This seems to be a common pattern with Microsoft Services these days. A few months ago, Outlook for Mac switched to seemingly requiring you to opt-in to having

This seems to be a common pattern with Microsoft Services these days. A few months ago, Outlook for Mac switched to seemingly requiring you to opt-in to having your IMAP credentials (or Google OAuth token I guess) stored and your mailbox and calendar mirrored to an Exchange box. There was an opt-out, but it required clicking "Not IMAP?" to use IMAP. There is also no way to discover if Microsoft stores your credentials or your mail, how much of the mail, and no way to explicitly delete the mirror. I did go through a few instances with GDPR supervisory authorities and eventually got a few questions about this answered by Microsoft. "Based on your request please find the information related to your query: • How long is mail data fetched from the non-Microsoft server retained? On 31st day of user inactivity we mark the account for removal. The account is soft deleted, and the data is purged within a week (approximately) after that. • What happens with an account that is no longer being used? Does the service continue fetching and “enhancing” mail data or does it happen on demand when a user opens Outlook? - If the user is not signing into the 3rd party accounts using outlook mobile, Teams for life or Outlook for Mac. We stop syncing any data after 7 days and mark the account for deletion after 30 days. • How do I know what data the service holds? - Service holds Mail, Calendar, contacts data and profile data for the user (User provides consent to collect this data during add account flow). • How can I make sure data is no longer retained? (e.g., does logging out from Outlook delete the mail data and credentials?) - When removing the account in Mac you can choose to "Sign Out On All Devices" which deletes the mailbox from the Microsoft Cloud (Exchange-backed mailbox where the third-party account is being synced)." This is at least a violation of GDPR as in the service strongly suggests mirroring is required for functionality whereas Article 13 2(e) makes it clear that the data controller must make it clear if data collection is a "a necessary requirement". The Supervisory Authority (dataprotection.ie) didn't seem to care though.