Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The error “Microsoft Outlook was not able to create a message with restricted permission” is most closely associated with replying to an OMEv2-encrypted email in classic Outlook for Microsoft 365. Microsoft traced a documented regression to the Office protection-stack change from MSIPC to the MIP SDK. Update Microsoft 365 Apps, then retry; while troubleshooting, reply from Outlook on the web (OWA) or new Outlook, which Microsoft identified as workarounds. The affected builds began with Current Channel Version 2402, Build 17328.20142. Microsoft listed the first Beta fix in Version 2407 Build 17819.15010 and Current Channel rollout beginning with Version 2407 Build 17830.20000. If the problem continues on a fixed build, the next step is to separate a local Outlook/profile problem from an organization-wide IRM or RMS failure.
What does “restricted permission” mean in Outlook?
It means Outlook could not create the protected message object needed to reply under the original email’s rights-management policy. In the documented incident, the failure occurs when classic Outlook for Microsoft 365 replies to an OMEv2-encrypted message. OMEv2 is Microsoft 365’s newer Office Message Encryption format; the message can be read in a browser while the desktop client fails when it tries to generate a reply that inherits protection.
As an Amazon Associate I earn from qualifying purchases.
The wording can also appear in broader Information Rights Management (IRM) failures. A new message that fails when you choose Encrypt or Set permissions is not the same diagnostic path as the known OMEv2 reply regression, so first identify exactly which action produced the error.
Is this a known Microsoft 365 Outlook bug?
Yes. Microsoft published a known-issue notice on June 21, 2024, for the exact error while replying to an OMEv2-encrypted email from Outlook Desktop. Microsoft associated the incident with an Office change from the older MSIPC protection component to the MIP SDK.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Milestone | Build information | What it means |
|---|---|---|
| Issue onset | Current Channel Version 2402, Build 17328.20142 | The documented classic-Outlook regression began appearing in this release period. |
| First listed fix | Beta Version 2407, Build 17819.15010 | Microsoft first listed a fix in the Beta channel. |
| Current Channel rollout | Version 2407, Build 17830.20000 | Microsoft listed the fix as beginning to roll out to Current Channel. |
Those build numbers describe the historical incident and its rollout, not a guarantee that every later build is affected or fixed in exactly the same way. Check the build installed on the failing computer before choosing a troubleshooting branch.
How do I confirm that my case matches the documented issue?
Use the following checks in order. They distinguish the specific desktop regression from a general encryption or permissions problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify the action. Note whether the error appears while replying to an OMEv2-encrypted message, composing a new protected message, or changing permissions on an existing draft.
- Check whether the original message is protected. Look for the encryption or restricted-access indicator in the message header. Ordinary unencrypted mail points away from the documented OMEv2 path.
- Record the desktop build. In classic Outlook, open File > Office Account and record the product, update channel, version, and build number shown under Product Information.
- Try the same reply in OWA. Sign in to Outlook on the web with the same account, open the protected message, and select Reply. A successful browser reply with a desktop failure strongly suggests a classic-Outlook client issue.
- Compare another device or user. If the same account works on another computer, or other users can reply successfully, the fault is more likely local to the Outlook installation, profile, or cache.
Microsoft’s documented issue is specifically the OMEv2 reply path in classic Outlook. A failure in every client, including OWA, requires investigation of tenant configuration, identity, licensing, connectivity, or rights-management services instead of assuming the historical regression.
What should I do first to restore replies?
1. Install the latest Microsoft 365 Apps updates
In classic Outlook, go to File > Office Account > Update Options > Update Now. Allow Microsoft 365 Apps to download and install updates, close all Office applications when prompted, and restart Outlook. Recheck the displayed version and build, then retry the same protected reply.
Organizations that manage Office updates centrally may not expose Update Now. In that case, ask the Microsoft 365 administrator which update channel and deployment policy apply, and confirm when the fixed build has reached the device.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Use Outlook on the web as the immediate workaround
Open OWA in a supported browser, locate the OMEv2-protected email, and reply there. Microsoft stated that OWA and new Outlook do not have the documented classic-Outlook issue. If the browser reply succeeds, send it from OWA while the desktop application is being updated or repaired.
3. Try new Outlook if your organization allows it
New Outlook is a separate client experience from classic Outlook. Microsoft identified it as another workaround for this incident, but an organization can control whether users are allowed to install or switch to it. Do not change clients if compliance, add-ins, or retention requirements require classic Outlook without first checking with your administrator.
Why can OWA reply successfully when classic Outlook cannot?
The clients do not use identical code paths for protected mail. The known regression affected classic Outlook’s handling of the MIP SDK transition; Microsoft’s workaround guidance specifically pointed users to OWA and new Outlook. Therefore, a successful OWA test is useful evidence that the mailbox and the protected message are valid, even though it does not prove every desktop configuration is healthy.
OWA success does not rule out a local identity or policy issue. If only one account fails in the browser, check that account’s permissions and sign-in state. If OWA works for many users but classic Outlook fails on many computers, prioritize Office deployment and client diagnostics rather than tenant-wide RMS changes.
What should I check if updating Outlook does not fix it?
