Outlook Add-In Data Retention Audit: 2026 Guide

By Amin Soltani, Founder of Professionally 11 min read

The core problem

What Is an Outlook Add-In Data Retention Audit?

Most M365 IT admins think their email data is secure because it sits behind Microsoft's perimeter. Here's the thing: your users are installing AI-powered Outlook add-ins that silently copy full email bodies, attachments, and recipient data to external servers. An outlook add-in data retention audit is the systematic process of mapping these hidden data flows, challenging vendor retention claims, and locking down your tenant.

This isn't just a theoretical exercise. Microsoft processes more than 400 billion emails monthly across Exchange Online. For teams in customer service, sales, and global operations, those emails contain sensitive pricing, health data, and personally identifiable information (PII). When users install third-party AI tools to rewrite their drafts or summarize long threads, that data leaves your control.

Here's why that matters:

Under the evolving regulatory landscape, you are responsible for where that data goes and how long it stays there. An audit bridges the gap between what your users are doing to save time and what your compliance team requires to avoid fines. Without a clear inventory of what is reading your mailboxes, you are flying blind into a strict new era of data governance.

The threat landscape

The Hidden Risks of AI Agent Data Copying

The push for AI productivity has created a massive blind spot in enterprise email security. Legitimate AI add-ins for translation, summarization, or tone adjustment routinely transmit full email content externally for large language model (LLM) processing. But the risk isn't just about the AI provider's privacy policy (more on that later). It is about the architectural vulnerabilities of the add-ins themselves.

Recent research exposes the gap between perceived and actual risk. In January 2026, Varonis Threat Labs demonstrated a technique dubbed "Exfil Out&Look." They found that Outlook add-ins installed via Outlook Web App (OWA) can exfiltrate sensitive email content without generating entries in Unified Audit Logs. This technique uses minimal permissions, such as ItemSend events, to silently forward complete message data to attacker-controlled or third-party servers.

Supply chain attacks are also escalating. A separate February 2026 incident involved a hijacked Outlook add-in previously listed in the official Microsoft Office Add-in Store. According to Malwarebytes, attackers compromised the hosting URL of an abandoned meeting scheduler called AgreeTo. Because Office add-ins are essentially XML manifests that load remote URLs in an iframe, the attackers deployed a phishing kit that stole over 4,000 Microsoft accounts and payment data before being removed.

While native enterprise tools like Microsoft Copilot keep data within the tenant boundary, their generic outputs often fail to capture nuanced professional tone, driving users to install these risky third-party shadow AI add-ins.

The cost of inaction

What Happens When You Ignore Add-In Data Flows?

Ignoring the data flows of third-party Outlook add-ins is no longer a defensible position for IT administrators. When you allow unvetted AI tools to operate within your tenant, you are effectively bypassing your own Data Loss Prevention (DLP) policies. These tools often extract data before it hits your outbound filters, rendering your existing security investments useless.

The financial and reputational costs are severe. Under the GDPR Omnibus framework, failing to document and limit the retention of special category data processed by AI systems can trigger immediate breach notification obligations. If a third-party AI provider suffers a breach (and your users have been silently feeding it sensitive customer data for months) your organization is liable for the exposure.

Furthermore, the operational disruption of a retroactive audit is massive. When a compliance team discovers widespread shadow AI usage during an annual review, IT is forced into a reactive scramble. This often results in blanket bans on all add-ins, frustrating users who rely on these tools for productivity and driving them to use even less secure workarounds, like pasting sensitive emails into public web-based LLMs.

Regulatory shifts

Why the 2026 GDPR Omnibus Changes the Rules

The regulatory grace period for AI experimentation is over. The EU Digital Omnibus proposal, published by the European Commission in late 2025, introduces targeted GDPR amendments designed to reduce administrative burdens while sharpening the focus on high-risk AI processing.

These changes, actively shaping audit priorities for mid-market organizations in 2026, directly impact how you manage email data.

The Omnibus proposal introduces a specific legitimate interest basis under Article 6(1)(f) for the development and operation of AI systems. However, for special category data (which frequently appears in HR, legal, and customer support emails) a new exemption pathway under Article 9(2)(k) permits processing only under strict sequential safeguards. This includes mandatory efforts to avoid collection, remove data where possible, and ring-fence it if deletion is disproportionate.

But there's a catch:

If an Outlook add-in copies an email containing health information to an external server and retains it for 30 days to train its model, you have likely violated these new safeguards. Add-ins must demonstrate explicit data retention policies, updated Data Processing Agreements (DPAs), and technical measures preventing unnecessary storage. Enforcement bodies have signaled that they will not tolerate broad interpretations that undermine fundamental privacy protections.

Common blind spots

Why Most Add-In Audits Miss the Mark

Having supported audit programs across dozens of mid-market M365 tenants, the recurring pattern is clear: IT teams review the Microsoft 365 admin center add-in inventory but stop at version numbers and publisher names. They rarely map actual data flows or challenge declared retention periods.

In our experience, audits typically fail due to a few predictable oversights:

One sales operations lead I worked with discovered their team's preferred email tone-adjustment add-in retained every rewritten message for model improvement unless explicitly configured otherwise. The default setting exposed competitive pricing discussions and customer objections to an external provider for a full month. The subsequent audit revealed 14 similar tools across departments, none of which had been subjected to centralized review.

