Ask Secure Message a question. Answers come from this site's docs only. I will cite a page. I will not invent a product claim.
Microsoft is retiring OME. You host the gateway. Community starts with inbound filtering. The one-time-code portal is Professional — not Purview.
Microsoft is retiring Office 365 Message Encryption in favor of Microsoft Purview Message Encryption. The new name does not move the keys or the message path onto your host. Purview still processes protected mail on Microsoft infrastructure.
Point MX at Secure Message and relay outbound through it as a smart host. Mailboxes stay where they are. On Professional, matching outbound mail is held and opened in a one-time-code portal. Encryption keys live on the host you run. Message content is not sent to us unless you opt into a hosted AI provider, and it does not sit in a Microsoft encryption service.
This is email. Recipients do not install a client, join a chat, or create an account. They open a link and enter a one-time code sent to the mailbox they already have. There is no paging product and no extra identity for the reader.
Enterprise adds Autopilot, eDiscovery, and DLP. The inbound classifier is one Enterprise signal and stays off until you turn it on.
Rubix PDF Sign fills, signs and flattens PDFs on the workstation. No cloud account, no telemetry. It is a free download, and meant to pair with the gateway: sign locally, then send through Secure Message.