Short answer: It depends on what you need today, but for most people in 2026, you should stay on Outlook Classic a little longer if you rely on COM add-ins, PST files, offline work, or strict compliance workflows, and switch to the new Outlook for Windows if you want Copilot AI, a lighter app, and tight Microsoft 365 cloud features. Microsoft is moving every user to the new Outlook by 2029, but the two apps are not equal yet, and choosing the wrong one can break add-ins, disrupt retention duties, and expose regulated data.
Microsoft officially confirmed in its Microsoft 365 roadmap that Outlook Classic will keep getting security updates through at least 2029, while the new Outlook for Windows general availability notice rolled the redesigned app to most commercial tenants. The decision touches real rules: the HIPAA Security Rule at 45 CFR 164.312, the SEC books-and-records rule 17a-4, FINRA Rule 4511, and state laws like the California Consumer Privacy Act all shape how your email client stores, syncs, and exports messages. Pick wrong and you may fail an audit, lose an add-in your business depends on, or send client data through a cloud path you did not plan for.
A recent Gartner digital workplace survey reported that 71% of knowledge workers use Outlook as their primary email client, which makes this choice one of the most consequential software decisions a U.S. business makes this year.
- 📬 When the new Outlook is the right call, and when Outlook Classic still wins
- ⚖️ How federal rules like HIPAA, SOX, SEC 17a-4, FINRA 4511, and GLBA shape your choice
- 🗺️ State privacy overlays from CCPA/CPRA, NY SHIELD, and similar laws
- 🧰 Real feature gaps: add-ins, PSTs, offline, shared mailboxes, rules, and Copilot
- 🧪 Named scenarios, mistakes to avoid, and a full do/don’t and pros/cons breakdown
What “Outlook” and “Outlook Classic” Actually Mean in 2026
The word Outlook now points to several different apps, and Microsoft uses the same brand for all of them. The new Outlook for Windows overview describes a rebuilt client based on the Outlook on the web codebase, while Outlook Classic is the traditional Win32 desktop app most businesses have used since the Office 2007 era. Knowing which version you are actually on matters because the rules, features, and risks differ.
The New Outlook for Windows
The new Outlook for Windows is a web-first app wrapped in a native Windows shell. It pulls most of its features from Outlook on the web, and it ships by default on Windows 11 devices as the replacement for the old Mail and Calendar apps, which Microsoft retired in late 2024 under the Windows Mail and Calendar deprecation notice. The app supports Microsoft 365 accounts, Outlook.com, Gmail, Yahoo, and IMAP, and it adds Copilot features like Summarize, Draft with Copilot, and Theme detection. The consequence of its web-first design is that almost every action round-trips through Microsoft’s cloud, even for third-party accounts, which creates privacy and compliance questions some firms cannot accept.
A common misconception is that the new Outlook is just a skin on top of Classic. It is not. It is a separate executable, a separate settings store, and a separate data model, which is why add-ins, rules, and PST files do not carry over cleanly.
Outlook Classic (Win32)
Outlook Classic is the desktop app installed with Microsoft 365 Apps for Enterprise, Office LTSC 2024, and the retail Office 2024 SKUs. The Microsoft 365 Apps lifecycle page confirms support through at least 2029, and Microsoft has publicly promised at least 12 months’ notice before any forced cutover. Classic uses local OST and PST files, supports COM add-ins, runs full offline, and integrates with on-premises Exchange Server deployments. The consequence of Classic’s maturity is that it carries 25 years of features, which is both its strength and the reason the new Outlook still has gaps.
A common misconception is that Classic is “going away next year.” It is not. Microsoft’s published new Outlook transition FAQ makes clear that commercial customers keep Classic until at least 2029, and enterprise agreements may extend it further.
Outlook on the Web, Mac, and Mobile
The browser app at outlook.office.com is the reference for the new Outlook and updates fastest. Outlook for Mac shares code with the new Windows client. Outlook Mobile on iOS and Android is its own app built on the old Acompli engine, covered by the Outlook for iOS and Android service description. The consequence is that “Outlook” behavior varies by device, so your retention, DLP, and sensitivity-label settings must be tested on each client your users touch.
