It is reported that the new version of Win11 Outlook will send user credentials to Microsoft servers.

CTOnews.com November 14 news, according to German media heise reported that Microsoft Win11 new Outlook application has problems, will upload user credentials information to Microsoft server.

Microsoft is promoting the new Outlook application for Win11 and recommending users to migrate and upgrade. However, the media recently reported that the new version of Outlook Win11 will transfer IMAP and SMTP credentials from email accounts, as well as all emails, to Microsoft servers.

On Win11 23H2, the new Outlook version has become the default application Microsoft explained that users can switch to the previous Outlook version at any time, but the relevant data has been uploaded and stored on Microsoft servers.

Microsoft Windows 11 Outlook supports Gmail, Yahoo, iCloud and IMAP accounts, syncing between Android, iOS, Mac and Windows 11 devices.

The media noted that this would allow Microsoft to fully access all emails and read and analyze related content.

When you add an IMAP account to Windows 11 Outlook, the following prompt pops up:

If you want to add an IMAP account to Outlook, the email data will sync to Microsoft Cloud.

This sync doesn't include existing contacts or calendar entries, but anything the user subsequently creates in Outlook is saved to Microsoft Cloud.

The media sniffed packets and found that the data sent to Microsoft servers contained the user's login name and password. Although this data is protected by TLS, the data is sent to Microsoft in plain text within the tunnel.

Microsoft can use this data to authorize itself to log in to these user accounts in IMAP and SMTP in the new Windows 11 Outlook.

When switching from the old Outlook to the new Outlook, the new software is installed in parallel. Previously set up IMAP accounts do not automatically transfer, but accounts stored in Windows do.

During testing with Google accounts, users received authentication requests because OAuth2 authentication was used, Microsoft did not receive any specific access data, but only access tokens that users could revoke again.

Ulrich Kerber, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), said: "Reports that Microsoft is collecting data through Outlook are worrying."

CTOnews.com attaches a link to the original report, which interested users can read in depth.