Blok/Allow add-ins for Outlook

Question

Good morning all!

I need to be able to block or filter applications that can be installed in Outlook within our organization.

While we can block/enable integrated applications, we are currently unable to block applications that are ONLY for Outlook. I created a new user role (https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/specify-who-can-install-and-manage-add-ins), removing the My ReadWriteMailbox Apps, My Custom Apps, My Marketplace Apps permissions, but I am still able to install applications from Outlook.

The role is correctly configured and applied to my user.

My user does not have any administrative roles.

We have already waited over a week for synchronization.

Has anyone been able to configure this limitation? Am I missing any settings?

Thanks in advance!

Answer 1

Try also removing the MyBaseOptions role, as it also contains the corresponding app-related cmdlets. Well, maybe don't remove it directly, as it will affect other functionalities as well, but replace it with a custom role that has the *-App cmdlets removed.

Just to confirm whether this will actually help, can you run the following cmdlet:

1. Via the user who you want to restrict, connect to Exchange Online PowerShell and run the following cmdlet:

Get-Command New-App

1. Via an admin account, run the following:

Get-ManagementRole -Cmdlet New-App

The first cmdlet verifies whether the user has sufficient permissions to run the New-App cmdlet, that is install Outlook add-ins. The second one lists all admin and user roles that have the New-App cmdlet added, you need to make sure that none of these ends up assigned to the user(s).