Regarding TLS SMTP communications: there is an issue with downgrade attacks. Basically, you can't trust the protocol to be 100% encrypted, so you need to encrypt the email's content yourself.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM. PRISM was a US government program to snoop on US citizens' communications (even the 100% domestic content) merely because they were transfered between Microsoft's and other major internet companies' internal servers that just happened to be hosted across continents.

I don't think you'll get an authoritative answer on this topic.

That said, there was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.

Nearly three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)

Regarding TLS SMTP communications: there is an issue with downgrade attacks.
Basically, you can't trust email transactions to be 100% encrypted.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM, a US government program to snoop on communications (even between US citizens within the US!) by taking advantage of the fact that Microsoft and other major internet companies would sync data between backend servers on unencrypted network connections across continents.

There was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.

Being three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)

Regarding TLS SMTP communications: there is an issue with downgrade attacks. Basically, you can't trust the protocol to be 100% encrypted, so you need to encrypt the email's content yourself.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 group to another) given Edward Snowden's 2013 revelation of PRISM. PRISM was a US government program to snoop on US citizens' communications (even the 100% domestic content) merely because they were transfered between Microsoft's and other major internet companies' internal servers that just happened to be hosted across continents.

I don't think you'll get an authoritative answer on this topic.

That said, there was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as pretty much everybody else!) scrambled to fix this as soon as they could.

Nearly three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)

Regarding TLS SMTP communications: there is an issue with downgrade attacks. Basically, you can't trust the protocol to be 100% encrypted, so you need to encrypt the email's content yourself.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM. PRISM was a US government program to snoop on US citizens' communications (even the 100% domestic content) merely because they were transfered between Microsoft's and other major internet companies' internal servers that just happened to be hosted across continents.

I don't think you'll get an authoritative answer on this topic.

That said, there was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.

Nearly three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)