Office 365 Message Encryption and EWS API endpoints

Question

If a Exchange 365 user uses Office 365 Message Encryption (OME) to send and receive encrypted emails, can these emails and their header information be read by using the EWS API endpoints?

Update/Clarification

We are mainly interested in being able to read the Email Headers of a mail that was sent/received using Office 365 Message Encryption (OME). So things like From, To, CC, SentDate, Subject etc. Will these headers be available to be accessed via the EWS API. It is not a requirement for us to actually be able to decrypt and read the actual contents of the mail.

NOTE: we would be using ApplicationImpersonation to access mailboxes on behalf of users and read the email headers in each mailbox.

Answer 1

Based on the Microsoft documentation here:

A message is encrypted, or transformed from plain text into unreadable ciphertext, either on the sender’s machine, or by a central server while the message is in transit.

and the following here:

Are Office 365 encrypted messages stored in the cloud or on Microsoft servers?

No, the encrypted messages are kept on the recipient’s email system, and when the recipient opens the message, it is temporarily posted for viewing on Office 365 servers. The messages are not stored there.

and here:

Can I read the encrypted messages over mobile devices?

Yes, you can view messages on Android and iOS by downloading the OME Viewer apps from the Google Play store and the Apple App store. Open the HTML attachment in the OME Viewer app and then follow the instructions to open your encrypted message. For other mobile devices, you can open the HTML attachment as long as your mail client supports Form Post.

and the following here:

To view encrypted messages, recipients can either get a one-time passcode, sign in with a Microsoft account, or sign in with a work or school account associated with Office 365.

and this here:

Encrypted messages can be viewed on any client device, as long as the HTML attachment can be opened in a modern browser that supports Form Post.

and important this here:

During the decryption process, the encrypted mail you receive will not be stored by the Portal; it will not be transmitted outside the Portal at any time.

I would say that there is no option to use EWS to read such emails as that would be totally against what Microsoft wrote above. Because then the Administrator can bypass the encryption which isn´t possible without having the users password. So I would assume that EWS has the same restrictions as an Administrator and therefore isn´t able to perform that.

However as Office 365 Message Encryption uses Rights Management Services (RMS) as its encryption infrastructure (see here) you might wish to check what you can build on RMS.

Answer 2

This is in detail explained by two pieces of Microsoft documentation: [MS-OXORMMS] and [MS-RMPR].

The basic idea is that the encrypted part of the message is transferred as an attachment, while the unencrypted body only contains a convenience link for a client not supporting OME to allow reading the message.

The actual attachment is encrypted using a key on the server. To retrieve it you have to activate against the Rights Management Server and retrieve a license to decrypt the message.

Sending works the opposite way - you encrypt the message, send the key to the server and send the encrypted message as attachment to Exchange.

Based on that I think it is possible to send and receive OME-encrypted messages using EWS, as long as the client implements the necessary encrption/decryption/license management.