They must have some intense data retention policies. You can configure compliance levels to allow anyone into their Outlook acct using the app without any special permissions pretty easily.

Good on them to cut down access like that