Guidance on new Outlook app for iOS/Android

February 9, 2015

On January 29th, Microsoft released Outlook for iOS and Outlook for Android.
Information Systems & Technology (IS&T) currently recommends that users not install this application for security reasons.

The new Outlook for iOS and Android remotely stores a copy of your Exchange password. In short, Microsoft stores your MIT username and password on their servers, outside of any audit controls employed by the Institute, and interfaces with MIT’s systems on your behalf.
Additionally, per the application’s end-user license agreement, your emails, contacts, calendar data, tasks, etc. will be stored on Microsoft's servers for up to 30 days.
Because of this architecture, the ability to remotely wipe a lost or stolen device is not possible.
IS&T recommends the use of mobile applications that leverage Microsoft ActiveSync (more information: http://kb.mit.edu/confluence/x/XQdS) to ensure that devices are protected by security policies in place at the Institute.
Until Microsoft implements changes that allow this app to respect those security policies, IS&T recommends removing or avoiding this application altogether.