Last week, numerous media reports highlighted that the new Outlook not only syncs users’ emails but also transfers IMAP and SMTP access data associated with mail accounts to the Microsoft Cloud. In response to inquiries, the Redmond-based software giant has now addressed this unexpected data transmission in a statement to Heise Online.
According to the report, Microsoft explained that synchronizing users’ IMAP accounts helps ensure a consistent user experience for all accounts added to Outlook. The company stores access data for IMAP providers, whose servers Microsoft contacts using the Basicauth method, as encrypted user tokens within the users’ mailboxes.
“Email providers supporting OAuth (such as Gmail and Yahoo Mail) never grant us access to users’ access data, as the service receives an OAuth token from the client. This means Microsoft does not have access to the plaintext password,” the statement reportedly said. Access to these tokens is restricted solely to the users themselves and the Microsoft service interacting with the target servers.
Users have the option to avoid the new Outlook
Moreover, users have the freedom to opt out of synchronization. When setting up a new account, there’s a notification about data transmission. “Users who do not want to use their accounts with the Microsoft Cloud can cancel and switch back to the classic Outlook,” the company also explained regarding the import of mail accounts from the classic Outlook.
Switching to cloud synchronization doesn’t happen automatically. The user can always choose whether to add their accounts. However, this seemingly comes with a complete abandonment of the new Outlook, even though, according to a Microsoft blog post, it’s intended to eventually replace the classic Outlook.
Microsoft also notes that users can remove the data from the cloud by deleting the account and selecting the “Remove from all devices” option provided. Additionally, Microsoft removes the data itself after a prolonged period of inactivity as part of its Account Lifecycle Process.
Insufficient communication
However, it remains unclear why Microsoft does not explicitly inform its customers about the transfer of their IMAP and SMTP access data to the cloud. While these data might be technically necessary for some features that the new Outlook offers, this communication hasn’t been clearly articulated so far—not even in the support article that Microsoft refers to for further details on data synchronization.
“This is evident from the reactions, indicating that many users are unaware that the new Outlook transfers access data to Microsoft and actually copies emails to its cloud servers,” Heise Online explained. Even if Outlook is set up without a Microsoft account, the company pulls the emails into its cloud.
READ MORE: Renault’s Electric Revolution: Ampere Targets 40% Price Drop, Unveils Affordable Legend Model
