# Security & Privacy Scorecard

## Microsoft Office

Microsoft Office mobile app for creating, editing, and collaborating on Word documents, Excel spreadsheets, PowerPoint presentations, and PDFs. Integrated with Microsoft 365 cloud services and designed for enterprise Intune MDM management.

## What This Means for You

Your Microsoft 365 account activity, device identifier, and document interactions are collected and linked to your identity within Microsoft's infrastructure, and in-app web content can interact with your account in ways that require proper IT administrator configuration to keep fully controlled.

## Recommendation: Enterprise Use Only

In-app web content bridges lack origin checks, meaning a crafted link could silently interact with your Microsoft 365 account if an administrator has not applied the correct Intune policy controls. The app has strong fundamentals and enterprise security features. Suitable only for managed Microsoft 365 environments under Intune MDM with proper admin controls.

**Best For:** Enterprise Microsoft 365 users under Intune MDM management who need integrated productivity with Word, Excel, and Copilot AI

## Key Findings

**Data Security** - 3 findings (1 medium, 1 low, 1 info)

**Network Security** - 3 findings (2 low, 1 info)

**Code Safety** - 2 findings (2 medium)

**Privacy** - 2 findings (2 info)

## Privacy Concerns

### What Data is Collected

- Identity data: User ID linked to your Microsoft account
- Device information: Device ID linked to your identity
- Usage data: Product interaction events and in-app activity
- Diagnostic data: Performance metrics and customer support data

### Third-Party Data Sharing

No third-party data sharing was identified in this analysis. All telemetry and analytics infrastructure is first-party Microsoft (Intune, App Center, MetricKit), governed by Microsoft's Data Processing Agreement and enterprise contracts.

## Understanding the Scores

**Security:** 87/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 92/100 - Keychain storage is hardware-bound with cross-app single sign-on; deprecated accessibility classes used by some components could expose stored account data on rebooted devices before first unlock
- **Network Security:** 94/100 - All network connections enforce strict transport security with no cleartext exceptions; minor issues with in-app navigation origin handling and link routing
- **Code Safety:** 89/100 - In-app web content bridges for authentication and Teams SDK lack caller origin validation, requiring proper Intune policy to mitigate

### Privacy Breakdown

- **Data Collection:** 100/100 - All data collection is fully disclosed in Apple's App Privacy label with valid justifications
- **Data Sharing:** 100/100 - No third-party tracking or analytics SDKs identified; all data stays within Microsoft's infrastructure
- **User Control:** 100/100 - Enterprise administrators have policy controls over data handling via Intune MDM

## Positive Security Features

- Cross-app single sign-on uses hardware-bound keys stored in the Secure Enclave across dedicated Keychain access groups
- Policy-driven transport security controls for managed enterprise deployments enforced through Intune
- Complete privacy manifests declared for the main app and all required frameworks, with valid Apple API usage justifications
- All network connections enforce strict transport security with no cleartext exceptions in any component
- No third-party tracking SDKs identified - app carries no advertising or behavioral profiling libraries
- No known security issues identified in any confirmed SDK version

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **In-App Web Content Data Loss Prevention**
   All embedded web content currently bypasses Intune data loss prevention controls (copy/paste restrictions, screenshot blocking, save-to-personal-storage blocking). Enterprises relying on Intune MAM for strict data handling enforcement should verify that their policy accounts for this gap.

2. **Document Accessibility Disclosure**
   Corporate documents are accessible via the iOS Files app and a connected computer by anyone with physical access to an unlocked device. Enterprises handling confidential documents should configure additional access controls or inform users of this behavior.

### Security Enhancements

1. **Web Bridge Caller Validation**
   The authentication and Teams SDK web bridges accept requests from any in-app web content without checking where the request originated. Adding an allowlist of trusted origins would prevent crafted links from silently interacting with a user's Microsoft 365 account.

2. **Secure Storage Accessibility Settings**
   Some components reference deprecated Keychain accessibility settings that allow stored account data to be read before a device is unlocked after reboot. Industry best practice recommends updating to accessibility classes that require the device to have been unlocked at least once.

## Technical Context

**App Type:** Enterprise productivity suite with sensitive document handling and cloud identity integration
**Classes Analyzed:** iOS binary - symbol and static analysis
**Third-Party Services:** All Microsoft first-party (IntuneMAMSwift, MSAL, OneAuth, App Center, Teams JS SDK, Microsoft Lens, Fluid Framework)
**Context Tags:** enterprise, productivity, sensitive-data, documents, cloud, microsoft365

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Microsoft
**Version:** 2.109 (Build 2.109.26041327)
**Analysis Date:** 2026-04-17
**Package:** com.microsoft.officemobile

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on iOS app version 2.109 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors