Check ID: exchange_roles_assignment_policy_addins_disabled
Provider: Microsoft 365
Service: exchange
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Exchange Online role assignment policies are assessed for roles that permit installing or managing Outlook add-ins (such as My Marketplace Apps, My Custom Apps, My ReadWriteMailbox Apps, Org Marketplace Apps, Org Custom Apps). Presence of these roles indicates users or admins can deploy add-ins from the store or custom sources.

​
Risk

Allowing add-in installation exposes mailboxes to malicious or vulnerable add-ins. With ReadWriteMailbox, an add-in can read, copy, or alter messages, auto-forward mail, and access tokens, enabling data exfiltration, message tampering, and lateral movement, impacting confidentiality and integrity.

​
Recommendation

Enforce least privilege for add-ins: remove add-in roles from end-user policies, reserve add-in management for trusted admins, and only deploy vetted add-ins via an allowlist. Review role assignment policies regularly to sustain defense in depth and prevent unapproved extensions.

​
Remediation

Get-ManagementRoleAssignment -RoleAssigneeType RoleAssignmentPolicy | Where-Object {$_.Name -like "My Custom Apps-*" -or $_.Name -like "My Marketplace Apps-*" -or $_.Name -like "My ReadWriteMailbox Apps-*"} | Remove-ManagementRoleAssignment -Confirm:$false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_roles_assignment_policy_addins_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks