Skip to main content
Version: 2.1.0

MT.1041 - Ensure users installing Outlook add-ins is not allowed

Overview​

Users SHOULD NOT be allowed to install Outlook add-ins

Rationale: When users can install their own Outlook add-ins, it creates security risks. Malicious add-ins could access email content, exploit vulnerabilities, or facilitate data exfiltration through legitimate-looking add-ins.

Remediation action:​

  1. Connect to Exchange Online:
Connect-ExchangeOnline
  1. Get the current role assignment policy:
Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault }
  1. Check which app-related roles are assigned:
Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }
  1. Remove the app installation permissions from the default policy:
Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } | Remove-ManagementRoleAssignment -Confirm:$false
  1. Verify the changes:
Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }

The result should return no assignments.

Test Metadata​

FieldValue
Test IDMT.1041
SeverityHigh
SuiteMaester
CategoryExchange
PowerShell testTest-MtExoOutlookAddin
TagsExchange, Maester, MT.1041

Source​

  • Pester test: tests/Maester/Exchange/Test-ExchangeSetting.Tests.ps1
  • PowerShell source: powershell/public/maester/exchange/Test-MtExoOutlookAddin.ps1