Microsoft Outlook

Is Outlook safe?

Outlook is safe enough for ordinary email, and weaker on privacy than its business reputation suggests. The free app shows ads, Apple's privacy label says usage data may be used to track you across other companies' apps, and adding a Gmail, Yahoo, iCloud or IMAP account can put a copy of that mailbox on Microsoft's servers. Security is middling: mail is encrypted in transit but not end to end, and in 2023 hackers that Microsoft and the US government link to China read Outlook.com mail with a stolen Microsoft signing key. We score it 56/100, below Gmail at 62.

This page covers the Outlook apps for phones, the new Outlook for Windows and Outlook.com. Work and school accounts are run by your employer's settings, not Microsoft's consumer defaults.

What happens to your other email accounts

The new Outlook for Windows, Outlook for iOS and Android, and the new Outlook for Mac let you add non-Microsoft accounts. Microsoft's help page explains that syncing such an account to the Microsoft Cloud means "a copy of your email, calendar, and contacts will be synchronized between your email provider and Microsoft data centers." For Gmail, Yahoo, iCloud and IMAP accounts on mobile and Mac, and for Gmail and Yahoo in the new Outlook for Windows, that is how Outlook delivers features such as Focused Inbox and snoozing. Microsoft's own terms and privacy statement then apply to that data, on top of your email provider's.

In November 2023 the German magazine c't tested the new Outlook for Windows with an IMAP account and found that the server name, username and password were sent to Microsoft. The connection was protected with TLS, but the password was readable inside it. For Google accounts, Outlook used OAuth, so Microsoft received only an access token that you can revoke. Ulrich Kelber, then Germany's federal data protection commissioner, said he was alarmed and asked Ireland's Data Protection Commission, Microsoft's lead EU regulator, for a report. The University of Bonn told staff and students not to use the new Outlook and several other mail apps that work this way.

If your mail sits with a small provider, an employer or a university, think twice before adding it to Outlook. Use the provider's own app or webmail instead.

Ads and tracking in the free version

Microsoft says plainly that the free version shows ads "to support running this free service". They appear between messages with an "Ad" label, and Outlook on the web adds a larger display ad at the side. A Microsoft 365 subscription, from $1.99 a month in the US, removes them.

Apple's label lists advertising data (a type of usage data) used to track you and linked to you for third-party advertising. Emails, contacts and search history are linked to your identity for analytics, personalisation and app functions. On Google Play, Microsoft says it shares device IDs with other companies for advertising.

On email content, Microsoft's privacy statement says it "does not use what you say in email" to target ads. Its ads help page adds an exception. In some regions you can opt in to let Outlook analyse emails from commercial senders (shops, newsletters, receipts) to personalise ads, while emails from friends and family are filtered out by domain. The setting is opt-in and can be switched off.

The Storm-0558 attack

From 15 May 2023, a China-based group Microsoft calls Storm-0558 used a stolen Microsoft consumer signing key to forge access tokens and read email in Outlook.com and Exchange Online. Microsoft said about 25 organisations were affected, including government agencies and related consumer accounts. A customer, the US State Department, alerted Microsoft on 16 June; Microsoft's own systems had not spotted it.

The US Cyber Safety Review Board concluded in 2024 that the intrusion "should never have happened" and resulted from "a cascade of security failures at Microsoft", including a security culture it called inadequate. Hackers downloaded about 60,000 emails from the State Department alone. Ordinary users were not the target, but the episode shows the limits of trusting any provider that can read your mail.

How to use Outlook more safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for your Microsoft account, and use the Microsoft Authenticator app rather than text messages where you can.
2. Do not add IMAP accounts from work, a university or a small provider to the new Outlook. Read them in the provider's own app.
3. In Outlook's settings and the Microsoft privacy dashboard, turn off personalised ads and the use of commercial emails for ads.
4. For sensitive messages, use Encrypt or Do Not Forward if you have Microsoft 365 Personal or Family, or switch to an end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary service such as Proton Mail.
5. Treat any email about your Microsoft account, a parcel or an invoice as suspect until you have checked it by opening the website yourself, not the link.

How we scored it

Privacy (45) is the weakest factor: ads in the free version, usage data used for tracking, and mailboxes from other providers copied to Microsoft's cloud. Security (58) is held back by the Storm-0558 attack and the lack of default end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, though message encryption is available to paying users. The regulatory record (68) reflects no fine against Outlook, with German criticism of credential syncing that has not led to a published decision.