Android Outlook over IMAP is logging in from Microsoft servers

Question

Using Microsoft Outlook app for Android I could not add an Outlook-IMAP account on some Android tablet for some customer. However, it was no problem to add the same IMAP account to the GMail App, or some other mail Clients on the same tablet. Or to Thunderbird on Windows, even Outlook on Windows worked fine...

I wondered what the heck is going on. updated outlook on android, no change. So i setup an Test-Mail-Server and sniffed the network traffic. Turns out that my device was not talking to the Mail-Server but some Microsoft servers where... what?? got logins to my IMAP from 52.125.138.21 and 52.125.139.100. WHOIS... 52.125.0.0 - 52.127.255.255 -> Microsoft Corporation (MSFT)...

Why are they logging in to my IMAP Server with user and password... why is Andorid-Outlook telling my SECRET password to some servers @ Microsoft... and... do i have to assume they pass my credentials and all mails so some 3Letter agency? It's just stupid to transport all IMAP communication to MS and from there to the tablet.

So the question is: Is there any way to force Outlook on a Android tablet to directly communicate with the IMAP-Server? I set imap.myserver.ch:993 in the advanced settings... but this also leads to MS logging in and get all mails... still no traffic from tablet to IMAP-Server.

I'm useing Oultook Version 4.2025.3 (42025807) on a Galaxy Tab S6 Android Version 10

— DPLW | Sources

Answer

Looks like you have not read the the small print before using the

Microsoft Outlook app for Android.

Yes, what you have detected is the way the Outlook Android app works. Outlook is not an IMAP client, instead username and password are transmitted to a cloud server (named "Exchange Online") that saves these info and then logs into your mailbox, does what ever it is supposed to do in background and also allows your Outlook app to access your mailbox as well. See also the official documentation by Microsoft on that topic.

I assume access to IMAP folders is only for backward compatibility. The real target of Outlook app is accessing Outlook.com and cloud based Exchange servers. In this scenario the password is not stored on the Microsoft server, instead a generated token is used for user authentication towards the Exchange server. However all your mail, calendar and contact data still passes the Microsoft cloud servers.

BTW: This app and it's backend has not been developed by Microsoft. Instead Microsoft bought a company named "Acompli" and they are the creator of this system.

— Robert | Sources

Android Outlook over IMAP is logging in from Microsoft servers

Topics