I'm trying to determine the best solution that allows me to assure our CEO that his Office 365 mailbox cannot be read by anyone, including myself, an admin.
Obviously the mailbox is already locked down for his access only, but I could grant myself access and nose around if I were that way inclined. I'm certainly not, but the sensitivity of the data means we need an airtight solution. Auditing of the mailbox/server is not enough.
I'm thinking that mailbox permissions can never lock an admin out 100%, so some form of encryption of the messages will be required, so that even if I were to access the mailbox, I could not read the messages. He will be sending and receiving emails internally and externally, and uses Outlook on Mac/PC, and iOS to access his emails. I can't account for the external recipients' email clients, and ideally need to avoid any additional client side software.
Please could someone help with a suitable suggestion and give a high-level overview of what the solution entails? If you need more info please let me know.
Many thanks,