What this check looks at
Checks the role assignment policies for the roles that let people install Outlook add-ins themselves (My Custom Apps, My Marketplace Apps, My ReadWriteMailbox Apps).
Outlook add-ins run inside Outlook and can read, and with some permissions change, the message or calendar item the user has open. Who can install them is set by roles in the role assignment policies Exchange Online gives every mailbox: My Custom Apps (install add-ins from a file or URL), My Marketplace Apps (install from the Office Store) and My ReadWriteMailbox Apps (install add-ins that ask for read/write mailbox access). The Default Role Assignment Policy grants all three, so anyone can install add-ins.
The check reads every role assignment policy and fails when any includes one or more of those three roles, naming the policies. It passes when none does, so add-ins can only be deployed by administrators.
Malicious and over-permissive add-ins are a quiet way to read mail: an add-in installed from a link in a phishing email, or a free productivity tool that sends message contents to its own servers. Each runs with the user’s access every time they open a message, long after the moment they clicked Install.
Why it matters
An Outlook add-in can read every message the person opens. Letting people install their own means add-ins nobody vetted can read the organisation’s mail; administrators can still deploy the ones that are needed.
A sales team installs a free email tracking add-in from the store. It asks for read/write mailbox access, nobody reviews its privacy terms, and every message the team opens is processed by a company the client has no contract with. When a customer asks where their personal data went, the honest answer is that nobody knows.
Under UK GDPR that is a third party processing personal data without a contract or due diligence. Removing self-install costs most people nothing; administrators can still deploy the add-ins the business has approved, centrally, to the people who need them.
CIS Microsoft 365 Foundations Benchmark 6.3.1 asks that users cannot install Outlook add-ins. CIS Controls v8 2.5 (allowlist authorised software), ISO 27001 A.8.9 and A.5.19 (supplier relationships), NIST CSF 2.0 PR.PS-02 and NCSC CAF A4.a and B4.b cover controlling the software and suppliers that touch the organisation’s data.
How to fix it
Where: Exchange admin centre → Roles → User roles
Before you start
- List the add-ins people use (Integrated apps) and deploy the needed ones centrally before removing the self-install roles.
Step by step
- Find the add-ins people rely on. In the Microsoft 365 admin centre, go to Settings > Integrated apps to see centrally deployed add-ins, and ask the client which add-ins people use (CRM, e-signature, meeting tools). Plan to deploy the approved ones centrally before removing self-install.
- Deploy the approved add-ins centrally. In Settings > Integrated apps select Get apps (or Upload custom apps for a line-of-business add-in), choose the add-in, assign it to the users or groups who need it and finish the deployment. Add-ins deployed this way keep working after the roles are removed.
- Remove the roles in the Exchange admin centre. In the Exchange admin centre (admin.exchange.microsoft.com), go to Roles > User roles and select Default Role Assignment Policy. Select Manage permissions, untick My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps and save. Repeat for every other policy named in the evidence.
- Or remove them in PowerShell. Connect with Connect-ExchangeOnline and run, for each policy: Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -in "My Custom Apps","My Marketplace Apps","My ReadWriteMailbox Apps" } | Remove-ManagementRoleAssignment -Confirm:$false.
- Tell users how to ask for an add-in. Let people know they can no longer add add-ins in Outlook themselves, and how to ask IT for one, so each request gets a short review of the vendor and the permissions it wants.
- Confirm the roles are gone. Run Get-RoleAssignmentPolicy | Format-List Name, AssignedRoles and check none lists My Custom Apps, My Marketplace Apps or My ReadWriteMailbox Apps. The next assessment passes.
What users will notice
People can no longer install Outlook add-ins themselves; add-ins deployed by IT keep working.
How to confirm it worked
Get-RoleAssignmentPolicy | Select-Object Name, AssignedRoles shows none of My Custom Apps, My Marketplace Apps or My ReadWriteMailbox Apps.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB4.b Secure configuration |
| DSPT | Standard 10: Accountable suppliers |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| NIST SP 800-171 | 3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | CM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.8.9 Configuration managementA.5.19 Information security in supplier relationships |
| CIS M365 | 6.3.1 Ensure users installing Outlook add-ins is not allowed |
| CIS Controls v8.1 | 2.5 Allowlist authorized software (IG2) |
| NIST CSF 2.0 | PR.PS-02: Software is maintained, replaced, and removed commensurate with risk |
| NCSC 10 Steps | Architecture and configurationSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Specify the administrators and users who can install and manage add-ins for Outlook (Microsoft Learn)