Hi Sreeram Ramamoorthy, thank you for the description. I tried this setup again:
User Role Policy in ECP "Add-ins Whitelisted":
[x] My ReadWriteMailbox Apps (checked)
[ ] My Marketplace Apps (unchecked)
[ ] My Custom Apps (unchecked)
This policy is assigned to my user.
Then through the O365 Admin Center I chose the "Services & Add-ins" to start the centralized deployment.
Deploy Add-In > I want to add an Add-In from the Office Store > Evernote > Optional, disabled > Deploy to group test_outlookaddins
My user is a member of the "test_outlookaddins" group (security group), top level.
I also tested the "Optional, enabled" and "mandatory" setting of the deployment. But nothing works, if I try to install an Add-in in Outlook (fat client) which I deployed, I always get the message "Access denied. Contact your administrator". I waited around 15 minutes every time after changing the policy or deploying an add-in.
Is this an expected behaviour? Otherwise I can open a case with Microsoft.