Microsoft wants to replace Outlook with a new and modern version of the application, but it works less locally than the original client. Users with a non-Microsoft email account appear to be linking their account to the Microsoft cloud, not just the app.

The new version of Outlook for Windows computers shows strange behavior. This is what the German website Heise.de found out. The client behaves more like an extension of a cloud service than a local application, with potentially unintended consequences for users. Especially those who combine Outlook with an external email account from another provider (such as Google or iCloud) can get into trouble.

Enter the key in the Microsoft cloud

Of course, if you’re using the new Outlook, you’ll need to link the email accounts you want to use. You can also do this via a login process. As expected, anyone who logs in with an external address will be redirected to a website where they can authenticate via Oauth2. It is also possible to link an email account using IMAP data. So far everything is going well.

You might expect the credentials to give the email client access to your email account, but Microsoft goes much further. The data is sent directly to the Microsoft cloud, where it is stored and a persistent authenticated session is established. Microsoft appropriates an access token to access your email via the cloud. Outlook itself then does not communicate with your email account, but with the Microsoft servers. Microsoft positions its cloud infrastructure neatly between the client and your email account, first retrieving all emails via its cloud and only then forwarding them to your computer. XDA has reviewed the behavior.

Microsoft warns

The local role of the client himself is thereby severely restricted. Microsoft itself issues a warning when adding your account. This says that your email is effectively synced with the Microsoft cloud. Microsoft even transparently states that this synchronization occurs directly between your mail provider and the Microsoft data center. Anyone who is technically savvy can draw conclusions about the effective behavior of Microsoft and the client.

Users who are less tech-savvy or observant and simply replace their old version of Outlook with a new one may not realize that they are giving Microsoft full access to their email account. Basically, a client is software that connects to your account and retrieves your email. In the context of Outlook, however, Microsoft relegates the software to a portal for its own cloud functionality. With this approach, enabling or disabling Outlook does not affect Microsoft’s access to your email.

For business users, this behavior can be completely problematic. Anyone who chooses a provider other than Microsoft to process their emails will still pass on all of their email traffic via Outlook to Microsoft in the cloud. In addition, it is currently not possible to use the new version of Outlook as a real client. The classic version of Outlook, which retrieves email from added accounts, is still available today but will be phased out in the coming years.