CIS.M365.1.3.4: Ensure 'User owned apps and services' is restricted

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.1.3.4
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Microsoft 365
Feature	Organization settings
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 1.3.4 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:1.3.4 nist-800-53-r5:CM-7 Least Functionality nist-800-53-r5:CM-11 User-installed Software
MITRE ATT&CK	T1137.006
Reads from	Microsoft Graph

What this checks and how to fix it

1.3.4 (L1) Ensure ‘User owned apps and services’ is restricted

By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application.

Do not allow users to install add-ins in Word, Excel, or PowerPoint.

Rationale

Attackers commonly use vulnerable and custom-built add-ins to access data in user applications.

While allowing users to install add-ins by themselves does allow them to easily acquire useful add-ins that integrate with Microsoft applications, it can represent a risk if not used and monitored carefully.

Disable future user’s ability to install add-ins in Microsoft Word, Excel, or PowerPoint helps reduce your threat-surface and mitigate this risk.

Impact

Implementation of this change will impact both end users and administrators. End users will not be able to install add-ins that they may want to install.

Remediation action

1. Navigate to Microsoft 365 admin center.
2. Click to expand Settings select Org settings.
3. In Services select User owned apps and services.
4. Uncheck Let users access the Office Store and Let users start trials on behalf of your organization
5. Click Save.

PowerShell

1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes "OrgSettings-AppsAndServices.ReadWrite.All".
2. Run the following Microsoft Graph PowerShell commands:

$uri = "https://graph.microsoft.com/beta/admin/appsAndServices"
$body = @{
    "Settings" = @{
        "isAppAndServicesTrialEnabled" = $false
        "isOfficeStoreEnabled" = $false
    }
} | ConvertTo-Json
Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body

Related links

• Microsoft 365 admin center
• Manage add-ins in the Microsoft 365 admin center
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 59

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: oed-metzb; contributors: Mynster9361. Open-source licences.