Introduction
Outlook Client add-ins have become indispensable tools for enhancing productivity, streamlining workflows, and integrating various services directly into the Outlook interface. However, managing these add-ins across an organisation can pose challenges, especially when ensuring compliance, security, and consistent user experience. This is where Microsoft Intune steps in, offering a robust solution for centralized management of Outlook add-ins.
What Are Outlook Client Add-ins?
Outlook Client Add-ins are lightweight applications that extend the core capabilities of Outlook. These work across platforms—desktop, web, and mobile—and often connect to external services or perform automated tasks.
Common Use Cases
- Zoom or Microsoft Teams Integration – Seamless meeting scheduling.
- Salesforce or HubSpot Add-ins – Real-time CRM data within the inbox.
- Translator Add-in – Instant email translation.
- IRM Tools – Encrypting sensitive communications.
Add-ins can either streamline workflows or open the door to vulnerabilities if not managed properly.
Why Manage Outlook Client Add-ins with Intune?
Challenges Without Management
- Users can install unapproved or risky add-ins.
- Performance can degrade due to unnecessary add-ins.
- Add-ins may conflict with compliance policies.
Benefits of Using Intune
- Centrally control which add-ins are enabled, disabled, or user-configurable.
- Enforce consistency across all managed endpoints.
- Block unmanaged or non-compliant add-ins for enhanced security.
Microsoft Intune allows administrators to enforce policies using the Settings Catalog, providing fine-tuned control over Outlook clients in an enterprise environment.
How to Manage Outlook Client Add-ins Using Microsoft Intune
This walkthrough covers creating and assigning a configuration profile in Intune that manages Outlook add-ins on Windows 10/11 devices.
Step 1: Create a New Profile in Intune
- Go to the Intune Admin Center.
- Navigate to: Devices > Configuration profiles > Create profile
- Choose:
- Platform: Windows 10 and later
- Profile Type: Settings catalog
- Click Create
- Create a discrptive name for the profile
Step 2: Configure Outlook Add-in Settings
In the Configuration settings pane:
- Click Add Settings
- Search for Add-ins
- Under Microsoft Outlook 2016\Miscellaneous, Select:
- Block all unmanaged add-ins (User)
- List of managed add-ins
In this example, we want to block all unmanaged add-ins while allowing the Microsoft Teams add-in to remain enabled. To achieve this, follow these steps:
- Enable “Block all unmanaged add-ins” (User): This setting ensures that all currently installed unmanaged add-ins are disabled and prevents any new unmanaged add-ins from being enabled in the future.
- Enable “List of managed add-ins” (User): Configure this setting to define which add-ins are allowed and managed within Outlook.
Note: Before configuring the list of managed add-ins, you must gather the ProgIDs and corresponding values for the add-ins you wish to allow
Step 3: Identify Add-in ProgIDs
To Identify the Programmatic Identifier (ProgID) for outlook Add-ins. Use Registry Editor on a client machine where the add-in is installed, Each subkey name is the ProgID of the add-in.
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Addins
HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Office\16.0\Outlook\Addins
Also, you can use the following PowerShell command to list installed Outlook add-ins and retrieve ProgIDs:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\Addins\*" |
Select-Object PSChildName
Step 4: Add Managed Add-in Values
When adding entries to the “List of managed add-ins”:
| Value | Meaning | Description |
|---|---|---|
0 | Always Disabled | The add-in is completely blocked and cannot be enabled by the user. |
1 | Always Enabled | The add-in is always active and cannot be disabled by the user. |
2 | User Configurable | The user can choose to enable or disable the add-in. It is not blocked if “Block all unmanaged add-ins” is enabled. |
Note:
If you disable or do not configure this policy, the list of managed add-ins is deleted.
If the “Block all unmanaged add-ins” policy is enabled, any add-in not listed here will be blocked by default.
Step 5: Update the list of Add-ins
Now that you have identified the ProgIDs and understand the different value options, let’s proceed with the configuration. In our example, we want to:
- Always enable the Microsoft Teams add-in
- Allow the user to configure the OneNote add-in
- Block all other add-ins
First, let’s review the current setup in Outlook. Navigate to: File > Options > Add-ins
Here, you will notice that all add-ins are listed as either Active or Inactive—none should appear in the Disabled section at this point.
Now we will update the “List of managed add-ins” (User) setting with the following details:
| Value Name (ProgID) | Value | Meaning |
|---|---|---|
TeamsAddin.FastConnect | 1 | Always Enabled |
OneNote.OutlookAddin | 2 | Configurable by User |
Step 6: Assign the Profile
Once your settings are defined:
- Assign the profile to appropriate groups.
- Click Next through the wizard and review.
- Click Create to deploy the policy.
Note: The user’s device must be restarted for the settings to take effect.
Step 7: Verify That the Configuration Has Been Applied
After restarting the laptop, open Outlook. You should observe the following:
- All unmanaged add-ins have been moved to the Disabled section.
- Only the Microsoft Teams and OneNote add-ins remain enabled.
To verify the behavior, Click on Manage COM Add-ins.
You will notice:
The OneNote add-in can be disabled by the user, as it is configured to be user-configurable.
The Teams add-in cannot be disabled—this is because it is configured to be always enabled.
Best Practices for Outlook Client Add-in Management
- Audit Add-ins Regularly
Use tools like Office Telemetry or PowerShell scripts to identify active add-ins. - Whitelisting Over Blacklisting
Specify what’s allowed rather than what’s blocked—simplifies management. - User Experience Matters
Allow power users to configure non-essential but helpful add-ins. - Document ProgIDs
Maintain a central record of approved add-ins and their ProgIDs for easy reference. - Test Before Rollout
Deploy to pilot groups before organisation-wide rollout.
Conclusion
Managing Outlook client add-ins using Intune not only strengthens security but also ensures consistency and performance across your enterprise. By controlling which add-ins are enabled, disabled, or user-configurable, IT teams can avoid headaches down the line while enhancing end-user productivity.
