# Security & Privacy Scorecard

## Microsoft 365 Copilot

## What This Means for You

Your voice queries and Copilot chat sessions are tagged as containing personal information and customer content before being sent to Microsoft telemetry servers, and your device's advertising identifier is collected for install attribution without an in-app opt-out.

## Recommendation: Acceptable for Enterprise Use

Enterprise users on managed Intune devices can use safely. Privacy-conscious users should be aware of telemetry collection and an authentication bridge security issue before installing. IT administrators should review whether advertising identifier collection aligns with organisational privacy policies.

**Best For:** Enterprise Microsoft 365 users on managed Intune devices where IT policy controls data handling

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 2 findings (1 medium, 1 low)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Personal information: email address, name, account identifiers
- Device information: device model, manufacturer, OS version, screen resolution, locale, timezone, carrier country, network operator, persistent install identifier
- Usage data: app interactions, voice session events, Copilot chat metadata, AI-generated content metadata
- Advertising identifier: Google Advertising ID collected for install attribution (Limit Ad Tracking flag respected)

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Microsoft 1DS/Aria - telemetry and analytics, including voice session data classified as personal information and customer content
- Microsoft AppCenter - device diagnostics and analytics (carrier, model, locale, timezone, install UUID)
- Klondike Attribution (Microsoft) - install attribution using advertising identifier, install referrer URL, and click timestamps
- Google Install Referrer API - install source and referrer URL
- Firebase (FCM only) - push notifications only; analytics explicitly disabled

## Understanding the Scores

**Security:** 92/100
**Privacy:** 91/100

### Security Breakdown

- **Data Security:** 93/100 - Copilot session responses and authentication data are protected, though some AI response metadata written to local storage is not fully covered
- **Network Security:** 90/100 - All Microsoft cloud connections use secure transport; a global cleartext HTTP allowance remains for legacy on-premises server compatibility
- **Code Safety:** 100/100 - No unsafe code patterns identified across 15,000 classes analyzed

### Privacy Breakdown

- **Data Collection:** 91/100 - Broad telemetry collection including voice data; advertising identifier used in an enterprise context with no standalone opt-out
- **Data Sharing:** 95/100 - Data sharing limited to Microsoft-owned services and standard platform APIs; no broad third-party advertising ecosystem
- **User Control:** 92/100 - Users can request data deletion and the app respects system-level ad tracking limits, but in-app telemetry controls are limited

## Positive Security Features

- Authentication is handled through Microsoft's identity library with Azure AD, keeping sign-in flows within a well-audited platform
- Authentication data is protected using the device's hardware-backed secure storage
- Local device backup of app data is disabled, preventing sensitive content from appearing in unprotected phone backups
- All secure connections enforce strict error checking, rejecting invalid or untrusted server identities
- Enterprise-managed devices benefit from additional network traffic protection through Microsoft Intune management
- Firebase push notification infrastructure is used for notifications only; Firebase analytics are explicitly turned off
- AI inference for smart features runs on-device via Google ML Kit, meaning that data is not sent to external servers for processing
- FIDO2 hardware security key authentication is supported via Yubico, enabling strong phishing-resistant login for enterprise users
- The advertising identifier Limit Ad Tracking flag is respected, so users who have opted out system-wide are not tracked

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Consent Gating for Telemetry**
   Telemetry collection, including voice session data classified as personal information, begins at app startup before any consent acknowledgement can be confirmed. Adding an explicit consent check before the first telemetry transmission would align with GDPR requirements for processing personal data.

2. **Advertising Identifier Use in Enterprise Context**
   The advertising identifier is collected for install attribution without an in-app mechanism to opt out independently of the system-wide ad tracking toggle. For an enterprise productivity app, organisations and privacy-conscious users should have a direct way to disable this collection.

3. **Full Coverage of Local AI Session Storage**
   Some Copilot session metadata stored locally - including document sensitivity labels and source document references - is not handled per security standards. Extending the same protection already applied to the main response content would reduce exposure on shared or compromised devices.

### Security Enhancements

1. **Restrict Authentication Bridge Origins**
   The in-app authentication bridge that handles Microsoft 365 sign-in flows within embedded pages accepts messages from any page origin. Restricting this to known Microsoft domains would prevent a compromised or malicious embedded page from triggering authentication flows.

2. **Scope Cleartext HTTP Permissions**
   The current configuration allows unencrypted HTTP connections to any host. Restricting this allowance to only the specific legacy on-premises server scenarios that require it would prevent accidental unencrypted data transmission in other contexts.

## Technical Context

**App Type:** Enterprise AI productivity app (high sensitivity - handles work documents, emails, and voice input)
**Classes Analyzed:** 15,000
**Third-Party Services:** 24
**Context Tags:** enterprise, productivity, office, ai, documents, voice, cloud, ads

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Microsoft Corporation
**Version:** 16.0.19929.20060 (build 45158845)
**Analysis Date:** 2026-04-17
**Package:** com.microsoft.office.officehubrow

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 16.0.19929.20060 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors