It uses OAuth2 rather than IMAP for Google accounts, as per Heise's German-language reporting which was previously linked in HN (I haven't yet checked their Eng

It uses OAuth2 rather than IMAP for Google accounts, as per Heise's German-language reporting which was previously linked in HN (I haven't yet checked their English-language article). So the Google account password doesn't get sent to Microsoft servers or stored locally or anything, as it does with a regular IMAP account. Microsoft stores an OAuth2 access token for these accounts, which is still unnecessary compared to the locally synced version of Outlook we're all used to, but the user can revoke it through Google account settings at any time, just like any other OAuth2 access token.