Federal Law That Shapes Your Choice
Before the feature list, federal law narrows the field. Email is a record, and the client you choose controls how that record is created, stored, and produced.
HIPAA Security Rule
The HIPAA Security Rule at 45 CFR 164.312 requires access controls, audit logs, integrity controls, and transmission security for electronic protected health information. In plain English, if your email touches patient data, your client and server must log who reads what, encrypt data in motion, and keep records tamper-evident. The consequence of ignoring this is civil penalties up to 2.134 million dollars per violation category per year under the HHS civil money penalty schedule. A real-world example: Dr. Alvarez, a solo dermatologist in Ohio, moves her practice to the new Outlook but forgets to confirm her Gmail-routed referrals now sync through Microsoft servers, creating a new business-associate question for her cloud vendor. A common misconception is that Outlook itself is the HIPAA boundary. It is not; the server and BAA are.
SEC Rule 17a-4 and FINRA Rule 4511
Broker-dealers must preserve electronic communications in a non-rewriteable, non-erasable format under 17 CFR 240.17a-4, and FINRA Rule 4511 layers a six-year books-and-records duty on top. The consequence of a violation is fines, censure, and in severe cases deferred prosecution, as shown in the SEC’s 2022 off-channel communications sweep. Example: Priya, a compliance officer at a 40-person broker-dealer, must ensure that whichever Outlook her reps use feeds into the firm’s WORM archive. A common misconception is that cloud journaling alone satisfies 17a-4; it does not unless the archive itself is SEC-compliant.
Sarbanes-Oxley and GLBA
Public companies preserve email under SOX Section 802, which criminalizes destruction of records in a federal investigation with up to 20 years in prison. Financial institutions protect customer data under the Gramm-Leach-Bliley Safeguards Rule. The consequence of Outlook choice here is subtle: the new Outlook’s cloud-sync of third-party accounts may shift where “customer information” sits, triggering a new Safeguards Rule risk assessment.
E-Discovery Under FRCP 26 and 34
Email is discoverable under Federal Rules of Civil Procedure 26 and 34. Classic’s PST files are easy to collect with forensic tools; the new Outlook has no local PST, so you must pull from Exchange Online directly. The consequence is a different collection workflow and, sometimes, a different cost.
State Law Overlays
Every state adds its own layer, and the choice of client can change your exposure.
California CCPA and CPRA
Under the California Consumer Privacy Act and the CPRA amendments, consumers can request deletion of their personal information. The new Outlook’s cloud-first design makes honoring those requests faster because everything is already indexed server-side. The consequence of using Classic with large local PSTs is that you may miss copies during deletion, which can trigger a California Privacy Protection Agency enforcement action.
New York SHIELD Act
The New York SHIELD Act requires reasonable safeguards for private information of New York residents. Encrypted Exchange Online mailboxes, used by both Outlook versions, generally meet this bar, but local PSTs stored on unencrypted laptops do not. The consequence of a breach involving a lost laptop with a PST is a mandatory notification and potential civil penalties up to 5,000 dollars per violation.
Texas, Illinois, and Other State Regimes
Texas HB 4 (the Texas Data Privacy and Security Act) and the Illinois Personal Information Protection Act add similar duties. The consequence of mixing Classic and the new Outlook across a workforce is that your data map becomes inconsistent, and inconsistent maps fail audits.
Feature-by-Feature Reality Check
The two apps look similar but behave differently. The table below shows where each one stands as of April 28, 2026, using the current Microsoft 365 roadmap.