The framework

How to Conduct an Outlook Add-In Data Retention Audit

Effective auditing requires moving beyond simple checklists to a structured, repeatable process that integrates with your existing M365 governance. Here is a practitioner-tested framework for auditing your environment.

Phase 1: Complete Inventory

Start by identifying every add-in currently active in your tenant. Use the Microsoft 365 admin center (Settings > Integrated apps > Add-ins) and the new Inventory blade introduced for the New Outlook. Export both user-installed and centrally deployed add-ins.

Supplement this UI data with PowerShell. Run the Get-OrganizationAddIn and Get-App cmdlets in Exchange Online to catch legacy or hidden deployments. Cross-reference your findings against the Microsoft 365 App Certification list, which tracks publisher attestation status for thousands of Outlook apps.

Tag each add-in by risk category: AI inference, summarization, tone adjustment, calendar intelligence, or generic productivity. AI-powered tools warrant immediate deeper scrutiny.

Phase 2: Permission and Manifest Analysis

Download the XML manifests for every add-in. Examine the requested permissions (Mailbox.Read, Mailbox.ReadWrite, ItemRead, ItemSend). Map these against the tool's declared functionality using anomaly detection principles.

Phase 3: Data Flow and Retention Mapping

For each high-risk AI add-in, document exactly what happens to the data. You need to know the exact data elements transmitted (subject, body, attachments, recipients). Identify the destination endpoints by reviewing network traces, using browser developer tools in OWA to inspect JSON payloads, or consulting vendor documentation.

Most importantly, verify the declared retention period. Are they holding data for 30 days? Is the data used for model training? (And yes, many consumer-grade tools still default to this). Ensure their DPA aligns with the new Digital Omnibus legitimate interest provisions and that data residency matches EU requirements.

Phase 4: Technical Validation and Testing

Don't just trust the documentation. Test it. Create test mailboxes containing synthetic PII, PHI, or contract data. Activate the add-in and monitor outbound traffic.

Test prompt injection vectors as well. Recent research has shown that hidden HTML instructions can manipulate AI email summarizers without user visibility, making technical validation a critical step.

Phase 5: Risk Scoring and Remediation

Score add-ins on a 1-10 scale across retention (0 days = 10, 30+ days = 2), permission alignment, audit visibility, and vendor compliance posture. Set strict policy thresholds: anything scoring below a 7 requires replacement or strict compensating controls. Prioritize the immediate removal of tools without a verifiable zero-retention architecture.

Phase 6: Continuous Controls

Implement tenant-wide policies blocking the Office Store where possible, using centralized deployment for approved tools only. This prevents users from bypassing your audit process by installing unvetted add-ins directly from the marketplace.

The solution

Integrating Zero-Retention Tools into Governance

Not all AI email tools carry identical risk. The goal of an audit isn't to ban AI. It is to replace risky, data-hoarding shadow IT with secure, purpose-built solutions. When you cut shadow AI email risks with zero-retention add-ins, you empower your users without expanding your threat surface.

Consider a customer service team handling GDPR-covered consumer complaints. An empathetic tone-adjustment add-in seemed harmless until an audit revealed it forwarded entire complaint threads to a U.S.-based provider retaining data for 28 days. Under Digital Omnibus scrutiny, this created a high-risk processing record and potential notification obligations.

Contrast this with teams using Professionally. As an Outlook-native rewriting tool available directly in desktop, web, and iOS contexts, Professionally operates with explicit zero data retention. Content is processed to fix tone, clarity, and grammar, and then immediately discarded. No data is stored, and nothing is used for model training.

For IT admins building approved add-in catalogs, this architecture significantly reduces audit scope. It allows teams to standardize shared mailbox tone and improve communication clarity while respecting the strictest interpretations of data minimization under both current rules and the evolving 2026 framework.

Non-native English speakers, a growing segment in global M365 tenants, particularly benefit from tools that enhance clarity without creating additional data copies. The pattern across teams shows that aggressive or overly casual drafts get softened, while vague requests become specific, all without introducing new compliance liabilities.

Operationalizing

How Can Resource-Constrained IT Teams Scale Audits?

Mid-market IT teams rarely have dedicated privacy engineers, meaning you have to integrate the audit framework into your existing quarterly access reviews and application governance cycles.

Leverage Microsoft Purview's audit log retention policies to monitor for anomalous add-in activity. Configure these policies to retain relevant Exchange and add-in activity for the maximum one-year default (or 10 years with appropriate licensing) for high-risk users.

The surprising part:

Technology alone won't solve this. You have to train your power users in sales, customer success, and HR on the difference between local processing and external inference. Give them a simple decision tree: "Does this tool send my full email body externally? What is their retention policy?" This simple mental check prevents the shadow adoption of consumer AI tools before they ever reach your network.

Document everything. The new Omnibus environment rewards organizations that can demonstrate proactive, risk-based decision-making rather than reactive compliance. Maintain a living add-in register with risk scores, approval dates, responsible owners, and a strict review cadence.

Next steps

Preparing for 2027 Enforcement and Beyond

The Digital Omnibus represents simplification, not deregulation. High-risk AI processing of email data will face continued scrutiny, particularly where special category data or third-party rights are involved. The incidents of 2025 and 2026 have elevated add-in governance from a nice-to-have to a core enterprise control.

IT administrators who treat this as a recurring program rather than a one-off project will be best positioned to defend their environment. Start your next audit cycle with the inventory phase this quarter. The data copied today determines the regulatory exposure you carry into tomorrow.

FAQ