If you want to retain control over what your staff can install you will need to disable the GET ADD-INS button in Outlook. Unfortunately there is no ready made GPO toggle GET ADD-INS off.
To give you a false sense of security, there is a setting in the Office 365 Exchange Management Console to disable “User owned Apps and Services” with options for “Let people in your organization go to the Office Store” and “Let users install trial apps and services”. However, all that does it block access to the Office Store when staff surf directly to the web page STORE.OFFICE.COM and try to install something. It does not disable the GET ADD-INS button and it does not stop users from installing add-ins.
After digging through many posts and suggestions I gave up and worked with Microsoft support for about a week. Eventually, they came up with a registry entry that functions. I have tested in on both Outlook 2016 and 2019.
COMMAND LINE:
reg add HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\Webext /v StoreButtonInRibbonHomeTabAllowed /t reg_dword /d 0 /f
GROUP POLICY:
Launch Group Policy Management Console (GPMC)- Create a new GPO or edit an existing one
- Expand USER CONFIGURATION > PREFERENCES > WINDOWS SETTINGS > REGISTRY
- Right click in the blank space in the REGISTRY pane and select NEW > REGISTRY ITEM
- Set ACTIONS to UPDATE
- Set HIVE to HKEY_CURRENT_USER
- Set KEY PATH to
Software\Microsoft\Office\16.0\Outlook\Options\Webext - Set VALUE NAME to
StoreButtonInRibbonHomeTabAllowed - Set VALUE TYPE to REG_DWORD
- Set VALUE DATA to 0 (zero) and click OK to finish
Close Outlook and force a replication use GPUDATE /FORCE (not as an Admin because this is a local user) or reboot and you will see that the GET ADD-INS button is not just disabled, it is removed all together. Note that we have noticed that the first time Outlook is started it takes an extra minute or two, which is very strange but acceptable.
11 Comments
flowchart · June 18, 2023 at 1:48 am
Very nice artіcle, totally what I was looking for.
Kerry · May 20, 2021 at 3:10 pm
Thank you!
Ian Matthews · June 2, 2021 at 6:42 pm
Glad it helped Kerry. Have a good one.
Chris K. · January 20, 2021 at 9:48 am
While the current Outlook 2016 ADMX does now include a policy for setting this reg key (removing from the Main ribbon), “Office Add-ins” is still available and not greyed out under the Message ribbon of email messages. If you open a new email, you will still see “Office Add-ins” button still available and useable. This appears to be a major oversite from Microsoft on this policy.
John Doe · June 19, 2020 at 5:58 am
Thank you very much for this article. I was searching for this for a long time and nearly gave up, but this registry entry is exactly what I needed. *twothumbsup*
Kai · December 2, 2019 at 6:02 am
Is there a way to only allow admin-managed add-ins? The user should be able to see “get Add-ins” but should not be able to get Add-ins from the store.
Ian Matthews · December 27, 2019 at 8:20 pm
Hi Kai; Yes, I think you can apply a filter to the GPO see: https://www.urtech.ca/2019/08/solved-how-to-push-a-user-gpo-to-only-some-computers/
Taylor Harris · August 5, 2019 at 12:04 pm
This is not currently accurate information, as Microsoft’s Office 2016/2019/365 ADMX templates DO have a policy setting that controls exactly the registry key and option mentioned in this article. The policy setting is labeled: “Hide the Office Store button”.
I just downloaded the templates today and found it in the included Excel documentation. In addition to hiding the Store button from the Home ribbon, it also hides the “Get more apps” recommendation in the Action Items toolbar that appears at the top of messages.
Ian Matthews · August 6, 2019 at 2:37 pm
There are actually three places to disable GET ADD-INS. 1: website 2: Outlook 3: OWA. I am still working on OWA with MS Partner Support and hope to have a complete doc ready in few days.
Peter Holdridge · May 18, 2022 at 11:50 am
Any luck on OWA Ian?
Ian Matthews · June 2, 2022 at 9:34 pm
Sorry, no Peter – I have not had access in a while… just too busy with other server work – working 12+ hours a day.