MT.1041: Ensure users installing Outlook add-ins is not allowed

ID	MT.1041
Severity	Medium
Suite	Mito
Product	Exchange Online
Feature	Outlook
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Framework controls	nist-800-53-r5:CM-7 Least Functionality nist-800-53-r5:CM-11 User-installed Software
MITRE ATT&CK	T1137.006, T1114.002
Reads from	Exchange Online

What this checks and how to fix it

Users SHOULD NOT be allowed to install Outlook add-ins

Rationale: When users can install their own Outlook add-ins, it creates security risks. Malicious add-ins could access email content, exploit vulnerabilities, or facilitate data exfiltration through legitimate-looking add-ins.

Remediation action

1. Connect to Exchange Online:

Connect-ExchangeOnline

1. Get the current role assignment policy:

Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault }

1. Check which app-related roles are assigned:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }

1. Remove the app installation permissions from the default policy:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" } | Remove-ManagementRoleAssignment -Confirm:$false

1. Verify the changes:

Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | Where-Object { $_.Role -like "My*Apps" }

The result should return no assignments.

Related links

• Role-based access control in Exchange Online
• CIS Microsoft 365 Benchmark - 1.3.4 (L1) Ensure ‘User owned apps and services’ is restricted
• Microsoft Secure Score - Restrict user consent to applications

---

Mito check. Author: weyCC81; contributors: bastienperez. Open-source licences.