New Outlook hands your mailbox to Microsoft

If you add a mailbox from Noiz, or from any provider other than Microsoft, to the new Outlook, your mail and your mailbox password are copied to Microsoft's servers. Microsoft's cloud then signs in to your mailbox on your behalf and keeps a copy of everything in it. Noiz recommends Thunderbird instead, or classic Outlook for as long as Microsoft supports it.

This article explains how the sync works, why Noiz treats it as a risk, what South African law asks of a business whose mail is copied abroad, and which mail programs connect directly.

How the sync works

With a program that connects directly, your device talks to your mail server. With the new Outlook, Microsoft's cloud sits in between:

1. You type your mailbox password into Outlook. Outlook sends the server name, user name and password to Microsoft.
2. Microsoft's servers sign in to your mailbox. To your mail provider, those sign-ins come from Microsoft's network, not from your own connection.
3. Microsoft keeps a copy and serves it to the app. Your mail, calendar and contacts are copied into Microsoft's data centres, and Outlook reads them from there.

Microsoft's support article on the feature says a copy of your mail, calendar and contacts is kept "synchronized between your email provider and Microsoft data centers". It lists IMAP and POP accounts in the new Outlook for Windows, and IMAP accounts in Outlook for iOS, Outlook for Android and the new Outlook for Mac. Microsoft's Privacy Statement says the mobile app syncs this data to Microsoft servers for features such as search and mail filtering.

The article does not name a country or region for those data centres. Microsoft's Privacy Statement says desktop users can choose whether to sync, but Noiz has not found Microsoft instructions for adding an IMAP or POP mailbox to the new Outlook for Windows without it, and users report that the set-up does not offer a way round it.

Microsoft does not document how it stores the password. Keeping a mailbox in sync means signing in to it again and again, which requires keeping the password in a usable form. The German computer magazine c't reported in 2023 that, when an IMAP account is added, the new Outlook sends the server name, user name and password to Microsoft.

Why this matters

A contract or a statute describes what should happen. It does not stop it happening, and laws change. So the question is not only which laws apply, but who holds a readable copy of your mail and the password to your mailbox. Whoever does can be required to hand both over, and can change what it does with them. Three things follow.

Your password is held by a third party

Anyone with access to Microsoft's copy of the password can sign in to your mailbox at your mail provider, not only to the copy at Microsoft. Changing the password stops those sign-ins. It does not delete what Microsoft has already copied.

Your mail is held by Microsoft, in places Microsoft chooses

Microsoft's Privacy Statement says personal data may be stored in your region, the United States or any country where Microsoft operates facilities. For a South African user, the company holding the copy, and the data controller under Microsoft's own terms, is Microsoft Corporation in the United States. Every message, attachment and contact in the mailbox is personal information about your staff, clients and suppliers.

The copy can be read, and it can be handed over

The connection between Microsoft and your mail provider can be encrypted in transit. That protects the mail on the way; it does not stop Microsoft reading it once it arrives. Microsoft's servers read the mail to provide search and filtering, so the copy is not end-to-end encrypted, and Microsoft holds the keys to whatever encryption it applies.

Microsoft's transparency report says it discloses customer data when legally compelled. In the second half of 2025 it received 5,587 demands for consumer data from US law enforcement, including 115 warrants for content stored outside the United States. The US CLOUD Act (18 U.S.C. § 2713) requires a US provider to disclose data in its possession, custody or control, whether it is located inside or outside the United States.

To be precise about what Microsoft does not do: Microsoft states that it does not use the content of your email to target advertising, and its Copilot privacy FAQ says it does not train AI models on email contents. The concern is control of the copy, not advertising.

What South African law asks of you

Noiz is not a law firm and this is not legal advice. These are the provisions worth taking to your own adviser.