| Feature | New Outlook for Windows | Outlook Classic (Win32) |
|---|---|---|
| COM add-ins (e.g., legal time capture, CRM plug-ins) | Not supported; web add-ins only | Fully supported |
| PST file import/export | Import only, no local PST storage | Full read/write |
| Offline mode | Limited, cache window up to 30 days | Full, up to 24 months cache |
| Shared mailboxes | Supported, with some delegation gaps | Full delegation, send-as, folder permissions |
| Rules | Server-side only | Server and client rules |
| Public folders | Supported in 2026 for Exchange Online | Full support including on-prem Exchange |
| Copilot AI | Native integration | Partial, requires add-in |
| IMAP / Gmail / Yahoo | Supported with Microsoft cloud sync | Native IMAP without Microsoft relay |
| Group policy controls | Growing ADMX set | Mature, thousands of settings |
| S/MIME and sensitivity labels | Supported | Supported with broader cipher list |
COM Add-Ins and the Business Impact
COM add-ins are the single biggest reason firms stay on Classic. The new Outlook add-in parity page confirms only web add-ins run in the new app. That breaks legal time-entry tools, older CRM integrations, and many archiving plug-ins.
Offline Work and Travel
Sales reps on planes and lawyers in courthouses need full offline. Classic supports a 24-month cache; the new Outlook currently caps offline near 30 days. The consequence is a real productivity gap for field workers.
Copilot and AI Acceleration
If you pay for Microsoft 365 Copilot, the new Outlook has deeper hooks. Summarize long threads, Draft with Copilot, and Schedule with Copilot render best in the new app. Classic supports Copilot but with a smaller surface.
Three Scenarios With Concrete Consequences
Scenario 1: Solo CPA Choosing Between the Two
| Choice | What happens next |
|---|---|
| Maria picks the new Outlook for her solo CPA practice | She gets Copilot drafting and a simpler UI, but her QuickBooks COM add-in stops working, forcing manual invoice entry |
| Maria stays on Outlook Classic for tax season | Her add-ins keep running, she keeps full offline access on flights to clients, and she revisits the switch after April 15 |
Scenario 2: Mid-Size Law Firm With Compliance Duties
| Choice | What happens next |
|---|---|
| David rolls out the new Outlook firmwide in Q2 | The iManage and NetDocuments add-ins break for 180 lawyers, billable hours drop 8% for two weeks |
| David pilots the new Outlook with 15 users for 90 days | He identifies add-in gaps, negotiates web-add-in replacements, and schedules a phased rollout for Q4 |
Scenario 3: Broker-Dealer Under FINRA 4511
| Choice | What happens next |
|---|---|
| Priya allows reps to use either client without policy | Reps on the new Outlook unknowingly sync personal Gmail through Microsoft, creating off-channel communication risk |
| Priya locks the tenant to Classic with Smarsh journaling | All messages flow to the WORM archive, audit log stays intact, FINRA Rule 4511 duty is met |
Named Examples That Bring It to Life
Example 1: Jordan, a Freelance Designer in Austin
Jordan runs a one-person studio on Microsoft 365 Personal. He uses Gmail for client work and Outlook.com for invoices. He should pick the new Outlook because he has no add-ins, no compliance duty, and he wants Copilot to help him draft proposals. The consequence of switching is almost zero risk and a big productivity gain.
Example 2: Lin, an IT Admin at a 200-Person Manufacturer
Lin manages an on-premises Exchange 2019 server with a hybrid Microsoft 365 tenant. She should keep Outlook Classic because the new Outlook’s on-prem support is still maturing, public folders are critical, and the shop floor uses a custom COM add-in for shipping labels. The consequence of switching early would be a production outage in shipping.
Example 3: Rev. Thomas, a Church Administrator in Georgia
Rev. Thomas runs a 500-member congregation on Microsoft 365 Business Basic. He should pick the new Outlook because he needs a simple app for volunteers, shared mailboxes for office@ and prayer@, and no add-ins. The consequence is a gentler learning curve for non-technical staff.
Mistakes to Avoid
The Microsoft 365 admin center guidance and field experience make these mistakes common, and each one has a specific negative outcome.
- Skipping an add-in inventory before switching. You discover on day one that your CRM plug-in is dead, and sales stalls for a week.
- Assuming PSTs will “just work” in the new Outlook. They will not; you lose access to years of archived mail until you reopen Classic.
- Ignoring offline cache limits for field staff. Your reps on planes cannot read old mail, and deals slip.
