The new Outlook is not what it seems at first glance: a replacement for Microsoft Office Outlook – at least for now. However, Microsoft is praising the new Outlook and wants to persuade users to switch. But be careful: anyone who tries the new Outlook risks transferring their IMAP and SMTP access data to their mail accounts, as well as all their emails to Microsoft servers. Although Microsoft explains that it is possible to reuse previous applications at any time, the data will already be stored by the company. Microsoft can then read the email messages.

The new Outlook now appears as a recommended application in the Windows Start menu. This is on devices running Windows 11 with the 2023 update. The Outlook client itself also advertises the new version with the “Try the new Outlook” button. It's still in development, but it's expected to replace the email program and calendar included in Windows in 2024. In a recent tech community article, Microsoft employee Caitlin Hart explains that it will also replace classic Outlook.

When you add a mail account in the new Outlook that is not hosted by Microsoft, but rather on the company's mail servers, for example, the program displays a message. The message refers to a support article that simply states that non-Microsoft accounts are synchronized with the Microsoft cloud, with Gmail, Yahoo, iCloud and IMAP accounts currently supported. The new Outlook also does this in versions for Android, iOS and Mac. This means that copies of “emails, calendars and contacts are synchronized between your email provider and Microsoft data centers”. This gives the company full access to all emails and allows you to read and analyze them. Microsoft aims to offer functions that Gmail and IMAP do not offer.

The warning makes us think! What is Microsoft transferring and where?

When creating an IMAP account, heise was able to register that the destination server, login name and password are transferred to the Microsoft server. Although protected by TLS, data is sent to Microsoft in plain text over the tunnel. Without informing or asking, Microsoft authorizes full access to the IMAP and SMTP access data of new Outlook users.

Microsoft already attracted attention at the beginning of the year with similar situations. After Office updates on Mac computers, Outlook redirected data to Microsoft's cloud server without any query. At that time, the solution was to delete the IMAP accounts and configure them again. However, it is obvious that this is no longer useful with the new Outlook.