Microsoft OneDrive Security & Privacy Scorecard

Microsoft OneDrive

What This Means for You

Your advertising ID is linked to your Microsoft account and sent to Microsoft's servers even when you have set your device to limit ad tracking, and other apps installed on your phone can quietly query your OneDrive file and folder metadata without needing any special permission.

Recommendation: Use With Caution

Multiple medium-severity issues were identified in this version of the app. Other apps installed on your device can query your OneDrive file metadata without any access restriction, and your advertising ID is collected and linked to your Microsoft account even after you have opted out of ad tracking. The app's core security practices are strong overall, making it appropriate for most users who are comfortable with Microsoft's data practices.

Best For: Microsoft 365 and enterprise users who need seamless cloud storage and accept Microsoft's data practices

Key Findings

Data Security - 2 findings (1 medium, 1 low)

Network Security - 2 findings (1 medium, 1 low)

Code Safety - 7 findings (1 medium, 2 low, 4 info)

Privacy - 4 findings (2 medium, 2 info)

Privacy Concerns

What Data is Collected

• Personal information: Microsoft account identity, email address, contact names
• Device information: advertising ID, device user agent, operating system version
• Usage data: app interactions, file access patterns, install referrer source
• Location data: location metadata from photos; location summaries sent to Microsoft's AI service when using the Copilot feature
• Photo and media metadata: photo counts, recognized person names, tags, and year ranges transmitted to Microsoft's AI backend when you use the "Ask My Photos" Copilot feature

Third-Party Data Sharing

The following third parties may receive your data:

• Microsoft (telemetry and AI) - usage analytics, crash reports, and photo library metadata (when using Copilot) are sent to Microsoft's telemetry and AI infrastructure
• Google (advertising and services) - your advertising ID and device information are collected via Google's advertising framework; Firebase services handle push notifications and crash reporting
• Syndeo/Klondike (attribution) - install referrer and advertising ID are collected for measuring how you found and installed the app

Understanding the Scores

Security: 90/100
Privacy: 88/100

Security Breakdown

• Data Security: 91/100 - Files are encrypted in transit and at rest; locally cached sign-in data uses a weaker protection method with a low iteration count rather than the stronger hardware-backed key storage available on modern Android devices
• Network Security: 91/100 - All production connections use encrypted channels; a global configuration setting permits unencrypted connections that the operating system would not otherwise block
• Code Safety: 91/100 - Strong authentication security throughout; some internal data access points are reachable by any other app installed on your device without a permission grant, and a pre-production test server is registered in the production build

Privacy Breakdown

• Data Collection: 88/100 - Collects location, device identifiers, usage data, and photo metadata; the Copilot AI feature sends photo library summaries including recognized person names and location information to Microsoft's AI service
• Data Sharing: 96/100 - Data flows primarily within Microsoft's own infrastructure, with limited sharing to Google services for advertising measurement
• User Control: 89/100 - You can request data deletion; your advertising opt-out setting is recorded but does not stop collection or transmission of your advertising ID

Positive Security Features

• Secure login uses industry-standard OAuth 2.0 protections including state verification and code exchange methods, reducing the risk of account takeover during sign-in
• Cross-app account sharing verifies the requesting app's identity by comparing its cryptographic certificate rather than just its name, preventing impersonation attacks
• The authentication browser interface is strictly restricted to Microsoft-owned domains and is automatically removed when navigating away from those pages
• Navigation links require an active signed-in account before processing, preventing unauthorized access from an unauthenticated state
• Regional data residency options are supported, allowing data to stay within the EU, Australia, Japan, or US based on your account region

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Honor Advertising Opt-Out Settings
   When a user has enabled "Limit Ad Tracking" on their device, advertising identifiers should not be collected or transmitted. The current implementation records the opt-out flag but does not act on it, linking your advertising ID to your persistent Microsoft account identity regardless of your preference.

2. Align Play Store Privacy Disclosures with Actual Data Collection
   The Play Store data safety section states "No data shared with third parties" and does not disclose advertising ID or install referrer collection. Accurate disclosure helps users make informed choices before installing the app.

3. Improve In-App Disclosure for Copilot AI Features
   The "Ask My Photos" feature transmits photo library data - including recognized person names and location summaries - to Microsoft's AI service. A clear, prominent disclosure before first activation would better inform users about this data use.

Security Enhancements

1. Use Hardware-Backed Storage for Cached Sign-In Data
   Modern Android devices support secure hardware storage for sensitive keys. Switching to this method for protecting locally cached sign-in data would meaningfully raise the bar against offline recovery attempts on extracted device storage.

2. Restrict File Metadata Access to Authorized Apps
   Four data access points in the app are currently open to any other app installed on the device without any OS-level permission check. Adding permission declarations to these access points would prevent other installed apps from quietly querying your OneDrive file and folder information.

3. Validate Destination Before Sending Account Data in Embedded Document Views
   The SharePoint document embed feature constructs its destination URL from data passed through internal app navigation. Adding a strict allowed-host check before sending account access data would prevent a compromised component from redirecting that data to an unintended server.

Technical Context

App Type: Cloud storage and productivity - handles sensitive personal files, documents, and photos
Classes Analyzed: 4,000
Third-Party Services: 26
Context Tags: cloudstorage, documents, photos, enterprise, microsoft, copilot, ai, sensitivedata, location, camera

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Microsoft Corporation
Version: 7.52 (versionCode: 2027520202)
Analysis Date: 2026-04-17
Package: com.microsoft.skydrive

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 7.52 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors