Microsoft Office 365 Education is a collection of online services that allows students to collaborate and share their schoolwork. Students and educators are eligible for Office 365 Education for free, which includes Outlook, Word, Excel, PowerPoint, OneNote, Publisher, and Access. In addition, Office 365 Education includes classroom tools such as Exchange, OneDrive, SharePoint, Skype for Business, Teams, Sway, Forms, Stream, Flow, PowerApps, School Data Sync, and Bookings.

Microsoft's terms state children can access communication services, like Outlook and Skype, and can freely communicate and share data with other users of all ages. When users are signed in, some products may display a user's name or username and their profile photo as part of their use of Microsoft products, including in a user's communications, social interactions, and public posts. Microsoft's terms state they provide a privacy dashboard that allows users to control some of the data Microsoft processes through their use of a Microsoft account on the Microsoft privacy dashboard. From here, the terms state users can view and clear their browsing, search, and location data associated with their Microsoft account. Microsoft's terms state they are committed to protecting the security of its users' personal data. Microsoft uses a variety of security technologies and procedures to help protect users' personal data from unauthorized access, use, or disclosure. If a user uses a Microsoft product provided by an school or district they are affiliated with, or use an email address provided by a school or district to access Microsoft products, Microsoft may share certain data, such as interaction data and diagnostic data to enable a school or district to manage the products.

Microsoft Office 365 Education can be accessed through its website, and is available for download at their iOS App Store Homepage, and their Google Play Store Homepage. The Privacy Statement and Terms of Use used for this evaluation can be found on Microsoft Office 365 Education’s website. This evaluation is intended to provide key information about Microsoft Office 365 collection and use of data for for Education users. Where there are terms that differ, as with the limitations on advertising in Office 365 for Education take precedence, followed by Microsoft's Privacy Statement.

Additionally, other relevant policies used for this evaluation include:

• Privacy Principles
• Microsoft Services Agreement
• Data Collection Summary

Safety

Microsoft's terms state children can access communication services, like Outlook and Skype, and can freely communicate and share data with other users of all ages. When users are signed in, some products may display a user's name or username and their profile photo as part of their use of Microsoft products, including in a user's communications, social interactions, and public posts. The terms state that when a user creates a personal Microsoft account, they will be asked to provide certain personal data and they will assign a unique ID number to identify a user's account and associated information. While some products, such as those involving payment, require a real name, the terms state users can sign in and use other Microsoft products without providing their real name. Some data a user provides, such as their display name, email address, and phone number, can be used to help others find and connect with that user within Microsoft products.

In addition, the terms state that users should be aware that when they share their content with other people, it may become publicly visible to others. Microsoft's terms state they also provide parental tools called Family Features, which allow parents and kids to build trust based on a shared understanding of what behaviors, websites, apps, games, physical locations, and spending is right in their family. Parents can create a family account by going to https://account.microsoft.com/family and inviting their kids or other parents to join.

Privacy

Microsoft's terms state they provide a privacy dashboard that allows users to control some of the data Microsoft processes through their use of a Microsoft account on the Microsoft privacy dashboard. From here, the terms state users can view and clear their browsing, search, and location data associated with their Microsoft account. The terms state many of Microsoft’s products require some personal data to provide users with its services. The data Microsoft services can collect include: first and last name, email address, postal address, phone number, password credentials, and data about users such as their age, gender, country, and preferred language.

In addition, the terms state Microsoft also obtains data about users from third parties, such as data brokers from which Microsoft purchases demographic data to supplement the data they collect, and from services that make user-generated content from their service available to others, such as local business reviews or public social media posts. In carrying out these purposes, the terms state Microsoft combines data they collect from different contexts (for example, from a user's use of two Microsoft products) or obtain from third parties to give users a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes.

The terms say a user's data is not sold to third parties, and the terms say that personal information will be used or otherwise processed only to provide users the services including purposes compatible with providing those services. Also, Microsoft's Online Service Terms state they will not use or otherwise process personal information or derive information from it for any advertising or similar commercial purposes. However, parents and teachers should be aware that the Microsoft's privacy policy states they may use personal information for marketing and advertising purposes for other Microsoft products.

Security

Microsoft's terms state they are committed to protecting the security of its users' personal data. Microsoft uses a variety of security technologies and procedures to help protect users' personal data from unauthorized access, use, or disclosure. For example, the terms state Microsoft stores the personal data users provide on computer systems that have limited access and are in controlled facilities and protect the data users entrust to Microsoft through strong security and encryption. In addition, the terms state security is central to compliance with FERPA, which requires the protection of student information from unauthorized disclosures. The terms state educational institutions that use cloud computing should have contractual reassurances from a technology vendor like Microsoft that they will manage sensitive student data appropriately.

In addition, the terms state Microsoft uses data to protect the safety of their products and their customers. Microsoft's security features and products can disrupt the operation of malicious software and notify users if malicious software is found on their devices. The terms also state Microsoft uses data they collect to develop product updates and security patches. For example, the terms state Microsoft may use information about a user's device’s capabilities, such as available memory, to provide users with a software update or security patch. The terms also state updates and patches are intended to maximize users' experience with Microsoft's products, help users' protect the privacy and security of their data, provide new features, and ensure a user's device is ready to process updates. Lastly, the terms state Microsoft complies with data protection laws, including providing security breach notification to users.

Compliance

If a user uses a Microsoft product provided by an school or district they are affiliated with, or use an email address provided by a school or district to access Microsoft products, Microsoft may share certain data, such as interaction data and diagnostic data to enable a school or district to manage the products. The data associated with a school account, and how it will be used, is generally similar to the use and collection of data associated with a personal Microsoft account. If a school uses Azure Active Directory (AAD) to manage the account it provides to users, then a user can use their school account to sign in to Microsoft products, such as Office 365, and third-party products. If required by a school or district, users may also be asked to provide a phone number or an alternative email address for additional security verification.

In its terms, Microsoft agrees to obtain parental consent before collecting or disclosing personal information from minors. In addition, Microsoft states it may be designated as a “school official” with “legitimate educational interests” in student data as defined under FERPA. Microsoft also commits to using student data only to provide schools and districts with its cloud services and compatible purposes (such as improving malware detection), and does not mine student data for advertising. Lastly, the terms state Microsoft contractually commits not to disclose student data except as the educational institution directs, or as described in a school or district contract. Furthermore, the terms state schools that provide education records to Microsoft through their use of a Microsoft cloud service can be assured that those records are subject to stringent contractual restrictions regarding their use and disclosure.