[vladvasiliu]

> When combined with the rate limiting on 365 email api and ultimately removing imap access this seems like a strategic goal to capture our data.

While I agree with your other points, I'm not sure how this one works. If you're using Office365, you're already having your mail at least go through their servers. What difference does IMAP make to their snooping intentions?

[tremon]

This attack targets people's personal accounts. Many people have Office 365 because their work requires it, so they have to use the Outlook app for that. So if those people then choose to add their personal account to the same mail client, Microsoft can also snoop on the private correspondence of their captive corporate audience.