CIS.M365.6.3.1 - (L2) Ensure users installing Outlook add-ins is not allowed
Overview
The default role assignment policy does not grant users the roles that let them install Outlook add-ins.
An Outlook add-in can read and change mail. A malicious or over-privileged add-in, installed by a user who was persuaded to, gives an attacker access to the mailbox without a password. Restricting installation to administrators lets you review the add-in first. An add-in runs inside Outlook each time it starts (T1137.006), and one that can read mail can collect it through the Exchange APIs for someone else (T1114.002).
The test checks the My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps roles in the default role assignment policy, which is the policy CIS audits. Custom role assignment policies are outside this recommendation's audit scope. Users who need an add-in can get one deployed by an administrator through Integrated apps.
Remediation action
- Sign in to the Exchange admin center.
- Go to Roles > User roles > Default Role Assignment Policy.
- Clear My Custom Apps, My Marketplace Apps and My ReadWriteMailbox Apps.
- Select Save changes.
Related links
- Exchange admin center - User roles
- Specify the add-ins that users can install
- Manage add-ins in the Microsoft 365 admin center
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.3.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | Applications and workload identities |
| Resource type | Policy |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1137.006 Add-ins, T1114.002 Remote Email Collection |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.3.1 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:6.3.1, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCisUserCannotInstallOutlookAddIn |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.3.1.md