• POPIA section 72 says a responsible party in South Africa may not transfer personal information to a third party in a foreign country unless one of a short list of grounds applies: the recipient is bound by a law, binding corporate rules or a binding agreement giving protection substantially similar to POPIA; the data subject consents; or the transfer is necessary for a contract with, or in the interest of, the data subject. If your business's mail is copied to Microsoft Corporation by the new Outlook, your business should be able to say which ground it relies on.
• POPIA section 19 requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures, and to identify reasonably foreseeable risks. A mailbox password held by an additional company, and a copy of the mailbox outside your control, are risks to account for.
• POPIA section 21 requires a written contract with any operator that processes personal information for you. Under Microsoft's consumer terms, Microsoft Corporation is the data controller of the synced data, under its own Privacy Statement.
• POPIA section 57 requires prior authorisation from the Information Regulator before special personal information, or children's information, is transferred to a foreign country without adequate protection.
• The National Policy on Data and Cloud (Government Gazette 50741, 2024) requires government data relating to national security and sovereignty to be stored only in South Africa (paragraph 15.4.2), and says that processing of data collected in South Africa must comply with South African data protection and security laws (paragraph 15.4.1). It does not impose a general localisation rule on private businesses. Your own contracts, sector rules or client commitments may.

A Noiz mailbox is not end-to-end encrypted either

Noiz stores your mail on its servers in South Africa, under South African law, and Noiz can read it if it has to. The difference is who holds the copy and which country's law governs it. Keeping mail with a South African provider, read by a program that connects directly, keeps it under one jurisdiction and one company you have a contract with.

For mail that only you and the recipient can read, Thunderbird has OpenPGP and S/MIME built in. Both people need keys or certificates, and the sender, recipients and date stay visible to the mail servers.

Which mail programs connect directly

Why Thunderbird

Thunderbird is Free software. Free here means freedom, not price: anyone may inspect, change and share the code. It connects straight from your device to the Noiz mail server, keeps your mail on your device and on the Noiz server, and does not need an account with Thunderbird or anyone else. During set-up it may send your email domain, not your address or password, to Mozilla's settings database. It sends usage data to Mozilla by default; you can switch this off under Settings, Privacy & Security, Thunderbird Data Collection and Use.

Classic Outlook also connects directly. Microsoft has set out the stages for moving users to the new Outlook: first on by default with a way back, then no way back, and it says existing classic installations will be supported until at least 2029. Its optional connected experiences, such as Editor, Translator and Suggested replies, send the text you are working on to Microsoft; you can switch them off under File, Account, Account Privacy, Manage Settings. If you are on Outlook 2016, 2019 or 2021, move to Thunderbird rather than to another version of classic Outlook.

Businesses with Microsoft 365 work accounts can stop staff adding other accounts to the new Outlook with Microsoft's PersonalAccountsEnabled mailbox policy.

If you already use the new Outlook with a Noiz mailbox

1. Set up the mailbox in Thunderbird, or turn the New Outlook toggle off to return to classic Outlook, and add the mailbox there.
2. In the new Outlook, open Settings, Accounts, select Manage next to the Noiz mailbox, select Remove and choose Remove from all devices. Microsoft says this removes the account and its Microsoft Cloud data across Outlook clients. Remove the account from the Outlook phone app as well.
3. Change the mailbox password. Microsoft's servers can then no longer sign in to your mailbox.
4. Ask Noiz to check whether Microsoft's servers are still signing in to your mailbox.

Noiz support can help with any of these steps. Open a ticket from your client area and name the mailboxes involved.

Sources

Checked 9 October 2026.

Microsoft

• Sync account in Outlook for Mac to Microsoft Cloud and Sync your account to the Microsoft Cloud
• Add an email account to Outlook for Windows
• Accounts in the new Outlook for Windows
• Stages of migration to new Outlook for Windows
• Microsoft Privacy Statement (September 2026) and Microsoft Services Agreement (effective 30 September 2026)
• Law Enforcement Requests Report (second half of 2025)
• Privacy FAQ for Microsoft Copilot
• Connected experiences in Microsoft 365
• Product lifecycle: Outlook 2021, Outlook 2024

Law

• Protection of Personal Information Act 4 of 2013, sections 19, 21, 57 and 72
• National Policy on Data and Cloud, Government Gazette 50741, Notice 2533 of 2024
• 18 U.S.C. § 2713 (CLOUD Act)

Thunderbird

• Thunderbird Privacy Notice
• Thunderbird Telemetry
• OpenPGP in Thunderbird
• Thunderbird for Android

Reported

• heise/c't, Microsoft lays hands on login data: Beware of the new Outlook, 10 November 2023

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.