{
  "id": "CB-M365-MAIL-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-004.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-004",
    "title": "Prevent users from installing Outlook add-ins",
    "finding": {
      "title": "Users can install Outlook add-ins that read and send their mail",
      "description": "A user tricked into installing a malicious or over-privileged add-in gives a third party access to the content of their mailbox."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "outlook",
      "add-ins",
      "role-assignment-policy",
      "third-party-apps"
    ],
    "description": "The role assignment policies applied to mailboxes do not grant the user roles that allow\ninstalling add-ins: **My Custom Apps**, **My Marketplace Apps** and **My ReadWriteMailbox Apps**.\nAdd-ins the organization needs are deployed centrally by an administrator from **Integrated apps**\nin the Microsoft 365 admin center.\n",
    "rationale": "Outlook add-ins run with the user's mailbox permissions; an add-in with the ReadWriteMailbox\npermission can read, change and send any message. Marketplace add-ins are published by third\nparties and a custom add-in can be side-loaded from a manifest URL sent by an attacker. Central\ndeployment keeps the list of add-ins short, reviewed and known.\n",
    "impact": "Users can no longer add add-ins themselves, including popular ones (meeting tools, CRM\nconnectors). Ask the business which add-ins they use before the change and deploy the approved\nones centrally. Add-ins already installed by users keep working until they are removed.\n",
    "audit": {
      "manual": "1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Roles** > **User roles**. For each role assignment policy (start with **Default\n   Role Assignment Policy**), open **Manage permissions** and check that **My Custom Apps**, **My\n   Marketplace Apps** and **My ReadWriteMailbox Apps** are cleared.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-RoleAssignmentPolicy | Select-Object Name, IsDefault,\n     @{n='AppRoles';e={($_.AssignedRoles | Where-Object { $_ -like 'My*Apps' }) -join ', '}}\n   Get-EXOMailbox -ResultSize Unlimited -Properties RoleAssignmentPolicy |\n     Group-Object RoleAssignmentPolicy | Select-Object Name, Count\n   ```\n4. Fail if a role assignment policy used by at least one mailbox still holds one of the three\n   roles.\n"
    },
    "remediation": {
      "manual": "1. Review the add-ins in use (**Microsoft 365 admin center** > **Settings** > **Integrated apps**)\n   and deploy the approved ones to the relevant users or groups.\n2. In the Exchange admin center, browse to **Roles** > **User roles**, open each role assignment\n   policy in use > **Manage permissions**, clear **My Custom Apps**, **My Marketplace Apps** and\n   **My ReadWriteMailbox Apps**, and save.\n3. PowerShell equivalent (Exchange Administrator), for each policy:\n   ```powershell\n   Get-ManagementRoleAssignment -RoleAssignee \"Default Role Assignment Policy\" |\n     Where-Object { $_.Role -in 'My Custom Apps','My Marketplace Apps','My ReadWriteMailbox Apps' } |\n     Remove-ManagementRoleAssignment -Confirm:$false\n   ```\n",
      "rollback": "Re-add the role to the policy:\n`New-ManagementRoleAssignment -Policy \"Default Role Assignment Policy\" -Role \"My Marketplace Apps\"`.\n"
    },
    "references": [
      {
        "title": "Specify the administrators and users who can install and manage add-ins for Outlook in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/specify-who-can-install-and-manage-add-ins",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1041",
        "url": "https://maester.dev/docs/tests/MT.1041",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7(5)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1137"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-008",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}