CIS.M365.6.3.1 - (L2) Ensure users installing Outlook add-ins is not allowed
Overview
Users cannot install Outlook add-ins on their own, because the default role assignment policy lacks the roles that allow it.
An Outlook add-in can read and change mail. A malicious or over-privileged add-in, installed by a user who was persuaded to, gives an attacker access to the mailbox without a password. Restricting installation to administrators lets you review the add-in first. An add-in runs inside Outlook each time it starts (T1137.006), and one that can read mail can collect it through the Exchange APIs for someone else (T1114.002).
The test checks the My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps roles in the default role assignment policy and in each custom policy that is assigned to a mailbox. Users who need an add-in can get one deployed by an administrator through Integrated apps.
Remediation action
- Sign in to the Exchange admin center.
- Go to Roles > User roles > Default Role Assignment Policy.
- Clear My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps.
- Select Save changes.
- Repeat steps 2 to 4 for each custom role assignment policy that the test lists.
Related links
- Exchange admin center - User roles
- Specify the add-ins that users can install
- Manage add-ins in the Microsoft 365 admin center
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.3.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | Applications and workload identities |
| Resource type | Policy |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1137.006 Add-ins, T1114.002 Remote Email Collection |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.3.1 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:6.3.1, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCisUserCannotInstallOutlookAddIn |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.3.1.md