Detections
Analytics

6.3.1 Ensure users installing Outlook add-ins is not allowed

Information

Role assignment policies in Exchange Online control whether users can install and manage add-ins for Outlook. Three management roles govern this capability: My Custom Apps allows users to sideload custom add-ins, My Marketplace Apps allows users to install add-ins from the marketplace, and My ReadWriteMailbox Apps allows users to install add-ins that request read/write mailbox permissions. When these roles are assigned to a user's role assignment policy, users can self-install add-ins in both Outlook desktop and Outlook on the web, granting those add-ins access to mailbox data.

This recommendation applies to the default role assignment policy, which is automatically assigned to new mailboxes unless a custom policy is specified.

Attackers exploit vulnerable or malicious add-ins to read, exfiltrate, or modify mailbox content including email, calendar items, and contacts. Restricting user-installed add-ins reduces this attack surface and centralizes add-in approval with administrators.

Solution

To remediate using the UI:

 - Navigate to Exchange admin center https://admin.exchange.microsoft.com.
 - Click to expand Roles and select User roles.
 - Select Default Role Assignment Policy.
 - In the properties pane on the right click on Manage permissions.
 - Under Other roles uncheck any non-compliant roles: My Custom Apps, My Marketplace Apps, and My ReadWriteMailbox Apps.
 - Click Save changes.

To remediate using PowerShell:

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following script:

$TargetRoles = @(
 "My Custom Apps", "My Marketplace Apps", "My ReadWriteMailbox Apps"
)

$DefaultPolicy = Get-RoleAssignmentPolicy |
 Where-Object { $_.IsDefault -eq $true }

$Assignments = Get-ManagementRoleAssignment -RoleAssignee $DefaultPolicy.Identity |
 Where-Object { $_.Role -in $TargetRoles }

foreach ($Assignment in $Assignments) {
 Remove-ManagementRoleAssignment -Identity $Assignment.Identity -Confirm:$false
}

Impact:

End users will be unable to self-install third-party Outlook add-ins. Administrators may receive requests to evaluate and deploy add-ins on behalf of users. Organizations that rely on user-deployed add-ins for business workflows should inventory those add-ins and deploy them centrally via Centralized Deployment before implementing this recommendation.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-10, 800-53|CM-11, 800-53|SC-18

Plugin: microsoft_azure

Control ID: f56e43a6201ab15d7f5a2645e7de71d7ce8c6011cc7fc49512b47433d3f33fa9