Contributed by Stefan Wey with Bastien PerezAll contributors →
Part of Maester · Exchange Online · Outlook · All checks
```powershell title="Run this check" Invoke-Maester -TestId MT.1041 ``` ## Overview Users SHOULD NOT be allowed to install Outlook add-ins Rationale: When users can install their own Outlook add-ins, it creates security risks. Malicious add-ins could access email content, exploit vulnerabilities, or facilitate data exfiltration through legitimate-looking add-ins. #### Remediation action 1. Connect to Exchange Online: ```powershell Connect-ExchangeOnline ``` 1. Get the current role assignment policy: ```powershell Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault } ``` 1. Check which app-related roles are assigned: ```powershell Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } ``` 1. Remove the app installation permissions from the default policy: ```powershell Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } | Remove-ManagementRoleAssignment -Confirm:$false ``` 1. Verify the changes: ```powershell Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } ``` The result should return no assignments. #### Related links * [Role-based access control in Exchange Online](https://learn.microsoft.com/exchange/permissions-exo/permissions-exo) * [CIS Microsoft 365 Benchmark - 1.3.4 (L1) Ensure 'User owned apps and services' is restricted](https://www.cisecurity.org/benchmark/microsoft_365) * [Microsoft Secure Score - Restrict user consent to applications](https://security.microsoft.com/securescore) ## Details