“If you are trying to login to IMAP hosted by Google or Fastmail, why should Microsoft need to be contacted let alone given the password?” is how I read the art

“If you are trying to login to IMAP hosted by Google or Fastmail, why should Microsoft need to be contacted let alone given the password?” is how I read the article… Now, I know the answer is so that you can have push notifications sent to your mobile phone with every IMAP poll Microsoft does on your behalf, but that’s because the architecture of the new Outlook app likely borrows features of the Accompli mobile app they bought and maintained as Outlook mobile. That the desktop app re-uses the same APIs as the mobile app rather than process mail locally makes sense from a code reuse and efficiency standpoint, but really only because your accounts can seamlessly carry over to all your devices. It’s arguable that the distinction between keeping your password in the cloud and keeping your password local is a security risk. However, if you previously used Outlook.com to check your IMAP email, and maybe this is where the feature derives from, then you already provided your IMAP password to Microsoft on the web. Likewise Google for importing IMAP to Gmail. We do this because it is nicer to get one inbox and one push notification across multiple accounts - when we want cloud providers checking emails for us. It is less clear why a desktop app would do this unless you opted in to fancier service of some kind - e.g. viewing emails on the web when not at this device, or push notifications to your mobile phone, etc. If Microsoft wanted to read your emails even with a locally stored and never shared IMAP password, they could still send telemetry derived from the local client to build an advertising profile based on local emails, or to display targeted ads. They don’t technically need your password to read your emails if you are using their email client.