Forum Discussion

drogu-kangaroo's avatar
drogu-kangaroo
Copper Contributor
May 22, 2023

New Outlook opens security hole

Hello, We just tested the New Outlook and discovered that it allows users to add personal Gmail accounts to their Outlook profile. We have intentionally blocked 3rd party email services to prevent d...
HeyHey16K's avatar
HeyHey16K
Steel Contributor
We just had this reply from Microsoft support:

I checked with our escalations team, and the feature you are asking for, which is to prevent end users from adding their personal or third-party accounts is being developed. We do not have an exact ETA on when it will be rolled out, but it's a high priority item requested by other enterprise organizations, so hopefully soon.

In the meantime, the workaround to mitigate the security risks is to disable the new Outlook, either by hiding the toggle switch, restricting mailbox connections, or both.

Hope the provided information has addressed your concern,
Regards!
drogu-kangaroo's avatar
drogu-kangaroo
Copper Contributor
Jun 30, 2023

While we wait for Microsoft to provide a way to block 3rd party email from being added by end users, we were able to completely disable New Outlook following the steps in this article: 

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-on-the-web/enable-disable-employee-access-new-outlook 

 

We also deployed a registry change to end users with PowerShell to remove the button from Outlook. Run in user context because the key is HKCU

 

 

Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\office\16.0\Outlook\Options\General' -Name "HideNewOutlookToggle" -Value 1

 



  • OITCONZ's avatar
    OITCONZ
    Copper Contributor
    May 06, 2024
    We have found this fails in some situations. for example, client clicking on a /msg file has the new Outlook Experience wizard pop up even though it used to just let you import / open .msg files. This registry key is not able to resolve all issues with stopping the new Outlook experience
    • Princeds's avatar
      Princeds
      Copper Contributor
      May 22, 2024

      Hello,
      We got the new outlook recently in the client machines, We applied the OWA policy to block the personal email accounts in new outlook . The OWA policy is worked for hotmail and outlook.com, but not for gmail account. Also found another strange behavior that the policy is working as expected, when adding the gmail as a secondary account (My work account is a default one in new outlook),
      However I can able to setup the gmail as a default account (Primary), seems to be the policy is not working in this scenario .

      Is there any fix for this?

Resources