{
  "id": "CB-M365-TENANT-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-015.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-015",
    "title": "Prevent users from adding Store apps and starting trials",
    "finding": {
      "title": "Users can install Office Store add-ins and start trials for the organization",
      "description": "Users can bring unvetted add-ins and trial services into the tenant, which may read their mail and documents."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365",
      "user-owned-apps",
      "office-store",
      "trials",
      "shadow-it"
    ],
    "description": "In **User owned apps and services**, both options are cleared:\n\n- **Let users access the Office Store** (`isOfficeStoreEnabled` = `false`);\n- **Let users start trials on behalf of your organization** (`isAppAndServicesTrialEnabled` =\n  `false`).\n\nAdd-ins that users need are deployed centrally from **Integrated apps** after review.\n",
    "rationale": "Store add-ins run with the user's access to mail and documents and are published by third\nparties of varying trust. Trials started by users activate services the organization has not\nassessed, with their own data processing terms. Central deployment keeps both under review.\n",
    "impact": "Users can no longer install add-ins from the Office Store or start trials themselves; they ask\nIT. Add-ins already installed keep working until removed. Outlook add-ins are also governed by\nExchange user roles (MAIL domain).\n",
    "notes": "Self-service purchases of products (Power BI Pro, Copilot and others) are managed separately,\nper product, in **Billing** > **Self-service purchases** or with the `MSCommerce` module.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Services** > **User owned apps and\n   services**.\n3. Read-only alternative with Microsoft Graph (beta, scope `OrgSettings-AppsAndServices.Read.All`):\n   `GET https://graph.microsoft.com/beta/admin/appsAndServices` and read\n   `settings.isOfficeStoreEnabled` and `settings.isAppAndServicesTrialEnabled`.\n4. Fail if either option is checked (`true`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft 365 admin center as at least a Global Administrator.\n2. Browse to **Settings** > **Org settings** > **Services** > **User owned apps and\n   services**.\n3. Clear **Let users access the Office Store** and **Let users start trials on behalf of your\n   organization**, then **Save**.\n4. Equivalent with Microsoft Graph (beta, scope `OrgSettings-AppsAndServices.ReadWrite.All`):\n   `PATCH https://graph.microsoft.com/beta/admin/appsAndServices` with\n   `{\"settings\": {\"isOfficeStoreEnabled\": false, \"isAppAndServicesTrialEnabled\": false}}`.\n",
      "rollback": "Check the options again.\n"
    },
    "references": [
      {
        "title": "appsAndServicesSettings resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/appsandservicessettings?view=graph-rest-beta",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage add-ins in the Microsoft 365 admin center",
        "url": "https://learn.microsoft.com/microsoft-365/admin/manage/manage-addins-in-the-admin-center",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage self-service purchases and trials (for admins)",
        "url": "https://learn.microsoft.com/microsoft-365/commerce/subscriptions/manage-self-service-purchases-admins",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-009",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}