Microsoft Outlook

Description

Sixty percent of Fortune 500 companies use Outlook as their main email platform. That figure says less about what Outlook does and more about what it has become: not something users chose, but infrastructure they inherited. For most people who work at a large organization, Outlook is where work happens — it arrived with the laptop, connects to the corporate directory and integrates with every meeting room booking system and IT policy in the building. Nobody picked it out at check-out. It selected them.

That position — dominant through entrenchment as much as preference — goes back to decisions that Microsoft made in the 1990s about how email, calendaring and the Exchange Server should relate to each other. When those choices proved commercially successful, they committed a huge amount of corporate computing to a set of dependencies that was hard to break free of. Outlook’s 400 million active users around the world, and its continued place at the center of enterprise communication in 2025, is a direct result of that architecture.

ORIGINS: EXCHANGE CLIENT SCHEDULE+

Outlook did not come about as an independent idea. It was created by the merging of two pre-existing Microsoft applications in the mid-90s. The first was the Exchange Client — the email interface that is included with Exchange Server 4.0 and 5.0, which were released in 1996 and 1997. The second was Schedule+, a calendar and time management program that was shipped with Windows 3.11 in 1992, and later with Office 95. Both existed independently; neither fully served corporate users on their own.

Microsoft Exchange Server came along in 1996 as a replacement for Microsoft Mail, which had in turn descended from Network Courier — an early LAN email package from Canadian company Consumers Software, acquired by Microsoft in 1991. The Exchange Client that was included with Exchange Server 4.0 and 5.0 supported email, but did not offer the calendar integration that businesses required. Schedule+ dealt with calendars but didn’t have tight email integration.

Outlook 97 — shipped as part of the Microsoft Office 97 in January 1997 — brought the two together. It replaced the Exchange Client as the default client for Exchange Server 5.5 and at the same time, Schedule+ was retired as a standalone product. The result was a combination of email, contacts, calendar, tasks, notes and a journal function in a single application for the first time. Contemporary reviews described the feature set as comprehensive, and the interface as cluttered. The paper clip assistant, Clippy, that animated from within the Office suite and offered unsolicited help, did not improve the experience.

The architecture for Outlook was based on the data model of the original Microsoft Mail system, the Rich Text Format from Microsoft Word, and Microsoft’s Object Linking and Embedding framework. That heritage resulted in a data format — the PST file for personal storage and the Exchange messaging objects model — that built up technical debt in every version since, resulting in compatibility requirements that limited redesigns for decades.

VERSION HISTORY and the ENTOURAGE DETour

Outlook 98 and Outlook 2000 improved the original with better performance and tighter integration with the Exchange Server. Outlook 2000 introduced the Outlook COM add-in model, which enabled third-party applications to extend the capabilities of Outlook — a feature that gave rise to an ecosystem of CRM integrations, email tracking applications, and productivity plugins that continued into the 2020s.

Microsoft’s attempt to bring Outlook to the Mac ran into hardware compatibility problems that it could not quickly resolve. The Mac version of Outlook 2001 had poor performance on Apple hardware and instead of continuing to fix it, Microsoft created a separate application called Entourage — written from scratch for macOS and included in Office for Mac 2001. Entourage managed email, calendar and contacts but had a different data model than Outlook on Windows, causing long-standing synchronization issues for people who switched between platforms.

Entourage ran through Office for Mac 2004 and 2008 before Microsoft finally worked out the underlying technical problems. Outlook for Mac returned to Office for Mac 2011, replacing Entourage and bringing platform parity back. The Mac version continued to lag the Windows version in some enterprise features — the Mac client never got the ability to sync Contact Groups from Exchange, for instance, a gap that lasted through the 2020s.

Outlook 2003 introduced the Reading Pane, which displayed previews of email without opening them, and better performance for large mailboxes. Outlook 2007 added RSS feed reading and improved search, but also added the change that is still being discussed by email developers: Microsoft switched the html rendering engine from Internet Explorer to the Microsoft Word layout engine. The change improved Outlook’s handling of formatted documents at the cost of standards-compliant rendering of email as it was written in HTML. Because CSS support in the Word rendering engine reflected the CSS standards of the mid-1990s rather than current specifications, email designers had to build their email in styles of HTML more appropriate to 1998 than 2007 — nested tables, deprecated attributes, inline styles. No later version of Outlook updated the rendering engine for Windows, and the divide between Outlook and web standards remained intact for almost two decades.

OUTLOOK.COM AND HOTMAIL Acquisition

The web-facing side of Outlook takes a separate path. Sabeer Bhatia and Jack Smith founded Hotmail in 1996 as one of the first browser-based email services, but intentionally launched on July 4th as a statement about independence from ISP-controlled email. The name embedded in the name, Hotmail, capitalized the initials, to indicate that it was web-native. Microsoft bought Hotmail in December 1997 for a reported $400 million, at which point the service had more than 8.5 million subscribers. By February 1999 it had grown to 30 million.

Microsoft ran Hotmail as a service under the MSN brand for years, renaming it Windows Live Hotmail in 2007, before returning it to just Hotmail in 2011. In June 2012, Microsoft released Outlook.com in public preview, replacing Hotmail with a redesigned Webmail service using the same branding as the desktop application. The migration was finished in May 2013. Within six months of the preview launch, Outlook.com had 60 million users. The service inherited @hotmail.com, @live.com and @msn.com addresses in addition to the new @outlook.com domain.

Hotmail’s underlying infrastructure is a mix of FreeBSD and Solaris servers at the time of acquisition. Microsoft’s project to migrate it to Windows 2000 dragged out over several years – in June 2001, Microsoft announced the migration was complete and then retracted the statement days later when it was discovered that the DNS functions were still running on FreeBSD. The entire migration to Microsoft infrastructure was completed until 2002.

OUTLOOK FOR MOBILE

Microsoft joined the mobile email market with applications for the Windows Mobile operating system across the board, but a major shift was the introduction of Outlook for iOS and Android in January 2015. The mobile app organized itself around four hubs — Mail, Calendar, Files and People — with the Files hub aggregating recent attachments and integrating with cloud storage services including Dropbox, Google Drive and OneDrive.

The mobile app caches email and other information on external servers to support search and other functionality, which led to scrutiny from security researchers in 2015 when it was discovered that the app cached credentials on servers. Microsoft responded to the concerns in later updates and explained the data handling practices.

Outlook Mobile brought together personal information management elements that were previously handled by mobile users in separate applications: email, calendar scheduling, contact management, and file access in a single interface that adapted to the smaller screen.

CURRENT FEATURES

The New Outlook for Windows, which was rolled out incrementally from 2023 to 2025, brought a rebuilt interface that replaced the classic desktop client with an architecture closer to the web version. The transition met with a great deal of user resistance — power users and IT administrators were unhappy that some features from the classic version were missing and that Microsoft was migrating some users automatically.

Email in Outlook is sorted into a Focused Inbox and an Other tab. The Focused Inbox algorithm sends messages that it determines to be important to the primary view, and lower priority mail to the secondary tab. Users can override individual decisions or disable the separation entirely. Rules and Quick Steps enable automatic processing of incoming mail — routing, flagging, forwarding or archiving based on sender, subject or other criteria. Conversation threading groups replies beneath the original message.

The calendar allows for multiple overlapping calendars, shared calendars for teams, room booking integration with Exchange, and meeting scheduling with availability checking against other user’s calendars within the same organization. Time zone display enables the viewing of multiple zones for distributed teams at the same time.

Contacts Integrate with the corporate directory when connected to Exchange or Microsoft 365. Search covers mail, contacts, calendar items and attachments from a unified query bar. Offline mode provides synchronization of a configurable window of recent mail and folder creation, message editing, and other actions without network access.

Outlook integrates with Microsoft Teams for the purpose of meeting creation, display of presence status, and the ability to share emails directly to Teams channels. Integration with OneDrive enables attachments of cloud files as links instead of copies, maintaining the one source version of shared documents. Integration with SharePoint and Microsoft 365 Groups is used to link email workflows with shared team storage.

Copilot in Outlook, available to Microsoft 365 subscribers with Copilot licensing as of 2025, adds AI-assisted capabilities throughout the email and calendar workflow. Thread Summary is used to condense long email chains into bullet point digests. Draft with Copilot creates complete email drafts from a short prompt, with tone and length controls. Coaching with suggestions on tone, clarity and reader sentiment before sending. Meeting preparation draws relevant context from emails and documents before a scheduled meeting and displays it in the calendar event view. Scheduled meeting setup users can ask Copilot in natural language to find a free time slot with a specified person and create the invite. Summarization of attached PDF, Word and PowerPoint files brings up key points without opening the attached file.

Outlook on the web offers the same basic set of features via a browser, without the need for the desktop application. It supports Exchange, Microsoft 365, Outlook.com, and — through connected accounts — Gmail, Yahoo, and iCloud. The web interface is the main client for organizations that use Exchange Online instead of on-premises Exchange Server.

SECURITY

Outlook’s ubiquity in enterprise environments has made it a regular target for serious vulnerabilities.

CVE-2023-23397, which was disclosed and patched in March 2023, had a CVSS score of 9.8. The flaw enabled an attacker to steal a user’s Net-NTLMv2 authentication hash — which can be used to impersonate the user on other systems — simply by sending a specially-crafted email. The victim did not have to do anything; the vulnerability was triggered before the recipient opened or previewed the message. Microsoft Threat Intelligence traced active exploitation by a Russia-based threat actor targeting government, transportation, energy and military organizations in Europe. CERT-UA notified Microsoft about the incidents, which patched the flaw in coordination with law enforcement. A bypass of the original fix, CVE-2023-29324, required a follow-up patch in May 2023.

CVE-2024-21413, which was disclosed in February 2024 and rated with a CVSS score of 9.8, enabled remote code execution via maliciously crafted links in email messages that used the file:// protocol. The vulnerability, dubbed MonikerLink by Check Point Research which discovered it, bypassed Outlook’s Protected View by exploiting the way the Windows COM API processed certain URL formats. Triggering it didn’t require the victim to click on anything — just to preview the email in the Reading Pane. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog in February 2025 after it confirmed active exploitation in the wild.

CVE-2024-38173, revealed in August 2024 with a CVSS score of 6.7, was a Form Injection Remote Code Execution vulnerability. Like CVE-2024-21413, it triggered without any user interaction on systems with the auto-open email feature enabled. Morphisec Threat Labs, which discovered the flaw, said it is similar in mechanism to CVE-2024-30103, which was patched in July 2024.

The pattern across these vulnerabilities is indicative of the security implications of Outlook being the standard enterprise email client. The large attack surface — hundreds of millions of installs, usually with elevated network access on corporate systems, and often connected to Active Directory — makes zero-interaction vulnerabilities in Outlook extremely valuable to attackers who are not targeting individual users but rather targeting organizations. Microsoft fixes Outlook vulnerabilities in its monthly Patch Tuesday release cycle.

PRICING

Outlook is included in Microsoft 365 Personal ($69.99/year), Microsoft 365 Family ($99.99/year), Microsoft 365 Business Basic, Business Standard, and Business Premium, and Microsoft 365 Enterprise Plans. Copilot features in Outlook require a Microsoft 365 Copilot license ($30/user/month) for commercial subscribers or use AI credits included with Microsoft 365 Personal and Family subscriptions. Outlook.com is still available for free for personal use with limited storage. Perpetual license versions of Outlook are included with Microsoft Office Home & Student, Home & Business, and Professional editions without continuous access to updates other than security patches.