DLP or transport conditions with SITs or keywords, then attach the branded template and an expiration. Branding can also be applied as a supported Exchange action on a Purview DLP policy.

You can revert the default template (empty strings for text fields, $null for logo and background). You cannot delete the default branding template. Remove-OMEConfiguration permanently deletes a custom template only.

Expiration

Expiration is an AME feature on custom branding, not a standalone mail-flow checkbox. Microsoft's example is:

New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7

ExternalMailExpiryInDays accepts any integer from 1 through 730. Only external recipients are in scope. Custom branding causes Microsoft 365 to wrap matching mail so the recipient must use the portal; you can only use expiration if you use custom branding. The wrapper shows the expiry date. Opening after expiry returns an error in the portal.

Do not tell the exam that expiry applies to internal inline Outlook mail, or that you can set hours instead of days. Microsoft publishes days, 1–730, on a branded template.

Revocation

To guarantee the ability to track and revoke, add a custom branding template. Revocation applies to link-based branded mail. If the recipient got native inline Outlook, you cannot revoke.

Sender path (Outlook on the web): In Sent Items, Remove external access appears when the mail is revocable. Microsoft documents this for a single recipient who uses a social account such as gmail.com or yahoo.com and received the link-based experience. The sender cannot revoke mail sent to a Microsoft 365 work or school account or to a Microsoft account (for example outlook.com) that received the inline experience. After revoke, the message status in Sent Items shows as revoked. Outlook on the web is the published client for sender revoke of protected mail.

Admin path:

1. Get the Message-ID from message trace or the Message encryption report in the Microsoft Purview portal.
2. Confirm the mail is revocable: Get-OMEMessageStatus -MessageId "<id>" and check IsRevocable, or look for Revocation Status in the Encryption report details.
3. Revoke in the Encryption report (Revoke message) or run Set-OMEMessageRevocation -Revoke $true -MessageId "<id>".
4. Verify with Get-OMEMessageStatus showing Revoked: True.

The recipient then sees The message has been revoked by the sender in the encryption portal. Microsoft lists compliance administrator or Exchange administrator permissions for the PowerShell revoke cmdlets.

Admins can revoke messages that were encrypted from Outlook on the web, including Encrypt-Only, when the recipient received the branded portal experience. Do not treat revocation as a general Outlook recall for internal mail.

Encrypted message portal activity logs

Apply custom branding so external recipients use the portal; otherwise there is nothing AME can log for those recipients. Enable logging with:

Set-IRMConfiguration -EnablePortalTrackingLogs $true

Logged activities include:

• External user sign-in timestamp and authentication method
• External user reading messages or attachments
• Attachment download
• Mail replies and forwards

Search in the Microsoft Purview portal Audit solution. Under Activities, filter encrypted message portal activities, pick event types, set a date range (default is the previous week), and optionally scope to a user in your organization.

Microsoft is explicit about scope: these logs capture only external recipients accessing the encrypted message portal. Activities those same people perform inside email clients are not recorded. For internal recipients, use the MailItemsAccessed mailbox-auditing action in Purview Audit (Premium), not the portal log.

Licensing Microsoft publishes

The Microsoft Purview service description lists Advanced Message Encryption as Yes for Microsoft 365 E5/A5/G5, Microsoft Purview Suite (including EDU/GOV/FLW variants), Microsoft Defender + Purview Suite FLW, Microsoft 365 E5/A5/F5/G5 Information Protection and Governance, and Office 365 E5/A5/G5. That table does not list E3 or Business Premium as including AME. Confirm current SKU mapping in the service description at exam time. Microsoft does not publish an AME per-user price or a maximum number of branding templates in that article; do not invent those numbers.

Design sequence for SC-401

1. Confirm Azure RMS and Message Encryption (Get-IRMConfiguration, Test-IRMConfiguration).
2. Create AME branding templates per audience, including ExternalMailExpiryInDays where required.
3. Author mail flow or DLP policies that detect SITs or keywords on outbound mail.
4. Apply Encrypt or Do Not Forward, then apply the matching branding template at lower priority than encryption.
5. Enable EnablePortalTrackingLogs and operate revocation from the Encryption report or Set-OMEMessageRevocation.
6. Remember AME does not encrypt SharePoint or OneDrive cloud attachments or meeting invites; those remain sensitivity-label and DLP problems.

Exam traps

• AME without Message Encryption already set up is the wrong starting point.
• Revoke and expire without custom branding (portal wrapper) fail for native Outlook recipients.
• Multiple templates need New-OMEConfiguration (AME), not only Set-OMEConfiguration on the default template.
• Sender Remove external access is not a general recall for Microsoft 365 or Microsoft account recipients.
• Portal logs do not record Gmail activity that happens inside the Gmail client; they record portal access.