Classic Outlook Block Screen Capture in New Outlook: What Changed

You may have used a policy in classic Outlook to block users from taking screenshots of emails or calendar items. That feature relied on Information Rights Management to prevent screen capture on protected messages. In new Outlook for Windows, the same screen capture block works differently because the app uses a different codebase and security model. This article explains what changed, how the policy now applies, and what you must configure to keep your organization’s sensitive content protected.

How Screen Capture Blocking Worked in Classic Outlook

In classic Outlook, screen capture blocking was part of Information Rights Management. You could protect an email with IRM and then set a permission that prevented the recipient from copying, forwarding, or taking screenshots. Classic Outlook handled this by disabling the Print Screen key and by hiding the message content when the user tried to capture the screen. The feature worked only when the email had an IRM template applied that explicitly blocked screen capture.

The classic Outlook implementation relied on the Windows Graphics Device Interface and a hook into the keyboard driver. When a protected message was displayed, Outlook would intercept the Print Screen key press and either ignore it or replace the screen content with a black rectangle. This method was not perfect. Some third-party screen capture tools could bypass the block by accessing the screen buffer directly.

Prerequisites for Classic Outlook

To use screen capture blocking in classic Outlook, you needed:

• An active Azure Rights Management subscription (part of Microsoft 365 E3 or E5)
• An IRM template with the “Do Not Forward” or a custom template with screen capture disabled
• Windows 7 or later

What Changed in New Outlook for Windows

New Outlook for Windows is built on the same web-based codebase as Outlook on the web. This means the screen capture blocking mechanism is now handled by the browser engine and the Windows 10/11 Desktop Duplication API. Instead of hooking the keyboard driver, new Outlook uses the Windows 10/11 protected window feature. When a protected message is open, Windows marks the window as protected. Any screen capture tool that uses the Desktop Duplication API will see a black rectangle instead of the window content.

The new method is more reliable against modern screen capture tools that use the DirectX or Windows Graphics Capture API. However, it introduces a new requirement: the user must be running Windows 10 version 1809 or later. Windows 11 is fully supported. Windows 10 versions older than 1809 cannot enforce the protected window flag.

Group Policy and Cloud Policy Changes

Classic Outlook group policies are stored in the Outlook 16 administrative template files. New Outlook uses a different set of policies. You must download and install the new Outlook administrative templates from the Microsoft 365 admin center. Alternatively, you can use the Microsoft 365 Apps cloud policy service to configure screen capture blocking for new Outlook without deploying local group policies.

The specific policy setting for screen capture blocking in new Outlook is located under:

User Configuration > Administrative Templates > Microsoft Outlook 2016 > Outlook Options > Other > Information Rights Management

The setting is named “Configure screen capture protection for IRM-protected messages.” In classic Outlook, this setting was named “Block screen capture of protected messages.” The behavior is identical, but the policy path changed.

Steps to Configure Screen Capture Block in New Outlook

Method 1: Using Group Policy (on-premises AD or local)

1. Download the new Outlook administrative templates
   Go to the Microsoft 365 admin center, select Health > Software updates > Administrative Templates. Download the latest Outlook 16 ADMX files for new Outlook.
2. Copy the ADMX and ADML files to your policy store
   Copy the Outlook 16 ADMX file to your Central Store or the PolicyDefinitions folder on your domain controller. Copy the matching ADML language file to the en-US subfolder.
3. Open the Group Policy Management Console
   Open gpmc.msc and edit the GPO that applies to your Outlook users.
4. Navigate to the screen capture policy
   Go to User Configuration > Policies > Administrative Templates > Microsoft Outlook 2016 > Outlook Options > Other > Information Rights Management.
5. Enable the policy
   Double-click “Configure screen capture protection for IRM-protected messages.” Set it to Enabled. In the options, choose “Block screen capture for IRM-protected messages.” Click OK.
6. Apply the GPO to users
   Link the GPO to the organizational unit containing your Outlook users. Run gpupdate /force on test machines to verify.

Method 2: Using Microsoft 365 Cloud Policy

1. Sign in to the Microsoft 365 admin center
   Go to admin.microsoft.com and sign in with a Global Admin or Office Apps Admin role.
2. Open the Cloud Policy service
   Select Settings > Org settings > Cloud Policy service for Microsoft 365.
3. Create a new policy configuration
   Click Create policy. Give it a name such as “Outlook Screen Capture Block.”
4. Add the screen capture policy setting
   In the Search box, type “screen capture.” Select “Configure screen capture protection for IRM-protected messages.” Set it to Enabled. Choose “Block screen capture for IRM-protected messages.” Click Next.
5. Assign the policy to security groups
   Select the security group that contains your Outlook users. Click Create.
6. Wait for policy sync
   Cloud policy changes take up to 3 hours to apply to new Outlook clients. Users must restart new Outlook to see the change.

Method 3: Applying IRM Protection to Emails

1. Create an IRM template with screen capture blocked
   Sign in to the Azure portal. Go to Azure Information Protection > Templates. Create a new template or edit an existing one. Under Permissions, set “Do Not Forward” or add a custom permission that disables screen capture.
2. Publish the template to users
   In the same template settings, assign the template to users or groups. Save and publish.
3. Apply the template in new Outlook
   When composing a new email, select Options > Encrypt > select your IRM template. The recipient will see a protected message, and screen capture will be blocked.

Common Issues After Switching to New Outlook

Screen capture block does not work on Windows 10 versions older than 1809

If users run Windows 10 version 1709 or earlier, the protected window API is not available. The screen capture block will not function. Users on these versions will be able to take screenshots of IRM-protected messages. Upgrade affected machines to Windows 10 version 1809 or later, or to Windows 11.

Third-party screen capture tools still work

Tools that use the Windows Graphics Capture API will be blocked. However, tools that access the screen via a hardware capture card or a camera pointed at the monitor cannot be blocked by software. This is a limitation of any software-based screen capture prevention. Inform users that physical capture methods are outside the scope of this protection.

Policy does not apply after switching from classic Outlook

If you previously configured screen capture blocking using classic Outlook group policies, those policies do not carry over to new Outlook. You must deploy the new Outlook-specific policy using one of the methods described above. Verify the policy is applied by opening new Outlook, pressing Ctrl and clicking the File tab, then selecting Options. The screen capture protection setting should show as enabled.

Classic Outlook vs New Outlook: Screen Capture Block Comparison

Item	Classic Outlook	New Outlook
Enforcement method	Keyboard hook + GDI overlay	Windows protected window API
Minimum Windows version	Windows 7	Windows 10 version 1809
Policy location	Outlook 16 ADMX, IRM section	New Outlook ADMX, same section but separate file
Cloud policy support	Limited (older cloud policy)	Full support via Microsoft 365 Cloud Policy
Bypass by third-party tools	Possible via legacy screen capture APIs	Blocked for tools using Desktop Duplication API

You can now configure screen capture blocking for new Outlook using group policy or cloud policy. Test the setup on a small group of users before deploying broadly. For maximum protection, combine IRM protection with the Windows 10/11 protected window feature and ensure all users run a supported Windows version. The new enforcement method is more robust against modern screen capture tools, but physical capture methods remain a limitation you should document in your security policy.