- Forgetting that third-party accounts now sync through Microsoft. You create a new data-processing relationship that may need a DPA under GDPR Article 28 if you touch EU customers.
- Letting users pick individually without policy. You end up with two retention models and a failed audit under FINRA Rule 4511.
- Overlooking shared mailbox delegation gaps. Reception cannot send as the main inbox, and client emails bounce.
- Not testing sensitivity labels on each client. A confidential label applied in Classic may render differently in the new Outlook, leaking context in previews.
- Relying on client-side rules that vanish in the new Outlook. Your “move to project folder” rule silently stops, and important mail piles up in Inbox.
- Enabling Copilot on regulated mailboxes without review. Copilot summaries may create new records subject to 17a-4 retention.
- Assuming Classic is retired next year. It is not; you rush a rollout and break production for no reason.
Do’s and Don’ts
Each bullet below carries a short why so the reason sticks.
Do
- Do run an add-in audit because broken add-ins are the top cause of failed rollouts.
- Do pilot with 10% of users for 60 days because real workflows surface issues no lab can find.
- Do publish a written policy because consistent configuration is a compliance requirement under the FTC Safeguards Rule.
- Do back up PSTs before any switch because the new Outlook will not read them locally.
- Do train users on Copilot prompts because the biggest ROI from the new Outlook is AI fluency.
Don’t
- Don’t force a firmwide switch on day one because you will own every broken workflow at once.
- Don’t let personal Gmail sync on regulated mailboxes because you create off-channel risk under FINRA Rule 4511.
- Don’t disable client-side rules without replacements because users will miss critical alerts.
- Don’t ignore mobile clients because policies must match across devices under HIPAA 164.312.
- Don’t skip the business-associate-agreement review because cloud-sync of third-party mail can alter your BAA scope.
Pros and Cons of Each App
New Outlook for Windows
Pros
- Copilot native integration because AI drafting saves real time for knowledge workers.
- Lower memory footprint because the web-first design uses fewer system resources.
- Faster feature updates because Microsoft ships monthly to the web codebase.
- Cleaner UI for new users because it reduces training time for non-technical staff.
- Unified experience across web and desktop because parity lowers help-desk tickets.
Cons
- No COM add-in support because many business tools still depend on the old model.
- Limited offline window because field staff need months of cached mail.
- Third-party account cloud routing because it may conflict with privacy duties.
- Smaller group policy set because IT loses fine-grained control.
- Public folder and on-prem Exchange gaps because hybrid shops hit edge cases.
Outlook Classic
Pros
- Full add-in ecosystem because 25 years of COM tools still run.
- Deep offline mode because users keep working without a network.
- PST read/write because archiving, discovery, and migration workflows rely on it.
- Mature group policy because IT can lock down almost any behavior.
- Broad account and protocol support because IMAP and on-prem Exchange work natively.
Cons
- Heavier footprint because RAM use and startup time are higher.
- Slower feature cadence because updates ship less often.
- Older UI because newer hires find it less intuitive.
- Support ends by 2029 because Microsoft has published a lifecycle end.
- Copilot is partial because the new Outlook gets AI features first.
Step-by-Step: How to Decide and Switch Safely
The Microsoft deployment guide for the new Outlook lays out the official path, and these steps translate it into action.
Step 1: Inventory Your Environment
List every add-in, PST, shared mailbox, public folder, and third-party account across your users. The consequence of skipping this is an invisible dependency that breaks post-switch.
Step 2: Map Compliance Duties
Match each mailbox to its legal regime: HIPAA, SOX, 17a-4, FINRA 4511, GLBA, CCPA, SHIELD, or consumer-only. The consequence of a mismatch is an enforcement action later.
Step 3: Pilot With Representative Users
Pick 10% of users covering every role. Run 60 days. Capture every issue. The consequence of a too-narrow pilot is a rollout surprise.
Step 4: Remediate Add-Ins and Rules
Replace COM add-ins with web add-ins where possible. Convert client-side rules to server rules. The consequence of skipping is silent workflow breakage.
