Does modification of the 'Report Message' button function negatively impact our organisations security?

Question

We are looking to change the settings on the Outlook 'Report Message' button to enable staff to report suspicious emails.

Modification of the ‘Report Message’ button in Outlook for staff to report Phishing to an internal group email address requires implementation of an ‘integrated app’ which is fine but, the T&Cs state that ‘ This add-in can read or modify the contents of any item in your mailbox, and create new items. It can access personal information -- such as the body, subject, sender, recipients, or attachments -- in any message or calendar item. It may send this data to a third-party service’; which I am not comfortable with. Can please detail exactly what this means and whether that third-party is just Microsoft, or will all our data be accessible by some random third party (which we would be very concerned about).

Answer 1

Dear Robert Oakley, Thank you for sharing your concerns regarding the proposed modification to the "Report Message" button in Outlook. We understand the importance of securing our organization's information and would like to provide clarification on the points you raised. The modification aims to enable the team to report suspicious emails, a measure that enhances the organization's cybersecurity. However, we acknowledge that the Terms and Conditions (T&Cs) have raised specific concerns. The statement in the T&Cs about the add-in having the ability to read or modify mailbox content and access personal information is standard for integrated applications. Nevertheless, we can assure you that the mentioned third party is Microsoft, and the data will be shared securely and restricted to specific purposes, such as reporting phishing. We understand the significance of data security and are committed to ensuring that our organization's information is handled with the utmost confidentiality. If you need further details or have additional questions, please feel free to reach out.