Prevent users from adding Store apps and starting trials

Description

In User owned apps and services, both options are cleared:

• Let users access the Office Store (isOfficeStoreEnabled = false);
• Let users start trials on behalf of your organization (isAppAndServicesTrialEnabled = false).

Add-ins that users need are deployed centrally from Integrated apps after review.

Self-service purchases of products (Power BI Pro, Copilot and others) are managed separately, per product, in Billing > Self-service purchases or with the MSCommerce module.

Rationale

Store add-ins run with the user's access to mail and documents and are published by third parties of varying trust. Trials started by users activate services the organization has not assessed, with their own data processing terms. Central deployment keeps both under review.

Impact

Users can no longer install add-ins from the Office Store or start trials themselves; they ask IT. Add-ins already installed keep working until removed. Outlook add-ins are also governed by Exchange user roles (MAIL domain).

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Org settings > Services > User owned apps and services.
3. Read-only alternative with Microsoft Graph (beta, scope OrgSettings-AppsAndServices.Read.All): GET https://graph.microsoft.com/beta/admin/appsAndServices and read settings.isOfficeStoreEnabled and settings.isAppAndServicesTrialEnabled.
4. Fail if either option is checked (true).

Remediation

1. Sign in to the Microsoft 365 admin center as at least a Global Administrator.
2. Browse to Settings > Org settings > Services > User owned apps and services.
3. Clear Let users access the Office Store and Let users start trials on behalf of your organization, then Save.
4. Equivalent with Microsoft Graph (beta, scope OrgSettings-AppsAndServices.ReadWrite.All): PATCH https://graph.microsoft.com/beta/admin/appsAndServices with {"settings": {"isOfficeStoreEnabled": false, "isAppAndServicesTrialEnabled": false}}.

Rollback

Check the options again.

References

• appsAndServicesSettings resource type Microsoft, vendor-doc, accessed 2026-10-24
• Manage add-ins in the Microsoft 365 admin center Microsoft, vendor-doc, accessed 2026-10-24
• Manage self-service purchases and trials (for admins) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-009 Disable self-service sign-up to the tenant
• related CB-M365-MAIL-004 Prevent users from installing Outlook add-ins

People and lifecycle