Step 5: Schedule the Cutover
Use the Microsoft 365 Apps admin center to flip the toggle, and keep Classic installed as a fallback for at least 90 days. The consequence of ripping out Classic is no rollback path.
Step 6: Monitor and Iterate
Watch help-desk tickets, Copilot usage, and retention metrics. Adjust policy monthly. The consequence of set-and-forget is drift that fails your next audit.
Key Entities to Know
- Microsoft 365 Apps for Enterprise, the licensing vehicle for Classic, governed by the Microsoft Product Terms.
- Exchange Online, the cloud mailbox service, described in the Exchange Online service description.
- Microsoft Purview, the compliance stack for retention, DLP, and eDiscovery, documented in the Microsoft Purview overview.
- SEC and FINRA, the securities regulators enforcing 17a-4 and 4511.
- HHS Office for Civil Rights, the HIPAA enforcer, under the HHS OCR enforcement page.
- FTC, enforcing the Safeguards Rule and state-parallel consumer protection duties.
- State attorneys general, primary enforcers for CCPA, SHIELD, and similar laws.
Relevant Rulings and Enforcement Recap
The SEC’s off-channel communications sweep produced more than 2 billion dollars in penalties across banks and broker-dealers, a clear warning that your choice of email client and archive feeds direct regulatory risk. In Zubulake v. UBS Warburg, the court set the baseline for email preservation duties that still shape e-discovery today, and the Sedona Conference Principles translate those duties into practice. The HHS OCR settlement log shows repeated seven-figure fines for lost laptops holding PSTs, reinforcing that client choice and encryption discipline go together.
FAQs
Is Outlook Classic being discontinued in 2026?
No. Microsoft’s published lifecycle keeps Outlook Classic supported with security updates through at least 2029, and commercial customers get at least 12 months’ notice before any forced cutover.
Can I run both Outlook Classic and the new Outlook at the same time?
Yes. Both apps install side by side on Windows 10 and Windows 11, share the same Microsoft 365 mailbox, and let you toggle between them while you evaluate features and add-in compatibility.
Will my COM add-ins work in the new Outlook?
No. The new Outlook supports only web add-ins built on the Office JavaScript API, so COM plug-ins for CRM, legal time entry, or older archiving tools will not load and must be replaced.
Does the new Outlook support PST files?
No. You can import from a PST once, but you cannot open, edit, or archive to a local PST continuously, which matters for discovery, migration, and long-term archiving workflows.
Is the new Outlook HIPAA compliant?
Yes. When used with a Microsoft 365 tenant covered by a signed business associate agreement, the new Outlook can meet HIPAA Security Rule duties, though you still must configure access, audit, and transmission controls correctly.
Does the new Outlook route my Gmail through Microsoft servers?
Yes. Third-party accounts like Gmail, Yahoo, and IMAP sync through Microsoft cloud services, which may change your data-processing footprint and trigger new privacy or BAA reviews.
Can I use the new Outlook offline on a plane?
Yes. Offline mode works, but the cache window is shorter than Classic’s, typically around 30 days, so frequent travelers with long mail histories often prefer Classic.
Is Outlook Classic better for compliance than the new Outlook?
Yes. Today, Classic offers deeper group policy, broader add-in support for compliance tools, and PST workflows that match established e-discovery and 17a-4 archiving processes.
Do I need Microsoft 365 Copilot to use the new Outlook?
No. Copilot is an add-on license, but the new Outlook runs without it; you simply lose the AI drafting, summarization, and scheduling features that many users choose the new app for.
Will switching to the new Outlook break my email rules?
Yes. Client-side rules do not carry over because the new Outlook runs only server-side rules, so you must audit, convert, or rebuild every rule before switching to avoid missed messages.
Does the new Outlook support shared mailboxes and delegation?
Yes. Shared mailboxes, send-as, and delegation work, though a few advanced delegation scenarios still match Classic’s feature set more completely, so test your specific workflow first.
Is the new Outlook available on macOS?
Yes. Outlook for Mac shares the same codebase as the new Outlook for Windows, so Mac users already have a preview of what Windows users are migrating toward.