CITT

    Scan results

    Microsoft Outlook

    Android

    Stay organized with a unified inbox, intelligent filtering and multiple calendars at a glance. Outlook is free for personal use and supports Microsoft Exchange, Microsoft 365, Outlook.com, Gmail, Yahoo Mail, iCloud, IMAP and POP3.

    CITT SCORE
    89
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Work email and calendar with Microsoft 365

    What It Means For You

    Usage and diagnostic telemetry is collected by Microsoft Aria and AppCenter. Email activity and device identifiers are shared with Google Analytics, Facebook, and the Singular attribution SDK. Advertising infrastructure from Facebook Audience Network and AppNexus is present in the app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (5)

    Network Security

    1 total
    1 Low

    Code Security

    2 total
    2 Medium

    Privacy

    2 total
    1 Medium
    1 Low

    Third-Party Services

    Microsoft MSAL/ADAL, Microsoft Intune MAM, Microsoft Authenticator MFA SDK, Microsoft TokenShare SDK, Microsoft OneAuth, Microsoft AppCenter, Microsoft Aria Telemetry, Microsoft Copilot, Facebook Audience Network, Facebook React Native / Hermes, Facebook Fresco, AppNexus (Xandr) OpenSDK, Singular SDK, Google Firebase Cloud Messaging, Google Firebase Installations, Google Firebase App Indexing, Google Play Billing, Google ML Kit, Google Maps, Google Analytics, BouncyCastle, OkHttp3, Nimbus JOSE+JWT, YubiKit, LinkedIn LiTr, Snapchat Djinni, Apollo GraphQL, Evernote Android Job

    Security Strengths

    • ✓Certificate pinning implemented via OkHttp3 CertificatePinner for core Outlook domains
    • ✓Safe SSL error handling — all onReceivedSslError handlers call cancel(), zero proceed() bypasses
    • ✓HTTPS-only production endpoints — no HTTP API URLs found
    • ✓MSAL OAuth tokens encrypted with Android Keystore-backed AES-GCM
    • ✓Comprehensive backup exclusion — allowBackup=false with full domain exclusion config
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    enterprise
    email
    sensitive data
    ads
    contacts
    camera
    location

    Package

    com.microsoft.office.outlook

    Version

    5.2614.0 (versionCode 72614108)

    Analysis Date

    Apr 17, 2026

    Classes Analyzed

    4,000

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Hardcoded cloud integration secrets for Dropbox and Box create a risk that third parties could misuse these to impersonate Outlook's cloud storage connections. Ad SDKs from Facebook and Xandr collect your device's advertising ID, even for enterprise users. The app's core security architecture is strong, providing meaningful protection for your email and calendar data.

    Key Findings

    Data Security - 0 findings

    Network Security - 1 finding (1 low)

    Code Safety - 2 findings (2 medium)

    Privacy - 2 findings (1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Personal information: email addresses, contact names, calendar events
    • Device information: advertising identifier, device IDs
    • Usage data: app interactions, email metadata, preferences
    • Location data: approximate and precise location (when permission is granted)

    Third-Party Data Sharing

    The following third parties may receive your data:

    • Facebook Audience Network - advertising targeting and measurement
    • AppNexus (Xandr) - advertising targeting
    • Singular - app install attribution and analytics
    • Microsoft AppCenter - crash reporting and performance analytics
    • Microsoft Aria - usage telemetry
    • Google Analytics - usage analytics
    • Google Firebase - push notification delivery

    Understanding the Scores

    Security: 92/100
    Privacy: 88/100

    Security Breakdown

    • Data Security: 100/100 - Excellent protection of stored data with hardware-backed encryption and backup exclusions
    • Network Security: 96/100 - Strong network protections with minor concerns around add-in navigation filtering
    • Code Safety: 91/100 - Well-structured codebase with embedded cloud authorization secrets reducing the score

    Privacy Breakdown

    • Data Collection: 87/100 - Broad data collection including advertising identifiers; enterprise users may not expect ad SDK activity
    • Data Sharing: 88/100 - Data shared with multiple advertising and analytics platforms
    • User Control: 91/100 - Data deletion available; broad permissions requested but contextually appropriate for a productivity suite

    Positive Security Features

    • Secure network error handling - all connection errors are terminated, never bypassed
    • All data connections use encrypted transport with no unencrypted fallbacks
    • Sign-in session data is protected using hardware-backed secure storage on supported devices
    • App data is excluded from device backups, preventing accidental exposure via cloud sync
    • Data sharing between Outlook and other Microsoft apps is restricted to verified Microsoft-signed applications only
    • Device management capabilities are intentionally limited - the app cannot remotely wipe device data

    Areas for Improvement

    GDPR / CCPA Compliance

    The app's privacy practices could be strengthened by:

    1. Ad SDK Data Isolation
      Review whether advertising SDK initialization and device ID collection can be fully gated behind explicit user consent, particularly for enterprise deployments where advertising is disabled by policy.

    2. Third-Party Cookie Scope in Add-ins
      Restricting cross-origin cookie acceptance in the Office Add-in panel to specific trusted domains would limit the ability of embedded content to track users across sessions.

    Security Enhancements

    1. Cloud Integration Authorization Management
      Authorization codes for Dropbox and Box cloud storage integrations are embedded directly in the app. Moving these to server-side managed configurations would reduce exposure if the app binary is examined by third parties.

    2. Add-in Navigation Filtering
      The Office Add-in panel could validate navigation destinations against an approved domain list before loading content, reducing the risk of the panel being directed to unintended destinations.

    Technical Context

    App Type: Enterprise productivity - email, calendar, and cloud storage
    Classes Analyzed: 4,000
    Third-Party Services: 28
    Context Tags: enterprise, email, sensitive_data, ads, contacts, camera, location

    About This Analysis

    This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

    App Details

    Developer: Microsoft Corporation
    Version: 5.2614.0 (versionCode 72614108)
    Analysis Date: April 17, 2026
    Package: com.microsoft.office.outlook

    Analysis Limitations

    • Static analysis only (code review without running the app)
    • Based on APK version 5.2614.0 analyzed on April 17, 2026
    • May not reflect server-side security controls
    • Cannot detect all runtime behaviors

    Right of Reply

    Developer not yet contacted