Branch the investigation by scope. Counting affected users, devices, and clients is more informative than repeatedly reinstalling Office on one computer.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
| Observed scope | Most likely branch | Next checks |
|---|---|---|
| One user or one device; OWA works | Client, profile, cache, or local identity | Test another device, sign out and back in, and create a fresh Outlook profile if appropriate. |
| Several users or devices; OWA works | Office build, update deployment, or a shared client configuration | Compare channels and builds, verify the rollout, and collect consistent error details. |
| OWA and classic Outlook both fail for one user | Account, policy, licensing, or rights-management configuration | Have an administrator review IRM/RMS settings and the user’s protection rights. |
| OWA and multiple clients fail for several users | Tenant-wide IRM/RMS, identity, service, or connectivity issue | Review organization configuration, trusted publishing information, service health, and diagnostic tests. |
For a single-user or single-device failure
- Test the account on a different computer. A successful test isolates the original installation or profile.
- Sign out of Office, restart Windows, and sign back in with the organization account. This can refresh an expired or inconsistent protection token.
- With administrator or support guidance, remove the affected Outlook profile and create a new one. Re-test before restoring optional add-ins or custom settings.
- Compare the failing computer’s Office channel and build with a working computer. A mismatch can explain why one installation still contains the regression.
Profile removal should be planned carefully: verify that any locally stored data, archives, signatures, and add-in settings are available before deleting a profile. Exchange mailbox data normally synchronizes again after a new profile is created, but local-only items may not.
For an OWA or multi-user failure
Ask a Microsoft 365 administrator to review IRM and RMS configuration, including the organization’s Trusted Publishing Domain and the policies applied to the affected users. Microsoft community guidance also recommends running:
Test-IRMConfiguration -Sender <sender> -Recipient <recipient>Run the command with real sender and recipient addresses in the organization’s Exchange Online PowerShell environment, and preserve the complete output for support. The test can reveal whether licensing, publishing, or rights-management communication is failing independently of the Outlook interface.
Older Microsoft IRM guidance also lists a missing, corrupt, or invalid client licensor certificate as a possible cause and references RMS licensing-service and Office 365 Rights Management diagnostics. Because that material predates current protection components, administrators should validate each recommendation against current Microsoft 365 documentation and tenant configuration before changing certificates or policy.
Recommended Free Tools
Should I add the PreferredRmsPackage registry value?
No. Microsoft’s historical example used HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0CommonDRMPreferredRmsPackage with a DWORD value of 1 to select MSIPC. Microsoft now states that this value is deprecated in current Office and no longer works.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Treat the registry entry as historical context explaining older troubleshooting articles, not as a current fix. Editing it can create confusion during support and does not restore the retired protection path. Update Office first, then follow the client-versus-tenant diagnostic branch.
When should an administrator open a Microsoft support case?
Open a case from the Microsoft 365 Admin Center when the error persists after the device is on a build containing Microsoft’s fix, or when the failure affects OWA, several clients, or multiple users without an obvious policy cause. Include enough detail for support to reproduce the correct path.
- The exact error text: “Microsoft Outlook was not able to create a message with restricted permission.”
- Whether the message was OMEv2-encrypted and whether the failure occurred on reply, new-message encryption, or permission changes.
- Classic Outlook’s update channel, version, and build from File > Office Account.
- Whether the same action succeeds in OWA or new Outlook.
- The number of affected users and devices, plus examples of working and failing clients.
- Results and timestamps from
Test-IRMConfiguration, along with relevant tenant IRM/RMS configuration findings.
Microsoft’s known-issue notice instructs customers to open a support case when the error remains after the fixed build. Supplying the comparison and scope information above prevents the case from being treated as an undifferentiated “Outlook encryption” problem.
Which client should I use while the issue is being resolved?
| Client | Protected OMEv2 reply during the documented incident | Best use | Trade-offs |
|---|---|---|---|
| Classic Outlook for Microsoft 365 | Could show the restricted-permission error on reply in affected builds. | Return to it after updating and confirming the reply works. | Requires local Office updates, profile health, and compatible add-ins. |
| Outlook on the web | Microsoft identified it as a workaround; a successful reply helps isolate a desktop problem. | Immediate browser-based reply while desktop troubleshooting continues. | Browser experience and available features may differ from classic Outlook. |
| New Outlook | Microsoft identified it as unaffected by the documented classic-Outlook issue. | Alternative client when enabled by organizational policy. | Feature, add-in, and deployment differences may affect suitability. |
Does this error mean encrypted email is permanently unavailable?
No. The documented incident was a client regression, not evidence that OMEv2 protection itself had been withdrawn. The practical distinction is whether protected mail works in another client and whether the desktop installation has reached a build containing Microsoft’s fix.
There is no authoritative prevalence or failure-rate statistic in Microsoft’s published material for this incident. Do not infer the number of affected users from a single organization’s experience; use the observed client and user scope to choose the next diagnostic step.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently Asked Questions
Can I reply to an encrypted message without removing its protection?
Yes. Replying in OWA or a fixed Outlook build is intended to preserve the protected-mail workflow. Do not forward the message as unencrypted merely to bypass the error, because that can violate the sender’s rights policy and your organization’s handling rules.
What is the difference between OMEv2 and ordinary Outlook encryption?
OMEv2 is a rights-managed message format in which access and permitted actions travel with the email. A standard transport-encrypted message can protect data in transit without imposing the same reply, forwarding, or copy restrictions, so the troubleshooting path is different.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Will changing from Current Channel to Beta permanently solve the problem?
Microsoft first listed a fix in Beta before listing Current Channel rollout, but changing update channels is an administrative deployment decision with feature and support implications. Install the approved fixed build for your organization rather than switching channels solely to chase a historical workaround.
Could an expired certificate cause the same Outlook message?
It can contribute to broader IRM failures. Older Microsoft guidance identifies a missing, corrupt, or invalid client licensor certificate as one possible cause, particularly when OWA and multiple clients also fail; administrators should confirm the condition with current tenant diagnostics before changing certificates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
