Microsoft Outlook for iOS and Android: Insert signature images from OneDrive

🚨 The Signal: Outlook for iOS/Android now allows users to insert signature images directly from OneDrive. This expands data sources for signatures, potentially increasing exposure of sensitive images if not properly governed by existing data sharing policies.

The Impact

Users of Outlook for iOS and Android are affected, with a low security risk if existing data sharing policies are correctly enforced.

• End Users: Can now use OneDrive images, potentially exposing unapproved content.
• Security Team: Must verify OneDrive data sharing policies prevent sensitive image use.
• Compliance Team: Needs to ensure signature content aligns with data handling policies.

The Action

1. Review existing Microsoft Purview Data Loss Prevention (DLP) policies for OneDrive to ensure they cover image sharing in email signatures.
2. Verify Microsoft Entra Conditional Access policies for OneDrive to restrict access to sensitive image repositories on unmanaged devices.
3. Communicate to end-users about appropriate content for email signatures, reinforcing organizational data handling policies.

Impact: low · Workload: OneDrive