Email attachments are still one of the easiest ways to leak data or get malware into an org — most of the risk comes down to a handful of habits, good or bad.
In this post: Best practices · Actually encrypting a file, step by step · Catching what people forget to encrypt · When would you actually use this? · References
Best practices
- Use sharing links instead of attaching large files. Upload to OneDrive/SharePoint and share a link with an expiration date and view-only permission instead of a raw attachment — smaller emails, recipients always get the current version, and you can revoke access later. A 50MB PDF should never be a raw attachment.
- Encrypt anything sensitive. Password-protected PDFs/ZIPs, Outlook’s native encryption, or an E2EE email service for regulated data. Share the decryption password over a different channel (text, phone call) than the email itself.
- Treat unexpected attachments as suspicious by default. Watch for unknown senders, risky extensions (
.exe,.scr,.bat,.js), and vague “click and open” messaging. Tools like Mimecast, Proofpoint, or Barracuda can auto-quarantine before it reaches an inbox. - Respect size limits. Most servers cap around 25MB. Compress what you can, and use a cloud link for anything over roughly 10-15MB rather than fighting the limit.
- Follow your org’s actual policy on executable attachments, external email attachments, and auto-encryption for PII — don’t improvise security decisions per email.
- Track attachment activity via Microsoft 365 Compliance Center or a tool like Proofpoint Essentials if attachments carry real compliance weight in your org.
Actually encrypting a file, step by step
In Outlook: compose the email, go to Options > Encrypt, and choose Encrypt-Only or Do Not Forward depending on whether the recipient needs to be able to forward it. This uses Office 365 Message Encryption — no separate tool needed if you’re already on Microsoft 365.
For a password-protected PDF: in Acrobat, File > Protect Using Password. In Word/Excel before exporting to PDF, File > Info > Protect Document > Encrypt with Password.
For a password-protected ZIP: most archive tools (7-Zip, WinRAR) let you set a password at creation time — Windows’ built-in “Compress to ZIP” does not, so you’ll need one of those instead if this needs to work without extra software on the recipient’s end.
Catching what people forget to encrypt
Manual encryption depends entirely on someone remembering to do it, which is exactly why it’s worth backing up with a Data Loss Prevention (DLP) policy in Microsoft Purview that applies automatically. A DLP policy can scan outgoing mail for patterns — a credit card number format, a national ID number, a custom regex matching an internal document ID — and automatically apply encryption, block the send with a warning, or notify an admin, regardless of whether the sender thought to protect it themselves. This isn’t a replacement for training people on the manual steps above — it’s the safety net for the message that goes out during a busy afternoon when nobody stopped to think about it. If sensitive attachments are a recurring risk in your org rather than a one-off, a DLP policy scoped to the relevant data types closes the gap that “remember to encrypt it” never fully closes on its own.
A 50MB PDF should never be a raw email attachment.
When would you actually use this?
- You’re about to send a file bigger than the recipient’s server will likely accept — a link avoids the bounce entirely.
- The document contains PII or regulated data — encryption and a separate-channel password aren’t optional at that point.
- An email with an attachment looks even slightly off — verify before opening, not after something happens.
References
Small tip, hopefully a useful one. Comment below with questions.
App Catalog Authentication Automation Backup Compliance Content Type CSS Flows Google Javascript Limitations List Metadata MFA Microsoft Node NodeJs O365 OneDrive Permissions PnP PnPJS Policy PowerApps Power Automate PowerAutomate PowerPlatform PowerShell React ReactJs Rest API Rest Endpoint Security Send an HTTP Request to SharePoint SharePoint SharePoint List SharePoint Modern SharePoint Online SPFX SPO Sync Tags Teams Termstore Versioning