What this check looks at
Checks whether people can get add-ins from the Office Store and start trials of apps and services on behalf of the organisation.
Two switches under User owned apps and services in the Microsoft 365 admin centre decide whether people can install add-ins for Word, Excel, PowerPoint and Outlook from the Office Store themselves, and whether they can start trials of Microsoft apps and services on behalf of the organisation. Both are on by default.
The check fails when either is allowed, and says which; it passes when people can do neither.
An Office add-in runs inside the document or mailbox it is opened with, can read and change its content, and often sends that content to the vendor’s own service. When anyone can install any add-in, data flows to services nobody has assessed. Trials bring in new services the same way, often with company data in them, and sometimes turn into paid subscriptions nobody tracks.
Why it matters
Store add-ins can read the documents and mail they are opened with, and trials bring in services nobody approved or pays attention to. Both widen what can reach company data without IT knowing.
A member of staff installs a free email-signature or PDF add-in that sends every message it touches to a server abroad. The firm has handed client personal data to an unknown processor with no contract and no record, both of which UK GDPR requires, and may only find out when that vendor is breached.
Trials have a cost of their own: a trial started by a user adds a service to the tenant that someone must later find, assess, and either cancel or pay for. Deploying the add-ins people need centrally, through Integrated apps, keeps the benefit while giving each add-in an owner and a record.
The CIS Microsoft 365 Foundations Benchmark (1.3.4) asks for user-owned apps and services to be restricted, and Cyber Essentials asks organisations to remove or disable software they do not need. The rule maps to NIST CSF 2.0 PR.PS-02.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → User owned apps and services
Before you start
- List the add-ins people use today (Integrated apps shows those deployed centrally) and deploy any that are needed from Integrated apps first.
Step by step
- List the add-ins people use. In the Microsoft 365 admin centre, go to Settings > Integrated apps to see the add-ins already deployed centrally. Ask the client which other add-ins staff rely on, such as a CRM or e-signature add-in for Outlook.
- Deploy the add-ins that are needed. In Settings > Integrated apps, select Get apps, find each approved add-in and deploy it to the users or groups who need it. Add-ins deployed this way keep working after the store is closed.
- Turn off the store and trials. Go to Settings > Org settings > Services > User owned apps and services. Untick Let users access the Office Store, untick the option that lets users start trials on behalf of your organisation, and select Save.
- Tell staff. Let staff know they can no longer install store add-ins or start trials themselves, and how to ask IT for an add-in they need.
- Confirm. Reopen User owned apps and services and check both options are unticked. In Outlook on the web, the add-ins page should offer only centrally deployed add-ins. Re-run the assessment to confirm.
What users will notice
People can no longer install add-ins from the Office Store or start trials themselves; add-ins deployed by IT keep working.
How to confirm it worked
Microsoft 365 admin centre, Org settings, User owned apps and services: both options are unticked.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB4.b Secure configuration |
| DSPT | Standard 10: Accountable suppliers |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| NIST SP 800-171 | 3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | CM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.8.9 Configuration managementA.5.19 Information security in supplier relationships |
| CIS M365 | 1.3.4 Ensure 'User owned apps and services' is restricted |
| CIS Controls v8.1 | 2.5 Allowlist authorized software (IG2) |
| NIST CSF 2.0 | PR.PS-02: Software is maintained, replaced, and removed commensurate with risk |
| NCSC 10 Steps | Architecture and configurationSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage add-ins in the Microsoft 365 admin centre (Microsoft Learn)