Just last year Microsoft was fined for illegally collecting children's personal data. Microsoft has also broken the law to sell software in violation of US sanctions. They've illegally bribed government officials. They've committed a number of anti-trust violations. In these cases breaking the law was probably still worth it for them even after the fines they were forced to pay and other slaps on the wrist they received. We have no idea how many other laws they've been breaking without being caught.
For a company willing to break laws in the US and around the globe, violating a contract with Boeing is nothing, especially when the risk that Microsoft would be discovered taking advantage of the data Boeing gave them is basically zero.
You could even argue that Microsoft owes it to their shareholders to exploit every possible advantage they have at their disposal to maximize profits, laws and contracts be damned. That seems to be the position many corporations take at least, and even the companies that have been caught committing the worst kinds of acts like Purdue Pharma, DuPont, or Philip Morris still exist today and seem to have no problems with sustainability. MS could even use the data they collect to help ensure that they maintain their relationship with Boeing for as long as it benefits them to.
Given that I understand all the bad things that a business can do, how do I structure a relationship with a service provider such that I get the benefit of their service, and avoid the bad stuff? What tools can I use to ensure our interests remain aligned?
You’re writing like it’s not possible to do that. Even though we live in a highly specialized society that is chock full of examples.
A large enterprise may have the resources (time and money for corporate counsel) AND leverage (# licenses needed across many products) to negotiate privacy terms that align with their needs, or even pick another product.
A smaller firm is effectively stuck: they don’t have the resources or leverage, and sometimes must use the same products as large enterprises to do business with them.
In the case of Outlook specifically, if you do business with enterprises that use it, your meeting calendaring needs to work flawlessly with theirs. A missed or broken reschedule or repeating event can mean your teams sometimes don’t show up when expected. This really happens.
Has any business really succeeded in keeping business information confidential while outsourcing operation of that information? It seems like at a minimum you'd need a PCI-DSS/HIPAA-style audit regime, which I haven't seen the likes of MS granting access for (why would they?); even then those schemes aren't great at protecting confidentiality. Core business trade secrets get leaked all the time; the idea that a company would manage to protect stuff that's proprietary but peripheral, like how they use their workflow tools, seems like wishful thinking.
They controlled the upgrades, and Microsoft for a long time couldn't even count how many copies of office, etc were being used because the software didn't phone home. That software is probably still running until it's updated to have telemetry added.