Scan results

Recommendation: Enterprise Use Only

In-app web content bridges lack origin checks, meaning a crafted link could silently interact with your Microsoft 365 account if an administrator has not applied the correct Intune policy controls. The app has strong fundamentals and enterprise security features. Suitable only for managed Microsoft 365 environments under Intune MDM with proper admin controls.

Key Findings

Data Security - 3 findings (1 medium, 1 low, 1 info)

Network Security - 3 findings (2 low, 1 info)

Code Safety - 2 findings (2 medium)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Identity data: User ID linked to your Microsoft account
• Device information: Device ID linked to your identity
• Usage data: Product interaction events and in-app activity
• Diagnostic data: Performance metrics and customer support data

Third-Party Data Sharing

No third-party data sharing was identified in this analysis. All telemetry and analytics infrastructure is first-party Microsoft (Intune, App Center, MetricKit), governed by Microsoft's Data Processing Agreement and enterprise contracts.

Understanding the Scores

Security: 87/100
Privacy: 100/100

Security Breakdown

• Data Security: 92/100 - Keychain storage is hardware-bound with cross-app single sign-on; deprecated accessibility classes used by some components could expose stored account data on rebooted devices before first unlock
• Network Security: 94/100 - All network connections enforce strict transport security with no cleartext exceptions; minor issues with in-app navigation origin handling and link routing
• Code Safety: 89/100 - In-app web content bridges for authentication and Teams SDK lack caller origin validation, requiring proper Intune policy to mitigate

Privacy Breakdown

• Data Collection: 100/100 - All data collection is fully disclosed in Apple's App Privacy label with valid justifications
• Data Sharing: 100/100 - No third-party tracking or analytics SDKs identified; all data stays within Microsoft's infrastructure
• User Control: 100/100 - Enterprise administrators have policy controls over data handling via Intune MDM

Positive Security Features

• Cross-app single sign-on uses hardware-bound keys stored in the Secure Enclave across dedicated Keychain access groups
• Policy-driven transport security controls for managed enterprise deployments enforced through Intune
• Complete privacy manifests declared for the main app and all required frameworks, with valid Apple API usage justifications
• All network connections enforce strict transport security with no cleartext exceptions in any component
• No third-party tracking SDKs identified - app carries no advertising or behavioral profiling libraries
• No known security issues identified in any confirmed SDK version

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. In-App Web Content Data Loss Prevention
   All embedded web content currently bypasses Intune data loss prevention controls (copy/paste restrictions, screenshot blocking, save-to-personal-storage blocking). Enterprises relying on Intune MAM for strict data handling enforcement should verify that their policy accounts for this gap.

2. Document Accessibility Disclosure
   Corporate documents are accessible via the iOS Files app and a connected computer by anyone with physical access to an unlocked device. Enterprises handling confidential documents should configure additional access controls or inform users of this behavior.

Security Enhancements

1. Web Bridge Caller Validation
   The authentication and Teams SDK web bridges accept requests from any in-app web content without checking where the request originated. Adding an allowlist of trusted origins would prevent crafted links from silently interacting with a user's Microsoft 365 account.

2. Secure Storage Accessibility Settings
   Some components reference deprecated Keychain accessibility settings that allow stored account data to be read before a device is unlocked after reboot. Industry best practice recommends updating to accessibility classes that require the device to have been unlocked at least once.

Technical Context

App Type: Enterprise productivity suite with sensitive document handling and cloud identity integration
Classes Analyzed: iOS binary - symbol and static analysis
Third-Party Services: All Microsoft first-party (IntuneMAMSwift, MSAL, OneAuth, App Center, Teams JS SDK, Microsoft Lens, Fluid Framework)
Context Tags: enterprise, productivity, sensitive-data, documents, cloud, microsoft365

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Microsoft
Version: 2.109 (Build 2.109.26041327)
Analysis Date: 2026-04-17
Package: com.microsoft.officemobile

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 2.109 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors