6 ms·

It's crazy to think about the amount on insight outlook's data collection must provide on the inner workings of so many companies across so many different indus

It's crazy to think about the amount on insight outlook's data collection must provide on the inner workings of so many companies across so many different industries, even their own competitors. There's no way Microsoft isn't at least trying to use that data for their own benefit, yet somehow the company is still such a mess. Companies just blindly trust MS with their data and even force their employees to hand their personal data over in the process. I've pushed for my company to stop leaking so much company/employee/customer data to MS, but as long as the corporation doesn't personally experience how that data is being used/abused and they aren't being fined or hauled into court over it I doubt much will change.

sabarn01 3y ago
We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does.
- gtvwill 3y ago
  They can access your whole tenant and everything in it. Have had some pretty wild support calls where MSFT has had to crawl through a tenants data specifically the schedule system. It was ultra broken. They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. Their use of 3rd party and external tools for adjusting registry during licensing problems is wild.
  - sabarn01 3y ago
    You can get access with customer permission for a limited time window which is audited. In the normal course of business no.
    - graypegg 3y ago
      The reality here is that no one will trust a pinky promise. Especially not from Microsoft. You’re fighting a good fight but it’s a losing battle no matter how locked down it feels from your POV. “Can we have access to X, but don’t worry, we don’t let anyone look at X unless Y happens” is a bit suspicious when “grant X permission when Y happens” isn’t an option. Even worse when the access to X is only disclosed to users living in a jurisdiction requiring it. Microsoft’s many brand and marketing folks have a big uphill battle if they want to convince me otherwise. Or they can just stop collecting data.
      - sabarn01 3y ago
        Like telemetry? We have to collect customer data that's what we get paid for. As for pinky promises we are SOC compliant and externlly audited. https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2 https://learn.microsoft.com/en-us/compliance/regulatory/offe...
        JohnFen 3y ago
        > We have to collect customer data that's what we get paid for. Which is one of the many reasons why I will not allow Microsoft products on my machines.
        sabarn01 3y ago
        If you write a document and store it in sharepoint online we have to keep that data as does any online offering.
        JohnFen 3y ago
        Is that what you were referring to? The phrase "we have to collect customer data" implies a different thing entirely, so I misunderstood. My objection to Microsoft's methods in this regard isn't the data that customers voluntarily and knowingly store on Microsoft servers, it's the collection of data about customers, their machines, and the use of their machines that happens behind the scenes.
    - WarOnPrivacy 3y ago
      > You can get access with customer permission for a limited time window which is audited. In the normal course of business no. Right but no one is saying your department is violating our privacy. I'm not sure why you feel a need to defend it. I think we can safely say that MS's methods of violating our privacy are all automated and that you + coworkers aren't eyeballing our personal data. So we can move on from that. If you'd like to speak to the privacy violations that are referenced in the article, we're all ears. Education guesses about methods or who some of the 3rd parties are would be terrific.
  - com2kid 3y ago
    > They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. That is what a support team is for. And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. This isn't some super duper secret, when shit breaks there needs to be a, well secured, escape hatch for the people who fix things to crawl in and make repairs. Prior to cloud hosting, Microsoft could get permissions to remote in to your servers, or prior to those days, send someone physically out with a laptop and a debugger.
    - JohnFen 3y ago
      > And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. But surely you can see that saying this is still the same as just saying "trust us". It's very, very hard to trust Microsoft.
      - com2kid 3y ago
        Not having those protections in place would be a company ending event for Microsoft. The legal system would crush them, and customers would leave in droves. And the number of markets Microsoft completes in now is tiny. This isn't the 90s where Microsoft competed in slews of consumer and business markets. The potential upside from the Cloud team slurping up secrets from competitors in literally ANY other business segment, is dwarfed by the losses that would hit MS. Now of course that doesn't mean some corrupt fool in sales won't risk destroying the company so he can make his yearly bonus (that very thing has brought down companies before!), but Microsoft internally has a lot of motivations to ensure that doesn't happen. So, don't trust Microsoft saying "trust us". Trust Microsoft being greedy and wanting to keep growing the cash cow that is Azure Cloud.
        JohnFen 3y ago
        I wasn't talking about Azure. I was talking about Microsoft's software products such as Outlook, Windows, etc. Rergardless, my point is that Microsoft saying that they have audits and controls in place is exactly the same as them saying "trust us". They're just saying "trust that we have effective controls in place".
  - HenryBemis 3y ago
    I use an older version of "Windows Firewall Control". Regarding Outlook, I block ALL, except the server(s) that Outlook needs to contact in order to collect emails (i.e. you may have a couple of gmail accounts, etc.) The pros: Outlook doesn't get to speak to MS The cons: When an email has linked images, they don't load, which for the past 20+ years hasn't been a problem.
  - zmaks100 3y ago
    MSFT employee here. Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions. Otherwise support portal will not allow access. And there is no other way of accessing customer data. Access is revoked after a case is closed. The incentive for customers to give this access is simple - with this my team can answer questions right away without very lengthy back and forth (especially if customer is in different time zone). Which results in (way) faster support and problem resolution.
    - wolverine876 3y ago
      What about executives and other higher-ups? If they want to know about my internal business operations - for example, if we are competitors, they are looking to invest, etc. Is there technical protection? Is it encrypted in a way that's only accessible to me?
    - WarOnPrivacy 3y ago
      > MSFT employee here. > Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions. That article notes that Microsoft says Microsoft accesses our data and make it available to 7xx 3rd parties. It is safe to assume that Microsoft has automated process to violate our privacy and not eyeballs and fingers. So you don't really need to defend Azure tech support because no one is accusing Azure tech support.
- WarOnPrivacy 3y ago
  On one hand we have: sabarn01> We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does. On the other hand we have: Microsoft> We and 7xx Third Parties access Outlook data on user devices. Taking both you and Microsoft at face value, we seem to have two fairly different assertions. Customer concerns could be allayed if their shared data was fully auditable at any time by the customer. This would include what buyers of this data can see.
  - pxeboot 3y ago
    Outlook (the app) is not the same as outlook.com (the email service) or Exchange Online (what most companies use). Data from one product/service could be used in different ways than others.
    - WarOnPrivacy 3y ago
      Of course. Microsoft has different email products and services that they skim customer data from. Fortunately, Microsoft has infrastructure so robust they can share a customer's data with 733 3rd parties. I think we can safely send one more copy to the customer (who's data it is) without overtaxing anything.
artificialLimbs 3y ago
>> blindly trust MS We were sold on (in my mid biz) Microsoft being all-the-things compliant: HIPAA, GDPR, etc.. and this is why we put all our data there. As long as they keep touting this, businesses will keep on feeding them data.
- sabarn01 3y ago
  We have to certify every O365 service for all of these. We also have to certify all of our dependencies.
borissk 3y ago
Companies that use GMail/Google Workspace also weak a ton of private employee information to Google, without giving said employees much choice.
- remus 3y ago
  I mean, I don't think that's unreasonable. You are being paid by your employer after all, and part of the deal is that you agree, to a large extent, to do things the way your employer wants. If you think it is a big issue you can of course talk to your employer about it and see if they will change, but they're also free to disagree with you.
mtlmtlmtlmtl 3y ago
Wouldn't surprise me. After all, Microsoft has always been built on a process of reimplementing/porting/integrating what others have made/invented before them, then doing a bunch of shady/clever business moves to corner the market.
snowwrestler 3y ago
Companies structure their relationships with Microsoft in detailed contracts, which specify what data Microsoft’s corporate staff can access, and why, and what the penalties are for violating the contract. These contracts are extremely lucrative and extremely detailed. Microsoft applies a business analysis to each one of them. If they determine it’s more financially beneficial to abide by the contract, they will. There is zero “blind trust” involved, on either side. Where there is trust, it has been earned. And it can be burned.
- autoexec 3y ago
  Contracts are great, and may even provide for some type of compensation or remedy if you know and you could prove that Microsoft was using the data they collect against their own customers, but good luck knowing/proving that. If Microsoft uses the data they have to come up with competing products, or to time the release of their competing products, or to decide which stocks to buy or short, or to decide which companies to partner with or avoid, or which of your employees they should try to attract, or even to sell or leak privileged information to your competitors you'd never know about any of that without a whistleblower at Microsoft saying something, and that person's income and very comfortable lifestyle depends on them keeping their mouth shut. A whistleblower may also risk legal consequences themself if they ever come forward. Risking themselves, their future, and their family is asking a lot which is why whistleblowers are extremely rare. That's part of the problem with surveillance capitalism. All the spying being done is to collect massive amounts of extremely valuable data, but very little of that data is used transparently. You simply can never know how the data being collected about you will be used against you, you can just be sure that it will be. The reason companies are investing huge amounts of resources into collecting, storing, and analyzing every single scrap of data they can get their hands on is because doing so is making them money hand over fist. I doesn't matter if it's your data, or your company's data, they'll be using it in any and every way possible if they even suspect that doing so will give them an advantage or make them more money and their gains will almost always be at your expense.
  - snowwrestler 3y ago
    Let's say Boeing is a Microsoft customer. What is Microsoft going to do, read all of Boeing's emails and then start manufacturing airliners and spacecraft? I think for most companies it would not be that hard to tell if Microsoft stole their data and set up a directly competing line of business.
jameshart 3y ago
> yet somehow the company is still such a mess https://www.reuters.com/technology/microsoft-overtakes-apple-worlds-most-valuable-company-2024-01-11/ https://www.reuters.com/technology/microsoft-overtakes-apple... Some mess.

sabarn01 3y ago

We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does.

gtvwill 3y ago
They can access your whole tenant and everything in it. Have had some pretty wild support calls where MSFT has had to crawl through a tenants data specifically the schedule system. It was ultra broken. They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. Their use of 3rd party and external tools for adjusting registry during licensing problems is wild.
- sabarn01 3y ago
  You can get access with customer permission for a limited time window which is audited. In the normal course of business no.
  - graypegg 3y ago
    The reality here is that no one will trust a pinky promise. Especially not from Microsoft. You’re fighting a good fight but it’s a losing battle no matter how locked down it feels from your POV. “Can we have access to X, but don’t worry, we don’t let anyone look at X unless Y happens” is a bit suspicious when “grant X permission when Y happens” isn’t an option. Even worse when the access to X is only disclosed to users living in a jurisdiction requiring it. Microsoft’s many brand and marketing folks have a big uphill battle if they want to convince me otherwise. Or they can just stop collecting data.
    - sabarn01 3y ago
      Like telemetry? We have to collect customer data that's what we get paid for. As for pinky promises we are SOC compliant and externlly audited. https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2 https://learn.microsoft.com/en-us/compliance/regulatory/offe...
      - JohnFen 3y ago
        > We have to collect customer data that's what we get paid for. Which is one of the many reasons why I will not allow Microsoft products on my machines.
        sabarn01 3y ago
        If you write a document and store it in sharepoint online we have to keep that data as does any online offering.
        JohnFen 3y ago
        Is that what you were referring to? The phrase "we have to collect customer data" implies a different thing entirely, so I misunderstood. My objection to Microsoft's methods in this regard isn't the data that customers voluntarily and knowingly store on Microsoft servers, it's the collection of data about customers, their machines, and the use of their machines that happens behind the scenes.
  - WarOnPrivacy 3y ago
    > You can get access with customer permission for a limited time window which is audited. In the normal course of business no. Right but no one is saying your department is violating our privacy. I'm not sure why you feel a need to defend it. I think we can safely say that MS's methods of violating our privacy are all automated and that you + coworkers aren't eyeballing our personal data. So we can move on from that. If you'd like to speak to the privacy violations that are referenced in the article, we're all ears. Education guesses about methods or who some of the 3rd parties are would be terrific.
- com2kid 3y ago
  > They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. That is what a support team is for. And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. This isn't some super duper secret, when shit breaks there needs to be a, well secured, escape hatch for the people who fix things to crawl in and make repairs. Prior to cloud hosting, Microsoft could get permissions to remote in to your servers, or prior to those days, send someone physically out with a laptop and a debugger.
  - JohnFen 3y ago
    > And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. But surely you can see that saying this is still the same as just saying "trust us". It's very, very hard to trust Microsoft.
    - com2kid 3y ago
      Not having those protections in place would be a company ending event for Microsoft. The legal system would crush them, and customers would leave in droves. And the number of markets Microsoft completes in now is tiny. This isn't the 90s where Microsoft competed in slews of consumer and business markets. The potential upside from the Cloud team slurping up secrets from competitors in literally ANY other business segment, is dwarfed by the losses that would hit MS. Now of course that doesn't mean some corrupt fool in sales won't risk destroying the company so he can make his yearly bonus (that very thing has brought down companies before!), but Microsoft internally has a lot of motivations to ensure that doesn't happen. So, don't trust Microsoft saying "trust us". Trust Microsoft being greedy and wanting to keep growing the cash cow that is Azure Cloud.
      - JohnFen 3y ago
        I wasn't talking about Azure. I was talking about Microsoft's software products such as Outlook, Windows, etc. Rergardless, my point is that Microsoft saying that they have audits and controls in place is exactly the same as them saying "trust us". They're just saying "trust that we have effective controls in place".
- HenryBemis 3y ago
  I use an older version of "Windows Firewall Control". Regarding Outlook, I block ALL, except the server(s) that Outlook needs to contact in order to collect emails (i.e. you may have a couple of gmail accounts, etc.) The pros: Outlook doesn't get to speak to MS The cons: When an email has linked images, they don't load, which for the past 20+ years hasn't been a problem.
- zmaks100 3y ago
  MSFT employee here. Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions. Otherwise support portal will not allow access. And there is no other way of accessing customer data. Access is revoked after a case is closed. The incentive for customers to give this access is simple - with this my team can answer questions right away without very lengthy back and forth (especially if customer is in different time zone). Which results in (way) faster support and problem resolution.
  - wolverine876 3y ago
    What about executives and other higher-ups? If they want to know about my internal business operations - for example, if we are competitors, they are looking to invest, etc. Is there technical protection? Is it encrypted in a way that's only accessible to me?
  - WarOnPrivacy 3y ago
    > MSFT employee here. > Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions. That article notes that Microsoft says Microsoft accesses our data and make it available to 7xx 3rd parties. It is safe to assume that Microsoft has automated process to violate our privacy and not eyeballs and fingers. So you don't really need to defend Azure tech support because no one is accusing Azure tech support.
WarOnPrivacy 3y ago
On one hand we have: sabarn01> We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does. On the other hand we have: Microsoft> We and 7xx Third Parties access Outlook data on user devices. Taking both you and Microsoft at face value, we seem to have two fairly different assertions. Customer concerns could be allayed if their shared data was fully auditable at any time by the customer. This would include what buyers of this data can see.
- pxeboot 3y ago
  Outlook (the app) is not the same as outlook.com (the email service) or Exchange Online (what most companies use). Data from one product/service could be used in different ways than others.
  - WarOnPrivacy 3y ago
    Of course. Microsoft has different email products and services that they skim customer data from. Fortunately, Microsoft has infrastructure so robust they can share a customer's data with 733 3rd parties. I think we can safely send one more copy to the customer (who's data it is) without overtaxing anything.

artificialLimbs 3y ago

>> blindly trust MS We were sold on (in my mid biz) Microsoft being all-the-things compliant: HIPAA, GDPR, etc.. and this is why we put all our data there. As long as they keep touting this, businesses will keep on feeding them data.

sabarn01 3y ago
We have to certify every O365 service for all of these. We also have to certify all of our dependencies.

borissk 3y ago

Companies that use GMail/Google Workspace also weak a ton of private employee information to Google, without giving said employees much choice.

remus 3y ago
I mean, I don't think that's unreasonable. You are being paid by your employer after all, and part of the deal is that you agree, to a large extent, to do things the way your employer wants. If you think it is a big issue you can of course talk to your employer about it and see if they will change, but they're also free to disagree with you.

mtlmtlmtlmtl 3y ago

Wouldn't surprise me. After all, Microsoft has always been built on a process of reimplementing/porting/integrating what others have made/invented before them, then doing a bunch of shady/clever business moves to corner the market.

snowwrestler 3y ago

Companies structure their relationships with Microsoft in detailed contracts, which specify what data Microsoft’s corporate staff can access, and why, and what the penalties are for violating the contract. These contracts are extremely lucrative and extremely detailed. Microsoft applies a business analysis to each one of them. If they determine it’s more financially beneficial to abide by the contract, they will. There is zero “blind trust” involved, on either side. Where there is trust, it has been earned. And it can be burned.

autoexec 3y ago
Contracts are great, and may even provide for some type of compensation or remedy if you know and you could prove that Microsoft was using the data they collect against their own customers, but good luck knowing/proving that. If Microsoft uses the data they have to come up with competing products, or to time the release of their competing products, or to decide which stocks to buy or short, or to decide which companies to partner with or avoid, or which of your employees they should try to attract, or even to sell or leak privileged information to your competitors you'd never know about any of that without a whistleblower at Microsoft saying something, and that person's income and very comfortable lifestyle depends on them keeping their mouth shut. A whistleblower may also risk legal consequences themself if they ever come forward. Risking themselves, their future, and their family is asking a lot which is why whistleblowers are extremely rare. That's part of the problem with surveillance capitalism. All the spying being done is to collect massive amounts of extremely valuable data, but very little of that data is used transparently. You simply can never know how the data being collected about you will be used against you, you can just be sure that it will be. The reason companies are investing huge amounts of resources into collecting, storing, and analyzing every single scrap of data they can get their hands on is because doing so is making them money hand over fist. I doesn't matter if it's your data, or your company's data, they'll be using it in any and every way possible if they even suspect that doing so will give them an advantage or make them more money and their gains will almost always be at your expense.
- snowwrestler 3y ago
  Let's say Boeing is a Microsoft customer. What is Microsoft going to do, read all of Boeing's emails and then start manufacturing airliners and spacecraft? I think for most companies it would not be that hard to tell if Microsoft stole their data and set up a directly competing line of business.

jameshart 3y ago

> yet somehow the company is still such a mess https://www.reuters.com/technology/microsoft-overtakes-apple-worlds-most-valuable-company-2024-01-11/ https://www.reuters.com/technology/microsoft-overtakes-apple... Some mess.