MT.1041 - Ensure users installing Outlook add-ins is not allowed

Contributed by Stefan Wey with Bastien PerezAll contributors →

Overview

Users SHOULD NOT be allowed to install Outlook add-ins

Rationale: When users can install their own Outlook add-ins, it creates security risks. Malicious add-ins could access email content, exploit vulnerabilities, or facilitate data exfiltration through legitimate-looking add-ins.

Remediation action

1. Connect to Exchange Online:

Connect-ExchangeOnline

1. Get the current role assignment policy:

Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault }

1. Check which app-related roles are assigned:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }

1. Remove the app installation permissions from the default policy:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } | Remove-ManagementRoleAssignment -Confirm:$false

1. Verify the changes:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }

The result should return no assignments.

Related links

• Role-based access control in Exchange Online
• CIS Microsoft 365 Benchmark - 1.3.4 (L1) Ensure 'User owned apps and services' is restricted
• Microsoft Secure Score - Restrict user consent to applications

Test Metadata

Field	Value
Test ID	MT.1041
Severity	Medium
Suite	Maester
Product	Exchange Online
Feature	Outlook
Area	Applications and workload identities
Resource type	Policy
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1137.006 Add-ins, T1114.002 Remote Email Collection
Supports controls	nist-800-53-r5:CM-7, nist-800-53-r5:CM-11
PowerShell test	Test-MtExoOutlookAddin
Services	ExchangeOnline

Source

• Test: tests/maester/exchange/Test.MT.1041.ps1
• Documentation: tests/maester/exchange/Test.MT.1041.md