# What information is collected because of signing into Windows 10 with a Microsoft account?

The question is specifically as stated - "because of signing into Windows 10 with a Microsoft account". Not including what is collected even when using a local account. And not including what is collected by using apps that are available only to Microsoft accounts.

In other words, what privacy is lost by switching from using a local account to using a Microsoft account, when continuing to use the same programs that have been used before the switch?

• I assume that you mean collected and sent to Microsoft. Correct? – Neil Smithline May 15 '16 at 23:56
• @NeilSmithline Yes. – ispiro May 16 '16 at 10:00
• Basically this means that Microsoft can correlate your cross device activity with your historic activity on the device. – AstroDan Jun 9 '16 at 20:52
• .. and also identify and link you with corporate and other identities. So your github identities, Azure identities, and your work identities might be recognised as de facto aliases (nobody here should be on FB?). On the bright side it lets me "decorate" unactivated instances of Windows 10. – mckenzm Jul 22 '19 at 0:02

This question bothers a lot of our customers. There are three major effects switching from a local-only account to a Microsoft account:

# Identification

Microsoft will be able to identify the users from within different applications, websites and services. Even if they are using other hardware after a successful login (e.g. mobile phones or your friends computer).

This identification might lead to a advanced profiling which may cause highly personalized ads. The same effect can be observed on other OS ecosystems with advanced cloud technologies like Apple iOS and Google Android.

# Synchronisation

Microsoft is using Windows 10, Office 2016 and other products of the current line-up to push their cloud services. In case of Windows 10 this includes synchronization of settings between devices (e.g. theme, browser settings).

This might also include passwords (browser, WiFi) which would increase the risk of breaches. However, Microsoft is using transport encryption and I assume they are also using some kind of encryption for the stored data. This would limit the risk of an incident. But still: Your sensitive data is leaving your local storage which increases the attack surface.

The same goes for OneDrive which is used to sync files between devices (like Dropbox). You are able to define OneDrive as your main storage which causes additional security-related and in some cases even legal-related implications. Under some circumstances and in some sectors this might not be allowed. This is one of the problems Swiss financial institutes are facing with Windows 10.

Some features and services require a Microsoft login to be used. This might include the Windows Apps Store and Cortana. Using these services might introduce additional risks of profiling (Personal Ads), data leakage (Cortana phones home) and further exploit vectors. But this is nothing new and also part of every other OS and online service. I don't have good example (yet?) where an exploitation of Windows 10 was only possible because of a Microsoft login.

I think the point here is not which kind of data is collected because it is more or less stated here: http://windows.microsoft.com/en-gb/windows/preview-privacy-statement or on any other privacy statement you accept when installing, instead the interesting fact is that the mentioned data is going to be correlated to your account.

Just think of what kind of information you may put in your account like age, sex, geolocation. This additional information will surely provide a more valuable kind of correlated information (to sell or to use).

Eg.

Data from Cortana - Searches:

• Car deal
• Car 2010 deal 5000$• Car 2010 5000$ budget 1.4l

and now just add some spices:

Account dude75@hotmail.com

• Age 41
• Sex Male
• Geo NYC

and the outcome could be:

On Bing when he's logged in show car dealers ads of NYC.

Hope this helps