On the subject of Outlook, is this still storing credentials in the cloud rather than there being a direct connection to the server?
Here's an article discussing it:
http://exchangeserverpro.com/outlook-for-ios-and-android
Also here:
https://4sysops.com/archives/is-microsofts-outlook-app-for-ios-and-android-insecure/
"Credential storage
In the original release of the Outlook app for iOS and Android, authentications against Office 365 Exchange used basic authentication. This could mean your credentials were stored in a Microsoft–run cloud service that resided inside Amazon Web Services.
As of a
June 2015 update, Office 365 Exchange now uses OAuth in the Outlook app, removing the possibility that Office 365 credentials will be stored. The new authentication procedure uses Active Directory Authentication Library (ADAL)–based authentication. Accounts with a cloud-based username/password are directed to an Office 365 sign-in page; accounts with an Active Directory Federation Services (ADFS)–based username/password are directed to the ADFS sign-in page. Office 365 Exchange joins Outlook.com, OneDrive, Dropbox, Box, and Gmail as services that use OAuth within the Outlook app.
As of the publication of this article [Sept. 2, 2015], Yahoo, iCloud, and on-premises Exchange Server do not support OAuth. For these services, the Outlook app does store your credential in encrypted form in the Outlook cloud service. A random AES-128 key (called a device key) is generated during the first run of the app. When a user logs in to a non-OAuth service, the username, password, and device key are transmitted to the Outlook cloud service via a TLS encrypted connection. The cloud service verifies the password and then encrypts the password with the device key. The device key is then wiped from memory, never having been stored on disk. When a user checks for mail, the device key is sent to the cloud service and used to decrypt the encrypted password. After the Outlook cloud service has checked for mail, the device key is wiped from memory again.
If you’re using Office 365 Exchange, the move to OAuth in the Outlook app removes the concern about stored credentials. However, if you’re running on-premises Exchange, the storage of user credentials (even in encrypted form) is a risk that your security department will have to consider.
One additional risk in the current architecture is the use of Amazon Web Services to run the Outlook cloud service.
Microsoft has said that a “coming IT control” is the move of the cloud service from Amazon Web Services to Microsoft Azure, but the company has not offered a timeline for when the move will be made. The current iteration of the Outlook web service does meet Category A of the
Compliance Framework for Office 365, which does not include EU Model Clauses (EUMC), HIPAA Business Associate Agreement, or FedRAMP, just to name a few. I hope the move to Azure will clear up many of these current limitations."