Unapproved Outlook Add-Ins can pose a security risk to organizations. Some add-ins can ask for more permissions to a user’s mailbox than an organization prefers and depending on the add-in’s privacy policy, there might not be much control over what the developer does with that data. There are a few ways you can disable Outlook Add-Ins on Office 365 Exchange and prevent a user from installing unapproved Outlook add-ins.
Change the Default User Role Assignment Policy
This is typically the best option to block users from installing Outlook Add-Ins.
- Log into your Exchange Admin Center (classic)
- Go to Permissions > User-Roles
- Edit the Default Role Assignment Policy
- Under Other Roles, Uncheck My ReadWriteMailbox Apps – This role will allow users to install apps with ReadWriteMailbox permissions
- Click Save
Options in O365 Admin Portal
This option blocks access to a website that contains Outlook Add-Ins. It does NOT disable the Get Add-Ins button in Outlook or block access to Get Add-Ins in OWA Outlook.
- Log into your Office 365 Admin Portal
- Click Settings
- Go to Services & Add-Ins
- Go to User Owned Apps and Services
- Uncheck Let Users Access The Office Store
- Uncheck Let Users Install Trial Apps and Services
- Click Save Changes
Disable App Registrations in Azure AD
Changing this setting could affect other Azure applications, so use with caution. With this setting set to No, users will see “Access is denied. Please contact your administrator.”
- Log into your Azure Portal
- Go to Azure Active Directory > User Settings
- Set App Registration to No
- Save changes
Use Group Policy to Hide Get Add-Ins Button
- Create a new Group Policy and go to User Configuration > Preferences > Windows Settings
- In the Registry, right-click and select New
- Set Action to Update
- Set Hive to HKEY_CURRENT_USER
- Set Key Path to Software\Microsoft\Office\16.0\Outlook\Options (the 16.0 version might be different based on your version of Outlook)
- Set Value Name to StoreButtonInRibbonHomeTabAllowed
- Set Value Type to REG_DWORD
- Set Value Data to 0
