We recently had the question to restrict users from installing Office add-ins. Users were able to install third party add-ins in for example the Outlook client or in Office Web Access. We thought we had set the correct settings but it turned out we missed a few. After some browsing and testing we found the correct settings to disable users from installing them. There were two settings we applied and one of them was in the Office 365 admin portal and the other one was at the Exchange Admin Center. This post is not to hide the store or the add-in button but only to disable users from installing them.
Installing Office add-ins
A user can install add-ins on multiple ways:
1. From the appsource website https://store.office.com/
2. From an Office application
3. From Outlook Web Access
Restricting users from adding or installing Office add-ins
We need to change settings on two places.
1. Services & add-ins
Changing the settings in services & add-ins will restrict the user from logging in to the appsource portal to add add-ins using that way.
Go to Settings –> Services & add-ins and then ‘User owned apps and services’
uncheck both options and save the changes
2. Exchange Admin Center
Changing the settings in the Exchange Admin Center will restrict users from adding add-ins in the Office application and Outlook Web Access.
Go to user roles
You can add a new role assignment policy and apply it first to a subset of users. You can also change the default role assignment policy.
Disable ‘My Custom Apps’, ‘My Marketplace Apps’, ‘My ReadWriteMailbox Apps’ and save the policy.
Testing the settings
It may take some time before the policies are being applied to all users but you can try adding an add-in using Outlook Web Access.
