# Security & Privacy Scorecard

## Microsoft Outlook

## What This Means for You

Your device's advertising identifier is collected and shared with Facebook and Xandr ad networks for targeting, and built-in authorization codes for Dropbox and Box cloud storage connections could be misused by third parties to impersonate Outlook's cloud integrations.

## Recommendation: Use With Caution

Hardcoded cloud integration secrets for Dropbox and Box create a risk that third parties could misuse these to impersonate Outlook's cloud storage connections. Ad SDKs from Facebook and Xandr collect your device's advertising ID, even for enterprise users. The app's core security architecture is strong, providing meaningful protection for your email and calendar data.

**Best For:** Microsoft 365 users who need integrated email, calendar, and cloud storage management in one app.

## Key Findings

**Data Security** - 0 findings

**Network Security** - 1 finding (1 low)

**Code Safety** - 2 findings (2 medium)

**Privacy** - 2 findings (1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Personal information: email addresses, contact names, calendar events
- Device information: advertising identifier, device IDs
- Usage data: app interactions, email metadata, preferences
- Location data: approximate and precise location (when permission is granted)

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Facebook Audience Network - advertising targeting and measurement
- AppNexus (Xandr) - advertising targeting
- Singular - app install attribution and analytics
- Microsoft AppCenter - crash reporting and performance analytics
- Microsoft Aria - usage telemetry
- Google Analytics - usage analytics
- Google Firebase - push notification delivery

## Understanding the Scores

**Security:** 92/100
**Privacy:** 88/100

### Security Breakdown

- **Data Security:** 100/100 - Excellent protection of stored data with hardware-backed encryption and backup exclusions
- **Network Security:** 96/100 - Strong network protections with minor concerns around add-in navigation filtering
- **Code Safety:** 91/100 - Well-structured codebase with embedded cloud authorization secrets reducing the score

### Privacy Breakdown

- **Data Collection:** 87/100 - Broad data collection including advertising identifiers; enterprise users may not expect ad SDK activity
- **Data Sharing:** 88/100 - Data shared with multiple advertising and analytics platforms
- **User Control:** 91/100 - Data deletion available; broad permissions requested but contextually appropriate for a productivity suite

## Positive Security Features

- Secure network error handling - all connection errors are terminated, never bypassed
- All data connections use encrypted transport with no unencrypted fallbacks
- Sign-in session data is protected using hardware-backed secure storage on supported devices
- App data is excluded from device backups, preventing accidental exposure via cloud sync
- Data sharing between Outlook and other Microsoft apps is restricted to verified Microsoft-signed applications only
- Device management capabilities are intentionally limited - the app cannot remotely wipe device data

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Ad SDK Data Isolation**
   Review whether advertising SDK initialization and device ID collection can be fully gated behind explicit user consent, particularly for enterprise deployments where advertising is disabled by policy.

2. **Third-Party Cookie Scope in Add-ins**
   Restricting cross-origin cookie acceptance in the Office Add-in panel to specific trusted domains would limit the ability of embedded content to track users across sessions.

### Security Enhancements

1. **Cloud Integration Authorization Management**
   Authorization codes for Dropbox and Box cloud storage integrations are embedded directly in the app. Moving these to server-side managed configurations would reduce exposure if the app binary is examined by third parties.

2. **Add-in Navigation Filtering**
   The Office Add-in panel could validate navigation destinations against an approved domain list before loading content, reducing the risk of the panel being directed to unintended destinations.

## Technical Context

**App Type:** Enterprise productivity - email, calendar, and cloud storage
**Classes Analyzed:** 4,000
**Third-Party Services:** 28
**Context Tags:** enterprise, email, sensitive_data, ads, contacts, camera, location

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Microsoft Corporation
**Version:** 5.2614.0 (versionCode 72614108)
**Analysis Date:** April 17, 2026
**Package:** com.microsoft.office.outlook

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 5.2614.0 analyzed on April 17, 2026
- May not reflect server-side security controls
- Cannot detect all runtime behaviors