Preventing Installation of Outlook Add-ins [CHK-1064]

Rationale

Attackers can exploit vulnerable or custom-made add-ins to gain access to user data. Regulating the ability to install add-ins limits this attack surface.

Fix

An automated fix is not available. To fix it yourself:

1. Go to the Exchange Admin Center at https://admin.exchange.microsoft.com
2. Expand 'Roles'
3. Select 'User roles'
4. Double-click on 'Default Role Assignment Policy' to open it
5. Click on 'Manage Permissions'
6. Turn the following options OFF:
   • My Custom Apps
   • My Marketplace Apps
   • My ReadWriteMailboxApps
7. Click on 'Save'

Impact

Users will no longer be able to install 3rd party add-ins they wish to use. Administrators will start receiving requests to allow necessary 3rd party add-ins.

More Information

For more information, visit the following links:

• Specify who can install and manage add-ins
• Role assignment policies